17-65
User Guide for Cisco Security Manager 4.4
OL-28826-01
Chapter17 Managing Firewall Inspection Rules
Configuring Protocols and Maps for Inspection
Field Reference
IM Class and Policy Map (ASA 7.2+/PIX 7.2+) Add or Edit Match Condition (and Action) Dialog Boxes
Use the Add or Edit IM Match Criterion (for IM class maps) or Match Condition and Action (for IM
policy maps) dialog boxes to do the following:
•Define the match criterion and value for an IM class map.
•Select an IM class map when creating an IM policy map.
•Define the match criterion, value, and action directly in an IM policy map.
These types of maps are used only for devices running ASA 7.2 or higher, or PIX 7.2 or higher, operating
systems.
The fields on this dialog box change based on the criterion you select and whether you are creating a
class map or policy map.
Navigation Path
When creating an IM class map, in the Policy Object Manager, from the Add or Edit Class Maps dialog
boxes for IM, right-click inside the table, then select Add Row or right-click a row, then select Edit
Row. See Configuring Class Maps for Inspection Policies, page17-26.
Table17-37 Add and Edit IM Map Dialog Boxes
Element Description
Name The name of the policy object. A maximum of 40 characters is allowed.
Description A description of the policy object. A maximum of 200 characters is
allowed.
Match Condition and Action Tab
The Match All table lists the criteria included in the policy map. Each row indicates whether the
inspection is looking for traffic that matches or does not match each criterion, the criterion and value
that is inspected, and the action to be taken for traffic that satisfies the conditions.
•To add a criterion, click the Add button and fill in the Match Condition and Action dialog box (see
IM Class and Policy Map (ASA 7.2+/PIX 7.2+) Add or Edit Match Condition (and Action) Dialog
Boxes, page 17-65).
•To edit a criterion, select it and click the Edit button.
•To delete a criterion, select it and click the Delete button.
Category The category assigned to the object. Categories help you organize and
identify rules and objects. See Using Category Objects, page 6-12.
Allow Value Override per
Device
Overrides
Edit button
Whether to allow the object definition to be changed at the device level.
For more information, see Allowing a Policy Object to Be Overridden,
page 6-18 and Understanding Policy Object Overrides for Individual
Devices, page 6-17.
If you allow device overrides, you can click the Edit button to create,
edit, and view the overrides. The Overrides field indicates the number
of devices that have overrides for this object.