Cisco Systems Verifying and Monitoring FTP Inspection

47-23
Cisco ASA 5500 Series Configuration Guide using ASDM
Chapter47 Configuring Inspection of Basic Internet Protocol s
FTP Inspection
– Manage—Opens the Manage Regular Expressions dialog box, which lets you configure regular
expressions.
– Regular Expression Class—Lists the defined regular expression classes to match.
– Manage—Opens the Manage Regular Expression Class dialog box, which lets you configure
regular expression class maps.
•Server Criterion Values—Specifies the value details for FTP server match.
– Regular Expression—Lists the defined regular expressions to match.
– Manage—Opens the Manage Regular Expressions dialog box, which lets you configure regular
expressions.
– Regular Expression Class—Lists the defined regular expression classes to match.
– Manage—Opens the Manage Regular Expression Class dialog box, which lets you configure
regular expression class maps.
•User Name Criterion Values—Specifies the value details for FTP user name match.
– Regular Expression—Lists the defined regular expressions to match.
– Manage—Opens the Manage Regular Expressions dialog box, which lets you configure regular
expressions.
– Regular Expression Class—Lists the defined regular expression classes to match.
– Manage—Opens the Manage Regular Expression Class dialog box, which lets you configure
regular expression class maps.
•Multiple Matches—Specifies multiple matches for the FTP inspection.
– FTP Traffic Class—Specifies the FTP traffic class match.
– Manage—Opens the Manage FTP Class Maps dialog box to add, edit, or delete FTP Class
Maps.
•Action—Reset.
•Log—Enable or disable.
Modes
The following table shows the modes in which this feature is available:
Verifying and Monitoring FTP Inspection
FTP application inspection generates the following log messages:
•An Audit record 303002 is generated for each file that is retrieved or uploaded.
•The FTP command is checked to see if it is RETR or STOR and the retrieve and store commands
are logged.
•The username is obtained by looking up a table providing the IP address.
Firewall Mode Security Context
Routed Transparent Single
Multiple
Context System
••••—