Cisco ASA 5512-X Cli Configuration Guide

1-10
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring Inspection for Management Application Protocols
RSH Inspection
class c1
inspect radius-accounting radius_accounting_map
service-policy global_policy control-plane abc global
RSH Inspection
RSH inspection is enabled by default. The RSH protocol uses a TCP connection from the RSH client to
the RSH server on TCP port 514. The client and server negotiate the TCP port number where the client
listens for the STDERR output stream. RSH inspection supports NAT of the negotiated port number if
necessary.
SNMP Inspection
This section describes the IM inspection engine. This section includes the following topics:
• SNMP Inspection Overview, page 1-10
• Configuring an SNMP Inspection Policy Map for Additional Inspection Control, page 1-10
SNMP Inspection Overview
SNMP application inspection lets you restrict SNMP traffic to a specific version of SNMP. Earlier
versions of SNMP are less secure; therefore, denying certain SNMP versions may be required by your
security policy. The ASA can deny SNMP versions 1, 2, 2c, or 3. You control the versions permitted by
creating an SNMP map.
You then apply the SNMP map when you enable SNMP inspection according to the “Configuring
Application Layer Protocol Inspection” section on page 1-7.
Configuring an SNMP Inspection Policy Map for Additional Inspection
Control
To create an SNMP inspection policy map, perform the following steps:
Step 1 To create an SNMP map, enter the following command:
hostname(config)# snmp-map map_name
hostname(config-snmp-map)#
where map_name is the name of the SNMP map. The CLI enters SNMP map configuration mode.
Step 2 To specify the versions of SNMP to deny, enter the following command for each version:
hostname(config-snmp-map)# deny version version
hostname(config-snmp-map)#
where version is 1, 2, 2c, or 3.

Cisco ASA 5512-X Specifications

General

Brand	Cisco
Model	ASA 5512-X
Category	Firewall
Language	English