Identify Traffic (Layer 3/4 Class Maps); Create A Layer 3/4 Class Map For Through Traffic - Cisco ASA Series Configuration Manual

Chapter 11 Service Policy Using the Modular Policy Framework

Identify Traffic (Layer 3/4 Class Maps)

A Layer 3/4 class map identifies Layer 3 and 4 traffic to which you want to apply actions. You can create
multiple Layer 3/4 class maps for each Layer 3/4 policy map.
•
•

Create a Layer 3/4 Class Map for Through Traffic

A Layer 3/4 class map matches traffic based on protocols, ports, IP addresses and other Layer 3 or 4
attributes.
We suggest that you only inspect traffic on ports on which you expect application traffic; if you inspect
Tip
all traffic, for example using match any, the ASA performance can be impacted.
Procedure
Create a Layer 3/4 class map, where class_map_name is a string up to 40 characters in length.
Step 1
class-map class_map_name
The name "class-default" is reserved. All types of class maps use the same name space, so you cannot
reuse a name already used by another type of class map. The CLI enters class-map configuration mode.
Example:
hostname(config)# class-map all_udp
(Optional) Add a description to the class map.
Step 2
description string
Example:
hostname(config-cmap)# description All UDP traffic
Match traffic using one of the following commands. Unless otherwise specified, you can include only
Step 3
one match command in the class map.
•
•
•
•
Create a Layer 3/4 Class Map for Through Traffic, page 11-13
Create a Layer 3/4 Class Map for Management Traffic, page 11-15
match any—Matches all traffic.
hostname(config-cmap)# match any
match access-list access_list_name—Matches traffic specified by an extended ACL. If the ASA is
operating in transparent firewall mode, you can use an EtherType ACL.
hostname(config-cmap)# match access-list udp
match port {tcp | udp} {eq port_num | range port_num port_num}—Matches TCP or UDP
destination ports, either a single port or a contiguous range of ports. For applications that use
multiple, non-contiguous ports, use the match access-list command and define an ACE to match
each port.
hostname(config-cmap)# match tcp eq 80
match default-inspection-traffic—Matches default traffic for inspection: the default TCP and
UDP ports used by all applications that the ASA can inspect.
Cisco ASA Series Firewall CLI Configuration Guide
Configure Service Policies
11-13