Cisco FirePOWER ASA 5500 series User Manual

21-10
Cisco Security Appliance Command Line Configuration Guide
OL-10088-01
Chapter 21 Using Modular Policy Framework
Configuring Special Actions for Application Inspections
The match-all keyword is the default, and specifies that traffic must match all criteria to match the class
map.
The CLI enters class-map configuration mode, where you can enter one or more match commands.
Step 2 (Optional) To add a description to the class map, enter the following command:
hostname(config-cmap)# description string
Step 3 Define the traffic to include in the class by entering one or more match commands available for your
application.
To specify traffic that should not match the class map, use the match not command. For example, if the
match not command specifies the string “example.com,” then any traffic that includes “example.com”
does not match the class map.
To see the match commands available for each application, see Chapter 25, “Configuring Application
Layer Protocol Inspection.”
Defining Actions in an Inspection Policy Map
When you enable an inspection engine in the Layer 3/4 policy map, you can also optionally enable
actions as defined in an inspection policy map.
To create an inspection policy map, perform the following steps:
Step 1 To create the HTTP inspection policy map, enter the following command:
hostname(config)# policy-map type inspect application policy_map_name
hostname(config-pmap)#
See the “Configuring Application Inspection” section on page 25-5 for a list of applications that support
inspection policy maps.
The policy_map_name argument is the name of the policy map up to 40 characters in length. All types
of policy maps use the same name space, so you cannot reuse a name already used by another type of
policy map. The CLI enters policy-map configuration mode.
Step 2 To apply actions to matching traffic, perform the following steps:
a. Specify the traffic on which you want to perform actions using one of the following methods:
• Specify the inspection class map that you created in the “Identifying Traffic in an Inspection
Class Map” section on page 21-9 by entering the following command:
hostname(config-pmap)# class class_map_name
hostname(config-pmap-c)#
• Specify traffic directly in the policy map using one of the match commands described for each
application in Chapter 25, “Configuring Application Layer Protocol Inspection.” If you use a
match not command, then any traffic that matches the criterion in the match not command does
not have the action applied.
b. Specify the action you want to perform on the matching traffic by entering the following command:
hostname(config-pmap-c)# {[drop [send-protocol-error] |
drop-connection [send-protocol-error]| mask | reset] [log] | rate-limit message_rate}

Cisco FirePOWER ASA 5500 series Specifications

General

Brand	Cisco
Model	FirePOWER ASA 5500 series
Category	Firewall
Language	English