Cisco ASA 5505 Configuration Manual page 785

Configuring Inspection of Basic Internet
Protocols
This chapter describes how to configure application layer protocol inspection. Inspection engines are
required for services that embed IP addressing information in the user data packet or that open secondary
channels on dynamically assigned ports. These protocols require the adaptive security appliance to do a
deep packet inspection instead of passing the packet through the fast path. As a result, inspection engines
can affect overall throughput.
Several common inspection engines are enabled on the adaptive security appliance by default, but you
might need to enable others depending on your network. This chapter includes the following sections:
•
•
•
•
•
•
•
•
•
•
•
•
DNS Inspection
This section describes DNS application inspection. This section includes the following topics:
•
•
•
•
•
OL-20339-01
DNS Inspection, page 37-1
FTP Inspection, page 37-13
HTTP Inspection, page 37-23
ICMP Inspection, page 37-38
ICMP Error Inspection, page 37-39
Instant Messaging Inspection, page 37-39
IP Options Inspection, page 37-40
IPSec Pass Through Inspection, page 37-44
NetBIOS Inspection, page 37-48
PPTP Inspection, page 37-50
SMTP and Extended SMTP Inspection, page 37-50
TFTP Inspection, page 37-60
How DNS Application Inspection Works, page 37-2
How DNS Rewrite Works, page 37-3
Configuring DNS Rewrite, page 37-3
Select DNS Inspect Map, page 37-5
DNS Class Map, page 37-6
C H A P T E R
Cisco ASA 5500 Series Configuration Guide using ASDM
37
37-1