Cisco Systems Configuring Special Actions for Application Inspections (Inspection Policy Map)

CHAPTE R
2-1
Cisco ASA Series Firewall ASDM Configuration Guide
2
Configuring Special Actions for Application
Inspections (Inspection Policy Map)
Modular Policy Framework lets you configure special actions for many application inspections. When
you enable an inspection engine in the service policy, you can also optionally enable actions as defined
in an inspection policy map. When the inspection policy map matches traffic within the service policy
for which you have defined an inspection action, then that subset of traffic will be acted upon as specified
(for example, dropped or rate-limited).
This chapter includes the following sections:
•Information About Inspection Policy Maps, page2-1
•Guidelines and Limitations, page2-2
•Default Inspection Policy Maps, page2-2
•Defining Actions in an Inspection Policy Map, page2-3
•Identifying Traffic in an Inspection Class Map, page2-3
•Where to Go Next, page2-4
•Feature History for Inspection Policy Maps, page2-4
Information About Inspection Policy Maps
See the “Configuring Application Layer Protocol Inspection” section on page10-7 for a list of
applications that support inspection policy maps.
An inspection policy map consists of one or more of the following elements. The exact options available
for an inspection policy map depends on the application.
•Traffic matching option—You can define a traffic matching option directly in the inspection policy
map to match application traffic to criteria specific to the application, such as a URL string, for
which you then enable actions.
– Some traffic matching options can specify regular expressions to match text inside a packet. Be
sure to create and test the regular expressions before you configure the policy map, either singly
or grouped together in a regular expression class map.
•Inspection class map—An inspection class map includes multiple traffic matching options. You then
identify the class map in the policy map and enable actions for the class map as a whole. The
difference between creating a class map and defining the traffic match directly in the inspection