Cisco Systems Defining Actions in an Inspection Policy Map

2-4
Cisco ASA Series Firewall CLI Configuration Guide
Chapter2 Configuring Special Actions for Application In spections (Inspection Policy Map)
Defining Actions in an Inspection Policy Map
Note There are other default inspection policy maps such as _default_esmtp_map. For example, inspect
esmtp implicitly uses the policy map “_default_esmtp_map.” All the default policy maps can be shown
by using the show running-config all policy-map command.
Defining Actions in an Inspection Policy Map
When you enable an inspection engine in the Layer 3/4 policy map, you can also optionally enable
actions as defined in an inspection policy map.
Detailed Steps
Command Purpose
Step1 (Optional)
Create an inspection class map.
See the “Identifying Traffic in an Inspection Class Map” section
on page 2-5.
Alternatively, you can identify the traffic directly within the
policy map.
Step2 (Optional)
Create a regular expression.
For policy map types that support regular expressions, see the
general operations configuration guide.
Step3 policy-map type inspect application
policy_map_name
Example:
ciscoasa(config)# policy-map type inspect
http http_policy
Creates the inspection policy map. See the “Configuring
Application Layer Protocol Inspection” section on page9-7 for a
list of applications that support inspection policy maps.
The policy_map_name argument is the name of the policy map up
to 40 characters in length. All types of policy maps use the same
name space, so you cannot reuse a name already used by another
type of policy map. The CLI enters policy-map configuration
mode.
Step4 Specify the traffic on which you want to perform actions using one of the following methods:
class class_map_name
Example:
ciscoasa(config-pmap)# class http_traffic
ciscoasa(config-pmap-c)#
Specifies the inspection class map that you created in the
“Identifying Traffic in an Inspection Class Map” section on
page 2-5.
Not all applications support inspection class maps.
Specify traffic directly in the policy map using
one of the match commands described for each
application in the inspection chapter.
Example:
ciscoasa(config-pmap)# match req-resp
content-type mismatch
ciscoasa(config-pmap-c)#
If you use a match not command, then any traffic that matches the
criterion in the match not command does not have the action
applied.
For policy map types that support regular expressions, see the
general operations configuration guide.