Cisco ASA 5512-X Configuration Manual Download

Page: 132 / 422

6-4

Cisco ASA Series Firewall CLI Configuration Guide

Chapter 6 Getting Started with Application Layer Protocol Inspection

Application Layer Protocol Inspection

•

HTTP inspection policy maps—If you modify an in-use HTTP inspection policy map (

policy-map

type inspect http

), you must remove and reapply the

inspect http

map

action for the changes to

take effect. For example, if you modify the “http-map” inspection policy map, you must remove

inspect http http-map

command from the layer 3/4 policy, then add it back:

hostname(config)#

policy-map test

hostname(config-pmap)#

class http

hostname(config-pmap-c)#

inspect http http-map

hostname(config-pmap-c)#

inspect http http-map

How Multiple Traffic Classes are Handled

You can specify multiple inspection class maps or direct matches in the inspection policy map.

If a packet matches multiple different

match

class

commands, then the order in which the ASA

applies the actions is determined by internal ASA rules, and not by the order they are added to the
inspection policy map. The internal rules are determined by the application type and the logical
progression of parsing a packet, and are not user-configurable. For example for HTTP traffic, parsing a
Request Method field precedes parsing the Header Host Length field; an action for the Request Method
field occurs before the action for the Header Host Length field. For example, the following match
commands can be entered in any order, but the

match request method get

command is matched first.

match request header host length gt 100

reset

match request method get

log

If an action drops a packet, then no further actions are performed in the inspection policy map. For
example, if the first action is to reset the connection, then it will never match any further match criteria.
If the first action is to log the packet, then a second action, such as resetting the connection, can occur.

If a packet matches multiple

match

class

commands that are the same, then they are matched in the

order they appear in the policy map. For example, for a packet with the header length of 1001, it will
match the first command below, and be logged, and then will match the second command and be reset.
If you reverse the order of the two

match

commands, then the packet will be dropped and the connection

reset before it can match the second

match

command; it will never be logged.

match request header length gt 100

log

match request header length gt 1000

reset

A class map is determined to be the same type as another class map or

match

command based on the

lowest priority

match

command in the class map (the priority is based on the internal rules). If a class

map has the same type of lowest priority

match

command as another class map, then the class maps are

matched according to the order they are added to the policy map. If the lowest priority match for each
class map is different, then the class map with the higher priority

match

command is matched first. For

example, the following three class maps contain two types of

match

commands:

match request-cmd

(higher priority) and

match filename

(lower priority). The ftp3 class map includes both commands, but

it is ranked according to the lowest priority command,

match filename

. The ftp1 class map includes the

highest priority command, so it is matched first, regardless of the order in the policy map. The ftp3 class
map is ranked as being of the same priority as the ftp2 class map, which also contains the

match

filename

command. They are matched according to the order in the policy map: ftp3 and then ftp2.

class-map type inspect ftp match-all ftp1

match request-cmd get

class-map type inspect ftp match-all ftp2