Filter
Top Products
2-2
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 2 Configuring Special Actions for Application Inspections (Inspection Policy Map)
Guidelines and Limitations
policy map is that you can create more complex match criteria and you can reuse class maps.
However, you cannot set different actions for different matches. Note: Not all inspections support
inspection class maps.
• Parameters—Parameters affect the behavior of the inspection engine.
Guidelines and Limitations
• HTTP inspection policy maps—If you modify an in-use HTTP inspection policy map (policy-map
type inspect http), you must remove and reapply the inspect http map action for the changes to
take effect. For example, if you modify the “http-map” inspection policy map, you must remove and
readd the inspect http http-map command from the layer 3/4 policy:
ciscoasa(config)# policy-map test
ciscoasa(config-pmap)# class http
ciscoasa(config-pmap-c)# no inspect http http-map
ciscoasa(config-pmap-c)# inspect http http-map
• All inspection policy maps—If you want to exchange an in-use inspection policy map for a different
map name, you must remove the inspect protocol map command, and readd it with the new map.
For example:
ciscoasa(config)# policy-map test
ciscoasa(config-pmap)# class sip
ciscoasa(config-pmap-c)# no inspect sip sip-map1
ciscoasa(config-pmap-c)# inspect sip sip-map2
• You can specify multiple class or match commands in the inspection policy map.
If a packet matches multiple different match or class commands, then the order in which the ASA
applies the actions is determined by internal ASA rules, and not by the order they are added to the
inspection policy map. The internal rules are determined by the application type and the logical
progression of parsing a packet, and are not user-configurable. For example for HTTP traffic,
parsing a Request Method field precedes parsing the Header Host Length field; an action for the
Request Method field occurs before the action for the Header Host Length field. For example, the
following match commands can be entered in any order, but the match request method get
command is matched first.
match request header host length gt 100
reset
match request method get
log
If an action drops a packet, then no further actions are performed in the inspection policy map. For
example, if the first action is to reset the connection, then it will never match any further match or
class commands. If the first action is to log the packet, then a second action, such as resetting the
connection, can occur.
If a packet matches multiple match or class commands that are the same, then they are matched in
the order they appear in the policy map. For example, for a packet with the header length of 1001,
it will match the first command below, and be logged, and then will match the second command and
be reset. If you reverse the order of the two match commands, then the packet will be dropped and
the connection reset before it can match the second match command; it will never be logged.
match request header length gt 100
log
match request header length gt 1000
reset