25-11
Cisco ASA Series Firewall CLI Configuration Guide
Chapter25 Configuring the ASA for Cisco Cloud Web Security
Configuring Cisco Cloud Web Security
Detailed Steps
Command Purpose
Step1 policy-map type inspect scansafe name1
Example:
ciscoasa(config)# policy-map type inspect
scansafe cws_inspect_pmap1
Creates an inspection policy map so you can configure essential
parameters for the rule and also optionally identify the whitelist.
An inspection policy map is required for each class of traffic that
you want to send to Cloud Web Security.
The policy_map_name argument can be up to 40 characters in
length.
You enter policy-map configuration mode.
Step2 parameters
Example:
ciscoasa(config-pmap)# parameters
Parameters lets you configure the protocol and the default user or
group. You enter parameters configuration mode.
Step3 {http | https}
Example:
ciscoasa(config-pmap-p)# http
You can only specify one service type for this inspection policy
map, either http or https.
Step4 (Optional)
default {[user username]
[group groupname]}
Example:
ciscoasa(config-pmap-p)# default group
default_group
Specifies that if the ASA cannot determine the identity of the user
coming into the ASA, then the default user and/or group is
included in the HTTP header.
Step5 (Optional, for a Whitelist)
class whitelist_name
Example:
ciscoasa(config-pmap-p)# class whitelist1
Identifies the whitelist class map name that you created in the
“(Optional) Configuring Whitelisted Traffic” section on
page 25-15.
Step6 whitelist
Example:
ciscoasa(config-pmap-p)# class whitelist1
ciscoasa(config-pmap-c)# whitelist
Performs the whitelist action on the class of traffic.