Cisco Systems Configuration Examples for the CSC SSM

32-17
Cisco ASA Series Firewall CLI Configuration Guide
Chapter32 Configuring the ASA CSC Module
Configuration Examples for the CSC SSM
Shutting Down the Module
If you restart the ASA, the module is not automatically restarted. To shut down the module, perform the
following steps at the ASA CLI.
Detailed Steps
Configuration Examples for the CSC SSM
To identify the traffic that you want to scan, you can configure the ASA in different ways. One approach
is to define two service policies, one on the inside interface and one on the outside interface, each with
an ACL that matches traffic to be scanned. The following example is based on the network shown in
Figure 32-3 and shows the creation of two service policies for a common CSC SSM scanning scenario:
•The first policy, csc_out_policy, is applied to the inside interface and uses the csc_out ACL to ensure
that all outbound requests for FTP and POP3 are scanned. The csc_out ACL also ensures that HTTP
connections from inside to networks on the outside interface are scanned, but it includes a deny ACE
to exclude HTTP connections from inside to servers on the DMZ network.
•The second policy, csc_in_policy, is applied to the outside interface and uses the csc_in ACL to
ensure that requests for SMTP and HTTP originating on the outside interface and destined for the
DMZ network are scanned by the CSC SSM. Scanning HTTP requests protects the web server from
HTTP file uploads.
ciscoasa(config)# access-list csc_out permit tcp 192.168.10.0 255.255.255.0 any eq 21
ciscoasa(config)# access-list csc_out deny tcp 192.168.10.0 255.255.255.0 192.168.20.0
255.255.255.0 eq 80
ciscoasa(config)# access-list csc_out permit tcp 192.168.10.0 255.255.255.0 any eq 80
ciscoasa(config)# access-list csc_out permit tcp 192.168.10.0 255.255.255.0 any eq 110
ciscoasa(config)# class-map csc_outbound_class
ciscoasa(config-cmap)# match access-list csc_out
ciscoasa(config-cmap)# policy-map csc_out_policy
ciscoasa(config-pmap)# class csc_outbound_class
ciscoasa(config-pmap-c)# csc fail-close
ciscoasa(config-pmap-c)# service-policy csc_out_policy interface inside
ciscoasa(config)# access-list csc_in permit tcp any 192.168.20.0 255.255.255.0 eq 25
ciscoasa(config)# access-list csc_in permit tcp any 192.168.20.0 255.255.255.0 eq 80
ciscoasa(config)# class-map csc_inbound_class
ciscoasa(config-cmap)# match access-list csc_in
ciscoasa(config-cmap)# policy-map csc_in_policy
Command Purpose
hw-module module 1 shutdown
Example:
ciscoasa# hw-module module 1 shutdown
Shuts down the module.