Cisco Systems Syntax for Creating Lua EVAL Expressions

70-37
Cisco ASA 5500 Series Configuration Guide using ASDM
Chapter70 Configuring Dynamic Access Policies
Guide to Creating DAP Logical Expressions using LUA
In the Advanced field you enter free-form Lua text that represents AAA and/or endpoint selection logical
operations. ASDM does not validate text that you enter here; it just copies this text to the DAP policy
file, and the ASA processes it, discarding any expressions it cannot parse.
This option is useful for adding selection criteria other than what is possible in the AAA and endpoint
attribute areas above. For example, while you can configure the ASA to use AAA attributes that satisfy
any, all, or none of the specified criteria, endpoint attributes are cumulative, and must all be satisfied. To
let the security appliance employ one endpoint attribute or another, you need to create appropriate logical
expressions in Lua and enter them here.
•For a list of AAA Selection attributes, including proper name syntax for creating logical
expressions, see Table70-1.
•For a list of endpoint selection attributes, including proper name syntax for creating logical
expressions, see Table70-3.
The following sections provide detailed explanations of creating Lua EVAL expressions, as well as
examples.
•Syntax for Creating Lua EVAL Expressions
– Constructing DAP EVAL Expressions
•The DAP CheckAndMsg Function
– Checking for a Single Antivirus Program
– Checking for Antivirus Definitions Within the Last 10 Days
– Checking for a Hotfix on the User PC
– Checking for Antivirus Programs
– Checking for Antivirus Programs and Definitions Older than 1 1/2 Days
•Additional Lua Functions
– OU-Based Match Example
– Group Membership Example
– Antivirus Example
– Antispyware Example
– Firewall Example
– Antivirus, Antispyware, or any Firewall Example
•CheckAndMsg with Custom Function Example
•Further Information on Lua
Syntax for Creating Lua EVAL Expressions
This section provides information about the syntax for creating Lua EVAL expressions.
Note If you must use Advanced mode, we recommend that you use EVAL expressions whenever possible for
reasons of clarity, which makes verifying the program straightforward.
EVAL(<attribute> , <comparison>, {<value> | <attribute>}, [<type>])