13-11
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 13 Inspection of Basic Internet Protocols
FTP Inspection
For the traffic that you identify in this class map, you specify actions to take on the traffic in the
inspection policy map.
If you want to perform different actions for each
match
command, you should identify the traffic directly
in the policy map.
a.
Create the class map by entering the following command:
hostname(config)#
class-map type
inspect ftp
[
match-all
|
match-any
]
class_map_name
hostname(config-cmap)#
Where
the class_map_name
is the name of the class map. The
match-all
keyword is the default, and
specifies that traffic must match all criteria to match the class map. The match-any keyword
specifies that the traffic matches the class map if it matches at least one
match
statement. The CLI
enters class-map configuration mode, where you can enter one or more
match
commands.
b.
(Optional) To add a description to the class map, enter the following command:
hostname(config-cmap)#
description
string
Where
string
is the description of the class map (up to 200 characters).
c.
Specify the traffic on which you want to perform actions using one of the following
match
commands. If you use a
match not
command, then any traffic that does not match the criterion in
the
match not
command has the action applied.
•
match
[
not
]
filename regex
{
regex_name
|
class
class_name
}—Matches the filename in the
FTP transfer against the specified regular expression or regular expression class.
•
match
[
not
]
filetype regex
{
regex_name
|
class
class_name
}—Matches the file type in the FTP
transfer against the specified regular expression or regular expression class.
•
match
[
not
]
request-command
ftp_command
[
ftp_command
...]—Matches the FTP command,
one or more of the following:
APPE
—Append to a file.
CDUP
—Changes to the parent directory of the current working directory.
DELE
—Delete a file on the server.
GET
—Gets a file from the server.
HELP
—Provides help information.
MKD
—Makes a directory on the server.
PUT
—Sends a file to the server.
RMD
—Deletes a directory on the server.
RNFR
—Specifies the “rename-from” filename.
RNTO
—Specifies the “rename-to” filename.
SITE
—Used to specify a server-specific command. This is usually used for remote
administration.
STOU
—Stores a file using a unique file name.
•
match
[
not
]
server regex
{
regex_name
|
class
class_name
}—Matches the FTP server name
against the specified regular expression or regular expression class.
•
match
[
not
]
username regex
{
regex_name
|
class
class_name
}—Matches the FTP username
against the specified regular expression or regular expression class.
d.
Enter
exit
to leave class map configuration mode.
Summary of Contents for ASA 5508-X
Page 11: ...P A R T 1 Access Control ...
Page 12: ......
Page 157: ...P A R T 2 Network Address Translation ...
Page 158: ......
Page 233: ...P A R T 3 Service Policies and Application Inspection ...
Page 234: ......
Page 379: ...P A R T 4 Connection Management and Threat Detection ...
Page 380: ......
