Cisco Systems Default Inspection Policy Maps

2-3
Cisco ASA Series Firewall CLI Configuration Guide
Chapter2 Configuring Special Actions for Application Inspections (Inspection Policy Map)
Default Inspection Policy Maps
A class map is determined to be the same type as another class map or match command based on
the lowest priority match command in the class map (the priority is based on the internal rules). If
a class map has the same type of lowest priority match command as another class map, then the class
maps are matched according to the order they are added to the policy map. If the lowest priority
match for each class map is different, then the class map with the higher priority match command
is matched first. For example, the following three class maps contain two types of match commands:
match request-cmd (higher priority) and match filename (lower priority). The ftp3 class map
includes both commands, but it is ranked according to the lowest priority command, match
filename. The ftp1 class map includes the highest priority command, so it is matched first,
regardless of the order in the policy map. The ftp3 class map is ranked as being of the same priority
as the ftp2 class map, which also contains the match filename command. They are matched
according to the order in the policy map: ftp3 and then ftp2.
class-map type inspect ftp match-all ftp1
match request-cmd get
class-map type inspect ftp match-all ftp2
match filename regex abc
class-map type inspect ftp match-all ftp3
match request-cmd get
match filename regex abc
policy-map type inspect ftp ftp
class ftp3
log
class ftp2
log
class ftp1
log
Default Inspection Policy Maps
DNS inspection is enabled by default, using the preset_dns_map inspection class map:
•The maximum DNS message length is 512 bytes.
•The maximum client DNS message length is automatically set to match the Resource Record.
•DNS Guard is enabled, so the ASA tears down the DNS session associated with a DNS query as
soon as the DNS reply is forwarded by the ASA. The ASA also monitors the message exchange to
ensure that the ID of the DNS reply matches the ID of the DNS query.
•Translation of the DNS record based on the NAT configuration is enabled.
•Protocol enforcement is enabled, which enables DNS message format check, including domain
name length of no more than 255 characters, label length of 63 characters, compression, and looped
pointer check.
See the following default commands:
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
dns-guard
protocol-enforcement
nat-rewrite