Cisco PIX 500 Series Configuration Manual page 400

Configuring Special Actions for Application Inspections
The log keyword, which you can use alone or with one of the other keywords, sends a system log
message.
The rate-limit message_rate argument limits the rate of messages.
You can specify multiple class or match commands in the policy map.
If a packet matches multiple different match or class commands, then the order in which the security
appliance applies the actions is determined by internal security appliance rules, and not by the order they
are added to the policy map. The internal rules are determined by the application type and the logical
progression of parsing a packet, and are not user-configurable. For example for HTTP traffic, parsing a
Request Method field precedes parsing the Header Host Length field; an action for the Request Method
field occurs before the action for the Header Host Length field. For example, the following match
commands can be entered in any order, but the match request method get command is matched first.
match request header host length gt 100
reset
match request method get
log
If an action drops a packet, then no further actions are performed in the inspection policy map. For
example, if the first action is to reset the connection, then it will never match any further match or class
commands. If the first action is to log the packet, then a second action, such as resetting the connection,
can occur. (You can configure both the reset (or drop-connection, and so on.) and the log action for the
same match or class command, in which case the packet is logged before it is reset for a given match.)
If a packet matches multiple match or class commands that are the same, then they are matched in the
order they appear in the policy map. For example, for a packet with the header length of 1001, it will
match the first command below, and be logged, and then will match the second command and be reset.
If you reverse the order of the two match commands, then the packet will be dropped and the connection
reset before it can match the second match command; it will never be logged.
match request header length gt 100
log
match request header length gt 1000
reset
A class map is determined to be the same type as another class map or match command based on the
lowest priority match command in the class map (the priority is based on the internal rules). If a class
map has the same type of lowest priority match command as another class map, then the class maps are
matched according to the order they are added to the policy map. If the lowest priority command for each
class map is different, then the class map with the higher priority match command is matched first. For
example, the following three class maps contain two types of match commands: match request-cmd
(higher priority) and match filename (lower priority). The ftp3 class map includes both commands, but
it is ranked according to the lowest priority command, match filename. The ftp1 class map includes the
highest priority command, so it is matched first, regardless of the order in the policy map. The ftp3 class
map is ranked as being of the same priority as the ftp2 class map, which also contains the match
filename command. They are matched according to the order in the policy map: ftp3 and then ftp2.
class-map inspect type ftp match-all ftp1
match request-cmd get
class-map inspect type ftp match-all ftp2
match filename regex abc
class-map inspect type ftp match-all ftp3
match request-cmd get
match filename regex abc
policy-map type inspect ftp ftp
class ftp3
log
class ftp2
Cisco Security Appliance Command Line Configuration Guide
21-12
Chapter 21 Using Modular Policy Framework
OL-12172-03