Filter
Top Products
CHAPTER
11-1
Cisco ASA Series Firewall ASDM Configuration Guide
11
Configuring Inspection of Basic Internet
Protocols
This chapter describes how to configure application layer protocol inspection. Inspection engines are
required for services that embed IP addressing information in the user data packet or that open secondary
channels on dynamically assigned ports. These protocols require the ASA to do a deep packet inspection
instead of passing the packet through the fast path. As a result, inspection engines can affect overall
throughput.
Several common inspection engines are enabled on the ASA by default, but you might need to enable
others depending on your network.
This chapter includes the following sections:
• DNS Inspection, page 11-1
• FTP Inspection, page 11-17
• HTTP Inspection, page 11-26
• ICMP Inspection, page 11-39
• ICMP Error Inspection, page 11-39
• Instant Messaging Inspection, page 11-39
• IP Options Inspection, page 11-41
• IPsec Pass Through Inspection, page 11-45
• IPv6 Inspection, page 11-48
• NetBIOS Inspection, page 11-50
• PPTP Inspection, page 11-51
• SMTP and Extended SMTP Inspection, page 11-52
• TFTP Inspection, page 11-60
DNS Inspection
This section describes DNS application inspection. This section includes the following topics:
• Information About DNS Inspection, page 11-2
• Default Settings for DNS Inspection, page 11-2
• (Optional) Configuring a DNS Inspection Policy Map and Class Map, page 11-3