Filter
Top Products
30-19
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 30 Configuring the ASA CX Module
Configuring the ASA CX Module
Detailed Steps
Command Purpose
Step 1
class-map name
Example:
ciscoasa(config)# class-map cx_class
Creates a class map to identify the traffic for which you want to
send to the ASA CX module.
If you want to send multiple traffic classes to the ASA CX
module, you can create multiple class maps for use in the security
policy.
Step 2
match parameter
Example:
ciscoasa(config-cmap)# match access-list
cx_traffic
Specifies the traffic in the class map. See the “Identifying Traffic
(Layer 3/4 Class Maps)” section on page 1-12 for more
information.
Step 3
policy-map name
Example:
ciscoasa(config)# policy-map cx_policy
Adds or edits a policy map that sets the actions to take with the
class map traffic.
Step 4
class name
Example:
ciscoasa(config-pmap)# class cx_class
Identifies the class map you created in Step 1.
Step 5
cxsc {fail-close | fail-open} [auth-proxy
| monitor-only]
Example:
ciscoasa(config-pmap-c)# cxsc fail-close
auth-proxy
Specifies that the traffic should be sent to the ASA CX module.
The fail-close keyword sets the ASA to block all traffic if the ASA
CX module is unavailable.
The fail-open keyword sets the ASA to allow all traffic through,
uninspected, if the ASA CX module is unavailable.
The optional auth-proxy keyword enables the authentication
proxy, which is required for active authentication.
For demonstration purposes only, specify monitor-only to send a
read-only copy of traffic to the ASA CX module. When you
configure this option, you see a warning message similar to the
following:
WARNING: Monitor-only mode should be used for
demonstrations and evaluations only. This mode prevents
CXSC from denying or altering traffic.
See the “Monitor-Only Mode” section on page 30-3 for more
information.
Note You must configure all classes and policies to be either in
monitor-only mode, or in normal inline mode; you cannot
mix both modes on the same ASA.