Cisco ASA 5506-X User manual

Cisco Systems, Inc.
www.cisco.com
Cisco has more than 200 offices worldwide.
Addresses, phone numbers, and fax numbers
are listed on the Cisco website at
www.cisco.com/go/offices.
Cisco ASA Series Firewall CLI
Configuration Guide
Software Version 9.3
For the ASA 5506-X, ASA 5512-X, ASA 5515-X, ASA 5525-X, ASA 5545-X, ASA
5555-X, ASA 5585-X, ASA Services Module, and the
Adaptive Security Virtual Appliance
Released: July 24, 2014
Updated: February 18, 2015
Text Part Number: N/A, Online only

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL
STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT
WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT
SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE
OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public
domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH
ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT
LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF
DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,
WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO
OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this
URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership
relationship between Cisco and any other company. (1110R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display
output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in
illustrative content is unintentional and coincidental.
Cisco ASA Series Firewall CLI Configuration Guide
Copyright © 2015 Cisco Systems, Inc. All rights reserved.

iii
Cisco ASA Series Firewall CLI Configuration Guide
About This Guide
•Document Objectives, page iii
•Related Documentation, page iii
•Conventions, page iii
•Obtaining Documentation and Submitting a Service Request, page iv
Document Objectives
The purpose of this guide is to help you configure the firewall features for Cisco ASA series using the
command-line interface. This guide does not cover every feature, but describes only the most common
configuration scenarios.
You can also configure and monitor the ASA by using the Adaptive Security Device Manager (ASDM),
a web-based GUI application. ASDM includes configuration wizards to guide you through some
common configuration scenarios, and online help for less common scenarios.
Throughout this guide, the term “ASA” applies generically to supported models, unless specified
otherwise.
Related Documentation
For more information, see Navigating the Cisco ASA Series Documentation at
http://www.cisco.com/go/asadocs.
Conventions
This document uses the following conventions:
Convention Indication
bold font Commands and keywords and user-entered text appear in bold font.
italic font Document titles, new or emphasized terms, and arguments for which you supply
values are in italic font.
[ ] Elements in square brackets are optional.

iv
Cisco ASA Series Firewall CLI Configuration Guide
Obtaining Documentation and Submitting a Service Request
Note Means reader take note.
Tip Means the following information will help you solve a problem.
Caution Means reader be careful. In this situation, you might perform an action that could result in equipment
damage or loss of data.
Obtaining Documentation and Submitting a Service Request
For information on obtaining documentation, using the Cisco Bug Search Tool (BST), submitting a
service request, and gathering additional information, see What’s New in Cisco Product Documentation
at: http://www.cisco.com/c/en/us/td/docs/general/whatsnew/whatsnew.html.
Subscribe to What’s New in Cisco Product Documentation, which lists all new and revised
Cisco technical documentation as an RSS feed and delivers content directly to your desktop using a
reader application. The RSS feeds are a free service.
{x | y | z } Required alternative keywords are grouped in braces and separated by
vertical bars.
[ x | y | z ] Optional alternative keywords are grouped in brackets and separated by
vertical bars.
string A nonquoted set of characters. Do not use quotation marks around the string or
the string will include the quotation marks.
courier font Terminal sessions and information the system displays appear in courier font.
courier bold font Commands and keywords and user-entered text appear in bold courier font.
courier italic font Arguments for which you supply values are in courier italic font.
< > Nonprinting characters such as passwords are in angle brackets.
[ ] Default responses to system prompts are in square brackets.
!, # An exclamation point (!) or a pound sign (#) at the beginning of a line of code
indicates a comment line.

P ART 1
Service Policies and Access Control

CHAPTER
1-1
Cisco ASA Series Firewall CLI Configuration Guide
1
Service Policy Using the Modular Policy
Framework
Released: July 24, 2014
Updated: February 18, 2015
Service policies using Modular Policy Framework provide a consistent and flexible way to configure
ASA features. For example, you can use a service policy to create a timeout configuration that is specific
to a particular TCP application, as opposed to one that applies to all TCP applications. A service policy
consists of multiple actions or rules applied to an interface or applied globally.
•About Service Policies, page 1-1
•Guidelines for Service Policies, page 1-8
•Defaults for Service Policies, page 1-9
•Configure Service Policies, page 1-11
•Monitoring Service Policies, page 1-19
•Examples for Service Policies (Modular Policy Framework), page 1-19
•History for Service Policies, page 1-22
About Service Policies
The following topics describe how service policies work.
•The Components of a Service Policy, page 1-2
•Features Configured with Service Policies, page 1-4
•Feature Directionality, page 1-4
•Feature Matching Within a Service Policy, page 1-5
•Order in Which Multiple Feature Actions are Applied, page 1-6
•Incompatibility of Certain Feature Actions, page 1-7
•Feature Matching for Multiple Service Policies, page 1-8

1-2
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 1 Service Policy Using the Modular Policy Framework
About Service Policies
The Components of a Service Policy
The point of service policies is to apply advanced services to the traffic you are allowing. Any traffic
permitted by access rules can have service policies applied, and thus receive special processing, such as
being redirected to a service module or having application inspection applied.
You can have these types of service policy:
•One global policy that gets applied to all interfaces.
•One service policy applied per interface. The policy can be a mix of classes for traffic going through
the device and management traffic directed at the ASA interface rather than going through it,
Each service policy is composed of the following elements:
1. Service policy map, which is the ordered set of rules, and is named on the service-policy command.
In ASDM, the policy map is represented as a folder on the Service Policy Rules page.
2. Rules, each rule being a class command within the service policy map and the commands associated
with the class command. In ASDM, each rule is shown on a separate row, and the name of the rule
is the class name.
a. The class command defines the traffic matching criteria for the rule.
b. The commands associated with class, such as inspect, set connection timeout, and so forth,
define the services and constraints to apply to matching traffic. Note that inspect commands can
point to inspection policy maps, which define actions to apply to inspected traffic. Keep in mind
that inspection policy maps are not the same as service policy maps.
The following example compares how service policies appear in the CLI with how they appear in ASDM.
Note that there is not a one-to-one mapping between the figure call-outs and lines in the CLI.
The following CLI is generated by the rules shown in the figure above.
: Access lists used in class maps.
: In ASDM, these map to call-out 3, from the Match to the Time fields.
access-list inside_mpc line 1 extended permit tcp 10.100.10.0 255.255.255.0 any eq sip
access-list inside_mpc_1 line 1 extended deny udp host 10.1.1.15 any eq snmp
access-list inside_mpc_1 line 2 extended permit udp 10.1.1.0 255.255.255.0 any eq snmp
access-list inside_mpc_2 line 1 extended permit icmp any any
: SNMP map for SNMP inspection. Denies all by v3.
: In ASDM, this maps to call-out 4, rule actions, for the class-inside policy.
snmp-map snmp-v3only
deny version 1
deny version 2
deny version 2c
: Inspection policy map to define SIP behavior.
: The sip-high inspection policy map must be referred to by an inspect sip command

1-3
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 1 Service Policy Using the Modular Policy Framework
About Service Policies
: in the service policy map.
: In ASDM, this maps to call-out 4, rule actions, for the sip-class-inside policy.
policy-map type inspect sip sip-high
parameters
rtp-conformance enforce-payloadtype
no traffic-non-sip
software-version action mask log
uri-non-sip action mask log
state-checking action drop-connection log
max-forwards-validation action drop log
strict-header-validation action drop log
: Class map to define traffic matching for the inside-class rule.
: In ASDM, this maps to call-out 3, from the Match to the Time fields.
class-map inside-class
match access-list inside_mpc_1
: Class map to define traffic matching for the sip-class-inside rule.
: In ASDM, this maps to call-out 3, from the Match to the Time fields.
class-map sip-class-inside
match access-list inside_mpc
: Class map to define traffic matching for the inside-class1 rule.
: In ASDM, this maps to call-out 3, from the Match to the Time fields.
class-map inside-class1
match access-list inside_mpc_2
: Policy map that actually defines the service policy rule set named test-inside-policy.
: In ASDM, this corresponds to the folder at call-out 1.
policy-map test-inside-policy
: First rule in test-inside-policy, named sip-class-inside. Inspects SIP traffic.
: The sip-class-inside rule applies the sip-high inspection policy map to SIP inspection.
: In ASDM, each rule corresponds to call-out 2.
class sip-class-inside
inspect sip sip-high
: Second rule, inside-class. Applies SNMP inspection using an SNMP map.
class inside-class
inspect snmp snmp-v3only
: Third rule, inside-class1. Applies ICMP inspection.
class inside-class1
inspect icmp
: Fourth rule, class-default. Applies connection settings and enables user statistics.
class class-default
set connection timeout embryonic 0:00:30 half-closed 0:10:00 idle 1:00:00
reset dcd 0:15:00 5
user-statistics accounting
: The service-policy command applies the policy map rule set to the inside interface.
: This command activates the policies.
service-policy test-inside-policy interface inside

1-4
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 1 Service Policy Using the Modular Policy Framework
About Service Policies
Features Configured with Service Policies
The following table lists the features you configure using service policies.
Feature Directionality
Actions are applied to traffic bidirectionally or unidirectionally depending on the feature. For features
that are applied bidirectionally, all traffic that enters or exits the interface to which you apply the policy
map is affected if the traffic matches the class map for both directions.
Table 1-1 Features Configured with Service Policies
Feature
For Through
Traffic?
For Management
Traffic? See:
Application inspection (multiple
types)
All except
RADIUS
accounting
RADIUS
accounting only
•Chapter 6, “Getting Started with Application
Layer Protocol Inspection.”
•Chapter 7, “Inspection of Basic Internet
Protocols.”
•Chapter 8, “Inspection for Voice and Video
Protocols.”
•Chapter 9, “Inspection of Database and Directory
Protocols.”
•Chapter 10, “Inspection for Management
Application Protocols.”
•Chapter 14, “ASA and Cisco Cloud Web
Security.”
ASA IPS Yes No Chapter 18, “ASA IPS Module.”
ASA CX Yes No Chapter 17, “ASA CX Module.”
ASA FirePOWER (ASA SFR) Yes No Chapter 16, “ASA FirePOWER (SFR) Module.”
NetFlow Secure Event Logging
filtering
Ye s Ye s See the general operations configuration guide.
QoS input and output policing Yes No Chapter 12, “Quality of Service.”
QoS standard priority queue Yes No Chapter 12, “Quality of Service.”
TCP and UDP connection limits
and timeouts, and TCP sequence
number randomization
Ye s Ye s Chapter 11, “Connection Settings.”
TCP normalization Yes No Chapter 11, “Connection Settings.”
TCP state bypass Yes No Chapter 11, “Connection Settings.”
User statistics for Identity
Firewall
Ye s Ye s See the user-statistics command in the command
reference.

1-5
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 1 Service Policy Using the Modular Policy Framework
About Service Policies
Note When you use a global policy, all features are unidirectional; features that are normally bidirectional
when applied to a single interface only apply to the ingress of each interface when applied globally.
Because the policy is applied to all interfaces, the policy will be applied in both directions so
bidirectionality in this case is redundant.
For features that are applied unidirectionally, for example QoS priority queue, only traffic that enters (or
exits, depending on the feature) the interface to which you apply the policy map is affected. See the
following table for the directionality of each feature.
Feature Matching Within a Service Policy
A packet matches class maps in a policy map for a given interface according to the following rules:
1. A packet can match only one class map in the policy map for each feature type.
2. When the packet matches a class map for a feature type, the ASA does not attempt to match it to any
subsequent class maps for that feature type.
3. If the packet matches a subsequent class map for a different feature type, however, then the ASA
also applies the actions for the subsequent class map, if supported. See Incompatibility of Certain
Feature Actions, page 1-7 for more information about unsupported combinations.
Note Application inspection includes multiple inspection types, and most are mutually exclusive.
For inspections that can be combined, each inspection is considered to be a separate feature.
Table 1-2 Feature Directionality
Feature Single Interface Direction Global Direction
Application inspection (multiple types) Bidirectional Ingress
ASA CSC Bidirectional Ingress
ASA CX Bidirectional Ingress
ASA CX authentication proxy Ingress Ingress
ASA FirePOWER (ASA SFR) Bidirectional Ingress
ASA IPS Bidirectional Ingress
NetFlow Secure Event Logging filtering N/A Ingress
QoS input policing Ingress Ingress
QoS output policing Egress Egress
QoS standard priority queue Egress Egress
TCP and UDP connection limits and timeouts,
and TCP sequence number randomization
Bidirectional Ingress
TCP normalization Bidirectional Ingress
TCP state bypass Bidirectional Ingress
User statistics for Identity Firewall Bidirectional Ingress

1-6
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 1 Service Policy Using the Modular Policy Framework
About Service Policies
Examples of Packet Matching
For example:
•If a packet matches a class map for connection limits, and also matches a class map for an
application inspection, then both actions are applied.
•If a packet matches a class map for HTTP inspection, but also matches another class map that
includes HTTP inspection, then the second class map actions are not applied.
•If a packet matches a class map for HTTP inspection, but also matches another class map that
includes FTP inspection, then the second class map actions are not applied because HTTP and FTP
inspections cannot be combined.
•If a packet matches a class map for HTTP inspection, but also matches another class map that
includes IPv6 inspection, then both actions are applied because the IPv6 inspection can be combined
with any other type of inspection.
Order in Which Multiple Feature Actions are Applied
The order in which different types of actions in a policy map are performed is independent of the order
in which the actions appear in the policy map.
Actions are performed in the following order:
1. QoS input policing
2. TCP normalization, TCP and UDP connection limits and timeouts, TCP sequence number
randomization, and TCP state bypass.
Note When a the ASA performs a proxy service (such as AAA or CSC) or it modifies the TCP
payload (such as FTP inspection), the TCP normalizer acts in dual mode, where it is applied
before and after the proxy or payload modifying service.
3. ASA CSC
4. Application inspections that can be combined with other inspections:
a. IPv6
b. IP options
c. WAAS
5. Application inspections that cannot be combined with other inspections. See Incompatibility of
Certain Feature Actions, page 1-7 for more information.
6. ASA IPS
7. ASA CX
8. ASA FirePOWER (ASA SFR)
9. QoS output policing
10. QoS standard priority queue
Note NetFlow Secure Event Logging filtering and User statistics for Identity Firewall are order-independent.

1-7
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 1 Service Policy Using the Modular Policy Framework
About Service Policies
Incompatibility of Certain Feature Actions
Some features are not compatible with each other for the same traffic. The following list might not
include all incompatibilities; for information about compatibility of each feature, see the chapter or
section for the feature:
•You cannot configure QoS priority queuing and QoS policing for the same set of traffic.
•Most inspections should not be combined with another inspection, so the ASA only applies one
inspection if you configure multiple inspections for the same traffic. HTTP inspection can be
combined with the Cloud Web Security inspection. Other exceptions are listed in Order in Which
Multiple Feature Actions are Applied, page 1-6.
•You cannot configure traffic to be sent to multiple modules, such as the ASA CX and ASA IPS.
•HTTP inspection is not compatible with ASA CX or ASA FirePOWER.
•Cloud Web Security is not compatible with ASA CX or ASA FirePOWER.
Note The match default-inspection-traffic command, which is used in the default global policy, is a special
CLI shortcut to match the default ports for all inspections. When used in a policy map, this class map
ensures that the correct inspection is applied to each packet, based on the destination port of the traffic.
For example, when UDP traffic for port 69 reaches the ASA, then the ASA applies the TFTP inspection;
when TCP traffic for port 21 arrives, then the ASA applies the FTP inspection. So in this case only, you
can configure multiple inspections for the same class map. Normally, the ASA does not use the port
number to determine which inspection to apply, thus giving you the flexibility to apply inspections to
non-standard ports, for example.
This traffic class does not include the default ports for Cloud Web Security inspection (80 and 443).
An example of a misconfiguration is if you configure multiple inspections in the same policy map and
do not use the default-inspection-traffic shortcut. In Example 1-1, traffic destined to port 21 is
mistakenly configured for both FTP and HTTP inspection. In Example 1-2, traffic destined to port 80 is
mistakenly configured for both FTP and HTTP inspection. In both cases of misconfiguration examples,
only the FTP inspection is applied, because FTP comes before HTTP in the order of inspections applied.
Example 1-1 Misconfiguration for FTP packets: HTTP Inspection Also Configured
class-map ftp
match port tcp eq 21
class-map http
match port tcp eq 21 [it should be 80]
policy-map test
class ftp
inspect ftp
class http
inspect http
Example 1-2 Misconfiguration for HTTP packets: FTP Inspection Also Configured
class-map ftp
match port tcp eq 80 [it should be 21]
class-map http
match port tcp eq 80
policy-map test
class ftp

1-8
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 1 Service Policy Using the Modular Policy Framework
Guidelines for Service Policies
inspect ftp
class http
inspect http
Feature Matching for Multiple Service Policies
For TCP and UDP traffic (and ICMP when you enable stateful ICMP inspection), service policies
operate on traffic flows, and not just individual packets. If traffic is part of an existing connection that
matches a feature in a policy on one interface, that traffic flow cannot also match the same feature in a
policy on another interface; only the first policy is used.
For example, if HTTP traffic matches a policy on the inside interface to inspect HTTP traffic, and you
have a separate policy on the outside interface for HTTP inspection, then that traffic is not also inspected
on the egress of the outside interface. Similarly, the return traffic for that connection will not be
inspected by the ingress policy of the outside interface, nor by the egress policy of the inside interface.
For traffic that is not treated as a flow, for example ICMP when you do not enable stateful ICMP
inspection, returning traffic can match a different policy map on the returning interface. For example, if
you configure IPS on the inside and outside interfaces, but the inside policy uses virtual sensor 1 while
the outside policy uses virtual sensor 2, then a non-stateful Ping will match virtual sensor 1 outbound,
but will match virtual sensor 2 inbound.
Guidelines for Service Policies
IPv6 Guidelines
Supports IPv6 for the following features:
•Application inspection for DNS, FTP, HTTP, ICMP, ScanSafe, SIP, SMTP, IPsec-pass-thru, and
IPv6.
•ASA IPS
•ASA CX
•ASA FirePOWER
•NetFlow Secure Event Logging filtering
•TCP and UDP connection limits and timeouts, TCP sequence number randomization
•TCP normalization
•TCP state bypass
•User statistics for Identity Firewall
Class Map (Traffic Class) Guidelines
The maximum number of class maps (traffic classes) of all types is 255 in single mode or per context in
multiple mode. Class maps include the following types:
•Layer 3/4 class maps (for through traffic and management traffic).
•Inspection class maps
•Regular expression class maps
•match commands used directly underneath an inspection policy map

1-9
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 1 Service Policy Using the Modular Policy Framework
Defaults for Service Policies
This limit also includes default class maps of all types, limiting user-configured class maps to
approximately 235. See Default Class Maps (Traffic Classes), page 1-11.
Policy Map Guidelines
See the following guidelines for using policy maps:
•You can only assign one policy map per interface. However you can create up to 64 policy maps in
the configuration.
•You can apply the same policy map to multiple interfaces.
•You can identify up to 63 Layer 3/4 class maps in a Layer 3/4 policy map.
•For each class map, you can assign multiple actions from one or more feature types, if supported.
See Incompatibility of Certain Feature Actions, page 1-7.
Service Policy Guidelines
•Interface service policies take precedence over the global service policy for a given feature. For
example, if you have a global policy with FTP inspection, and an interface policy with TCP
normalization, then both FTP inspection and TCP normalization are applied to the interface.
However, if you have a global policy with FTP inspection, and an interface policy with FTP
inspection, then only the interface policy FTP inspection is applied to that interface.
•You can only apply one global policy. For example, you cannot create a global policy that includes
feature set 1, and a separate global policy that includes feature set 2. All features must be included
in a single policy.
•When you make service policy changes to the configuration, all new connections use the new service
policy. Existing connections continue to use the policy that was configured at the time of the
connection establishment. Output for the show command will not include data about the old
connections.
For example, if you remove a QoS service policy from an interface, then add a modified version,
then the show service-policy command only displays QoS counters associated with new
connections that match the new service policy; existing connections on the old policy no longer
show in the command output.
To ensure that all connections use the new policy, you need to disconnect the current connections so
they can reconnect using the new policy. Use the clear conn or clear local-host commands.
Defaults for Service Policies
The following topics describe the default settings for service policies and the Modular Policy
Framework:
•Default Service Policy Configuration, page 1-10
•Default Class Maps (Traffic Classes), page 1-11

1-10
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 1 Service Policy Using the Modular Policy Framework
Defaults for Service Policies
Default Service Policy Configuration
By default, the configuration includes a policy that matches all default application inspection traffic and
applies certain inspections to the traffic on all interfaces (a global policy). Not all inspections are enabled
by default. You can only apply one global policy, so if you want to alter the global policy, you need to
either edit the default policy or disable it and apply a new one. (An interface policy overrides the global
policy for a particular feature.)
The default policy includes the following application inspections:
•DNS
•FTP
•H323 (H225)
•H323 (RAS)
•RSH
•RTSP
•ESMTP
•SQLnet
•Skinny (SCCP)
•SunRPC
•XDMCP
•SIP
•NetBios
•TFTP
•IP Options
The default policy configuration includes the following commands:
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
dns-guard
protocol-enforcement
nat-rewrite
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225 _default_h323_map
inspect h323 ras _default_h323_map
inspect ip-options _default_ip_options_map
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp _default_esmtp_map
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip

1-11
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 1 Service Policy Using the Modular Policy Framework
Configure Service Policies
inspect xdmcp
service-policy global_policy global
Note See Incompatibility of Certain Feature Actions, page 1-7 for more information about the special match
default-inspection-traffic command used in the default class map.
Default Class Maps (Traffic Classes)
The configuration includes a default Layer 3/4 class map (traffic class) that the ASA uses in the default
global policy called default-inspection-traffic; it matches the default inspection traffic. This class, which
is used in the default global policy, is a special shortcut to match the default ports for all inspections.
When used in a policy, this class ensures that the correct inspection is applied to each packet, based on
the destination port of the traffic. For example, when UDP traffic for port 69 reaches the ASA, then the
ASA applies the TFTP inspection; when TCP traffic for port 21 arrives, then the ASA applies the FTP
inspection. So in this case only, you can configure multiple inspections for the same class map.
Normally, the ASA does not use the port number to determine which inspection to apply, thus giving you
the flexibility to apply inspections to non-standard ports, for example.
class-map inspection_default
match default-inspection-traffic
Another class map that exists in the default configuration is called class-default, and it matches all
traffic. This class map appears at the end of all Layer 3/4 policy maps and essentially tells the ASA to
not perform any actions on all other traffic. You can use the class-default class if desired, rather than
making your own match any class map. In fact, some features are only available for class-default.
class-map class-default
match any
Configure Service Policies
To configure service policies using the Modular Policy Framework, perform the following steps:
Step 1 Identify the traffic on which you want to act by creating Layer 3/4 class maps, as described in Identify
Traffic (Layer 3/4 Class Maps), page 1-13.
For example, you might want to perform actions on all traffic that passes through the ASA; or you might
only want to perform certain actions on traffic from 10.1.1.0/24 to any destination address.
Step 2 Optionally, perform additional actions on some inspection traffic.
Layer 3/4 Class Map Layer 3/4 Class Map
241506

1-12
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 1 Service Policy Using the Modular Policy Framework
Configure Service Policies
If one of the actions you want to perform is application inspection, and you want to perform additional
actions on some inspection traffic, then create an inspection policy map. The inspection policy map
identifies the traffic and specifies what to do with it.
For example, you might want to drop all HTTP requests with a body length greater than 1000 bytes.
You can create a self-contained inspection policy map that identifies the traffic directly with match
commands, or you can create an inspection class map for reuse or for more complicated matching. For
example, you could match text within a inspected packets using a regular expression or a group of regular
expressions (a regular expression class map), and target actions based on narrower criteria. For example,
you might want to drop all HTTP requests with a URL including the text “example.com.”
See Defining Actions in an Inspection Policy Map, page 2-4 and Identifying Traffic in an Inspection
Class Map, page 2-5.
Step 3 Define the actions you want to perform on each Layer 3/4 class map by creating a Layer 3/4 policy map,
as described in Define Actions (Layer 3/4 Policy Map), page 1-16.
Inspection Class Map/
Match Commands
Inspection Policy Map Actions
241507
Regular Expression Statement/
Regular Expression Class Map
Inspection Class Map/
Match Commands
Inspection Policy Map Actions
241509

1-13
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 1 Service Policy Using the Modular Policy Framework
Configure Service Policies
Step 4 Determine on which interfaces you want to apply the policy map, or apply it globally, as described in
Apply Actions to an Interface (Service Policy), page 1-18.
Identify Traffic (Layer 3/4 Class Maps)
A Layer 3/4 class map identifies Layer 3 and 4 traffic to which you want to apply actions. You can create
multiple Layer 3/4 class maps for each Layer 3/4 policy map.
•Create a Layer 3/4 Class Map for Through Traffic, page 1-13
•Create a Layer 3/4 Class Map for Management Traffic, page 1-15
Create a Layer 3/4 Class Map for Through Traffic
A Layer 3/4 class map matches traffic based on protocols, ports, IP addresses and other Layer 3 or 4
attributes.
Tip We suggest that you only inspect traffic on ports on which you expect application traffic; if you inspect
all traffic, for example using match any, the ASA performance can be impacted.
Inspection
Connection Limits
Layer 3/4 Policy Map
Service Policy
IPS
Inspection
Connection Limits
241508

1-14
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 1 Service Policy Using the Modular Policy Framework
Configure Service Policies
Procedure
Step 1 Create a Layer 3/4 class map, where class_map_name is a string up to 40 characters in length.
class-map class_map_name
The name “class-default” is reserved. All types of class maps use the same name space, so you cannot
reuse a name already used by another type of class map. The CLI enters class-map configuration mode.
Example:
hostname(config)# class-map all_udp
Step 2 (Optional) Add a description to the class map.
description string
Example:
hostname(config-cmap)# description All UDP traffic
Step 3 Match traffic using one of the following commands. Unless otherwise specified, you can include only
one match command in the class map.
•match any—Matches all traffic.
hostname(config-cmap)# match any
•match access-list access_list_name—Matches traffic specified by an extended ACL. If the ASA is
operating in transparent firewall mode, you can use an EtherType ACL.
hostname(config-cmap)# match access-list udp
•match port {tcp | udp} {eq port_num |range port_num port_num}—Matches TCP or UDP
destination ports, either a single port or a contiguous range of ports. For applications that use
multiple, non-contiguous ports, use the match access-list command and define an ACE to match
each port.
hostname(config-cmap)# match tcp eq 80
•match default-inspection-traffic—Matches default traffic for inspection: the default TCP and
UDP ports used by all applications that the ASA can inspect.
hostname(config-cmap)# match default-inspection-traffic
This command, which is used in the default global policy, is a special CLI shortcut that when used
in a policy map, ensures that the correct inspection is applied to each packet, based on the
destination port of the traffic. For example, when UDP traffic for port 69 reaches the ASA, then the
ASA applies the TFTP inspection; when TCP traffic for port 21 arrives, then the ASA applies the
FTP inspection. So in this case only, you can configure multiple inspections for the same class map
(with the exception of WAAS inspection, which can be configured with other inspections. See
Incompatibility of Certain Feature Actions, page 1-7 for more information about combining
actions). Normally, the ASA does not use the port number to determine the inspection applied, thus
giving you the flexibility to apply inspections to non-standard ports, for example.
See Default Inspections and NAT Limitations, page 6-6 for a list of default ports. Not all
applications whose ports are included in the match default-inspection-traffic command are
enabled by default in the policy map.
You can specify a match access-list command along with the match default-inspection-traffic
command to narrow the matched traffic. Because the match default-inspection-traffic command
specifies the ports and protocols to match, any ports and protocols in the ACL are ignored.