Defining Actions In An Inspection Policy Map - Cisco FirePOWER ASA 5500 series Configuration Manual

Configuring Special Actions for Application Inspections
The match-all keyword is the default, and specifies that traffic must match all criteria to match the class
map.
The CLI enters class-map configuration mode, where you can enter one or more match commands.
(Optional) To add a description to the class map, enter the following command:
Step 2
hostname(config-cmap)# description string
Define the traffic to include in the class by entering one or more match commands available for your
Step 3
application.
To specify traffic that should not match the class map, use the match not command. For example, if the
match not command specifies the string "example.com," then any traffic that includes "example.com"
does not match the class map.
To see the match commands available for each application, see
Layer Protocol Inspection."

Defining Actions in an Inspection Policy Map

When you enable an inspection engine in the Layer 3/4 policy map, you can also optionally enable
actions as defined in an inspection policy map.
To create an inspection policy map, perform the following steps:
To create the HTTP inspection policy map, enter the following command:
Step 1
hostname(config)# policy-map type inspect application policy_map_name
hostname(config-pmap)#
See the
inspection policy maps.
The policy_map_name argument is the name of the policy map up to 40 characters in length. All types
of policy maps use the same name space, so you cannot reuse a name already used by another type of
policy map. The CLI enters policy-map configuration mode.
To apply actions to matching traffic, perform the following steps:
Step 2
a.
b.
Cisco Security Appliance Command Line Configuration Guide
21-10
"Configuring Application Inspection" section on page 25-5
Specify the traffic on which you want to perform actions using one of the following methods:
• Specify the inspection class map that you created in the
Class Map" section on page 21-9
hostname(config-pmap)# class class_map_name
hostname(config-pmap-c)#
Specify traffic directly in the policy map using one of the match commands described for each
•
application in Chapter 25, "Configuring Application Layer Protocol Inspection."
match not command, then any traffic that matches the criterion in the match not command does
not have the action applied.
Specify the action you want to perform on the matching traffic by entering the following command:
hostname(config-pmap-c)# {[drop [send-protocol-error] |
drop-connection [send-protocol-error]| mask | reset] [log] | rate-limit message_rate}
Chapter 21
Chapter 25, "Configuring Application
for a list of applications that support
"Identifying Traffic in an Inspection
by entering the following command:
Using Modular Policy Framework
If you use a
OL-10088-01