Cisco Systems Monitoring Modular Policy Framework, Configuration Examples for Modular Policy Framework

1-18
Cisco ASA Series Firewall CLI Configuration Guide
Chapter1 Configuring a Service Policy Using the Modular Policy Framework
Monitoring Modular Policy Framework
Detailed Steps
Examples
For example, the following command enables the inbound_policy policy map on the outside interface:
ciscoasa(config)# service-policy inbound_policy interface outside
The following commands disable the default global policy, and enables a new one called
new_global_policy on all other ASA interfaces:
ciscoasa(config)# no service-policy global_policy global
ciscoasa(config)# service-policy new_global_policy global
Monitoring Modular Policy Framework
To monitor Modular Policy Framework, enter the following command:
Configuration Examples for Modular Policy Framework
This section includes several Modular Policy Framework examples and includes the following topics:
•Applying Inspection and QoS Policing to HTTP Traffic, page1-19
•Applying Inspection to HTTP Traffic Globally, page1-19
•Applying Inspection and Connection Limits to HTTP Traffic to Specific Servers, page1-20
•Applying Inspection to HTTP Traffic with NAT, page1-21
Command Purpose
service-policy policy_map_name interface
interface_name [fail-close]
Example:
ciscoasa(config)# service-policy
inbound_policy interface outside
Creates a service policy by associating a policy map with an interface.
Specify the fail-close option to generate a syslog (767001) for IPv6 traffic
that is dropped by application inspections that do not support IPv6 traffic.
By default, syslogs are not generated. For a list of inspections that support
IPv6, see the “IPv6 Guidelines” section on page 1-6.
service-policy policy_map_name global
[fail-close]
Example:
ciscoasa(config)# service-policy
inbound_policy global
Creates a service policy that applies to all interfaces that do not have a
specific policy. Specify the fail-close option to generate a syslog (767001)
for IPv6 traffic that is dropped by application inspections that do not
support IPv6 traffic. By default, syslogs are not generated. For a list of
inspections that support IPv6, see the “IPv6 Guidelines” section on
page 1-6.
Command Purpose
show service-policy Displays the service policy statistics.