Cisco ASA 5540 User Manual

1-10
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring the ASA for Cisco Cloud Web Security
Configuring Cisco Cloud Web Security
Configuring a Service Policy to Send Traffic to Cloud Web Security
See Chapter 1, “Configuring a Service Policy Using the Modular Policy Framework,” for more
information about service policy rules.
Prerequisites
(Optional) If you need to use a whitelist to exempt some traffic from being sent to Cloud Web Security,
first create the whitelist according to the “(Optional) Configuring Whitelisted Traffic” section on
page 1-14 so you can refer to the whitelist in your service policy rule.
Detailed Steps
Command Purpose
Step 1
policy-map type inspect scansafe name1
Example:
hostname(config)# policy-map type inspect
scansafe cws_inspect_pmap1
Creates an inspection policy map so you can configure essential
parameters for the rule and also optionally identify the whitelist.
An inspection policy map is required for each class of traffic that
you want to send to Cloud Web Security.
The policy_map_name argument can be up to 40 characters in
length.
You enter policy-map configuration mode.
Step 2
parameters
Example:
hostname(config-pmap)# parameters
Parameters lets you configure the protocol and the default user or
group. You enter parameters configuration mode.
Step 3
{http | https}
Example:
hostname(config-pmap-p)# http
You can only specify one service type for this inspection policy
map, either http or https.
Step 4
(Optional)
default {[user username]
[group groupname]}
Example:
hostname(config-pmap-p)# default group
default_group
Specifies that if the ASA cannot determine the identity of the user
coming into the ASA, then the default user and/or group is
included in the HTTP header.
Step 5
(Optional, for a Whitelist)
class whitelist_name
Example:
hostname(config-pmap-p)# class whitelist1
Identifies the whitelist class map name that you created in the
“(Optional) Configuring Whitelisted Traffic” section on
page 1-14.
Step 6
whitelist
Example:
hostname(config-pmap-p)# class whitelist1
hostname(config-pmap-c)# whitelist
Performs the whitelist action on the class of traffic.

Cisco ASA 5540 Specifications

General

Firewall Throughput	650 Mbps
Maximum Firewall Connections	400, 000
VPN Throughput	225 Mbps
Maximum VPN Peers	5, 000
High Availability	Active/Active, Active/Standby
IPSec VPN Throughput	225 Mbps
Memory	1 GB
IPS Throughput	225 Mbps
Security Contexts	50
Flash Memory	64 MB
Form Factor	1U
Power Supply	Dual
Interfaces	4 x 10/100/1000 Ethernet