1-20

Cisco ASA Series Firewall CLI Configuration Guide
Chapter1 Configuring a Service Policy Using the Modular Policy Framework
Configuration Examples for Modular Policy Framework
ciscoasa(config)# policy-map http_traffic_policy
ciscoasa(config-pmap)# class http_traffic
ciscoasa(config-pmap-c)# inspect http
ciscoasa(config)# service-policy http_traffic_policy global
Applying Inspection and Connection Limits to HTTP Traffic to Specific Servers

In this example (see Figure 1-3), any HTTP connection destined for Server A (TCP traffic on port 80)

that enters the ASA through the outside interface is classified for HTTP inspection and maximum

connection limits. Connections initiated from Server A to Host A does not match the ACL in the class

map, so it is not affected.

Any HTTP connection destined for Server B that enters the ASA through the inside interface is classified

for HTTP inspection. Connections initiated from Server B to Host B does not match the ACL in the class

map, so it is not affected.

Figure1-3 HTTP Inspection and Connection Limits to Specific Servers
See the following commands for this example:
ciscoasa(config)# object network obj-192.168.1.2
ciscoasa(config-network-object)# host 192.168.1.2
ciscoasa(config-network-object)# nat (inside,outside) static 209.165.201.1
ciscoasa(config)# object network obj-192.168.1.0
ciscoasa(config-network-object)# subnet 192.168.1.0 255.255.255.0
ciscoasa(config-network-object)# nat (inside,outside) dynamic 209.165.201.2
ciscoasa(config)# access-list serverA extended permit tcp any host 209.165.201.1 eq 80
ciscoasa(config)# access-list ServerB extended permit tcp any host 209.165.200.227 eq 80
ciscoasa(config)# class-map http_serverA
ciscoasa(config-cmap)# match access-list serverA
ciscoasa(config)# class-map http_serverB
ciscoasa(config-cmap)# match access-list serverB
ciscoasa(config)# policy-map policy_serverA
ciscoasa(config-pmap)# class http_serverA
ciscoasa(config-pmap-c)# inspect http
ciscoasa(config-pmap-c)# set connection conn-max 100
ciscoasa(config)# policy-map policy_serverB
ciscoasa(config-pmap)# class http_serverB
ciscoasa(config-pmap-c)# inspect http
inside outside
Server A
Real Address: 192.168.1.2
Mapped Address: 209.165.201.1
Host B
Real Address: 192.168.1.1
Mapped Address: 209.165.201.2:

port

Host A
209.165.200.226
Server B
209.165.200.227
port 80
port 80
insp.
insp.
set conns
143357
Security
appliance