15-17
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 15 Inspection of Database, Directory, and Management Protocols
SNMP Inspection
Example:
The following example denies SNMP Versions 1 and 2:
hostname(config)#
snmp-map sample_map
hostname(config-snmp-map)#
deny version 1
hostname(config-snmp-map)#
deny version 2
Step 2
If necessary, create an L3/L4 class map to identify the traffic for which you want to apply the inspection.
class-map
name
match
parameter
Example:
hostname(config)# class-map snmp_class_map
hostname(config-cmap)# match access-list snmp
In the default global policy, the inspection_default class map is a special class map that includes default
ports for all inspection types (
match default-inspection-traffic
). If you are using this class map in
either the default policy or for a new service policy, you can skip this step.
For information on matching statements, see
Identify Traffic (Layer 3/4 Class Maps), page 11-13
.
Step 3
Add or edit a policy map that sets the actions to take with the class map traffic.
policy-map
name
Example:
hostname(config)# policy-map global_policy
In the default configuration, the global_policy policy map is assigned globally to all interfaces. If you
want to edit the global_policy, enter global_policy as the policy name.
Step 4
Identify the L3/L4 class map you are using for SNMP inspection.
class
name
Example:
hostname(config-pmap)# class inspection_default
To edit the default policy, or to use the special inspection_default class map in a new policy, specify
inspection_default
for the
name
. Otherwise, you are specifying the class you created earlier in this
procedure.
Step 5
Configure SNMP inspection.
inspect snmp
[
snmp_map
]
Where
snmp_map
is the optional SNMP inspection policy map. You need a map only if you want
non-default inspection processing.
Example:
hostname(config-class)# no inspect snmp
hostname(config-class)# inspect snmp snmp-map
Note
If you are editing the default global policy (or any in-use policy) to use a different inspection
policy map, you must remove the SNMP inspection with the
no inspect snmp
command, and
then re-add it with the new inspection policy map name.
Summary of Contents for ASA 5508-X
Page 11: ...P A R T 1 Access Control ...
Page 12: ......
Page 157: ...P A R T 2 Network Address Translation ...
Page 158: ......
Page 233: ...P A R T 3 Service Policies and Application Inspection ...
Page 234: ......
Page 379: ...P A R T 4 Connection Management and Threat Detection ...
Page 380: ......
