24-71
Cisco ASDM User Guide
OL-16647-01
Chapter 24 Configuring Application Layer Protocol Inspection
Inspect Map Field Descriptions
An inspection class map matches application traffic with criteria specific to the application. You then
identify the class map in the inspect map and enable actions. The difference between creating a class
map and defining the traffic match directly in the inspect map is that you can create more complex match
criteria and you can reuse class maps. The applications that support inspection class maps are DNS, FTP,
H.323, HTTP, Instant Messaging (IM), and SIP.
Fields
• Name—Shows the class map name.
• Match Conditions—Shows the type, match criterion, and value in the class map.
–
Match Type—Shows the match type, which can be a positive or negative match.
–
Criterion—Shows the criterion of the class map.
–
Value—Shows the value to match in the class map.
• Description—Shows the description of the class map.
• Add—Adds match conditions for the class map.
• Edit—Edits match conditions for the class map.
• Delete—Deletes match conditions for the class map.
Modes
The following table shows the modes in which this feature is available:
ESMTP Inspect Map
The ESMTP pane lets you view previously configured ESMTP application inspection maps. An ESMTP
map lets you change the default configuration values used for ESMTP application inspection.
Since ESMTP traffic can be a main source of attack from spam, phising, malformed messages, buffer
overflows, and buffer underflows, detailed packet inspection and control of ESMTP traffic are
supported. Application security and protocol conformance enforce the sanity of the ESMTP message as
well as detect several attacks, block senders and receivers, and block mail relay.
Fields
• ESMTP Inspect Maps—Table that lists the defined ESMTP inspect maps.
• Add—Configures a new ESMTP inspect map. To edit an ESMTP inspect map, select the ESMTP
entry in the ESMTP Inspect Maps table and click Customize.
• Delete—Deletes the inspect map selected in the ESMTP Inspect Maps table.
• Security Level—Select the security level (high, medium, or low).
–
Low—Default.
Log if command line length is greater than 512
Log if command recipient count is greater than 100
Firewall Mode Security Context
Routed Transparent Single
Multiple
Context System
• • • •—