Cisco ASA Series Configuration Manual page 354

Skinny (SCCP) Inspection
Example:
hostname(config)# class-map sccp_class_map
hostname(config-cmap)# match access-list sccp
In the default global policy, the inspection_default class map is a special class map that includes default
ports for all inspection types (match default-inspection-traffic). If you are using this class map in
either the default policy or for a new service policy, you can skip this step.
For information on matching statements, see
Add or edit a policy map that sets the actions to take with the class map traffic.
Step 2
policy-map name
Example:
hostname(config)# policy-map global_policy
In the default configuration, the global_policy policy map is assigned globally to all interfaces. If you
want to edit the global_policy, enter global_policy as the policy name.
Identify the L3/L4 class map you are using for SCCP inspection.
Step 3
class name
Example:
hostname(config-pmap)# class inspection_default
To edit the default policy, or to use the special inspection_default class map in a new policy, specify
inspection_default for the name. Otherwise, you are specifying the class you created earlier in this
procedure.
Configure SCCP inspection.
Step 4
inspect skinny [sccp_policy_map] [tls-proxy proxy_name]
Where:
sccp_policy_map is the optional SCCP inspection policy map. You need a map only if you want
•
non-default inspection processing. For information on creating the SCCP inspection policy map, see
Configure a Skinny (SCCP) Inspection Policy Map for Additional Inspection Control, page
tls-proxy proxy_name identifies the TLS proxy to use for this inspection. You need a TLS proxy
•
only if you want to enable inspection of encrypted traffic.
Example:
hostname(config-class)# no inspect skinny
hostname(config-class)# inspect skinny sccp-map
Note
If you are editing an existing service policy (such as the default global policy called global_policy), you
Step 5
are done. Otherwise, activate the policy map on one or more interfaces.
service-policy policymap_name {global | interface interface_name}
Example:
hostname(config)# service-policy global_policy global
Cisco ASA Series Firewall CLI Configuration Guide
14-34
If you are editing the default global policy (or any in-use policy) to use a different SCCP
inspection policy map, you must remove the SCCP inspection with the no inspect skinny
command, and then re-add it with the new SCCP inspection policy map name.
Chapter 14 Inspection for Voice and Video Protocols
Identify Traffic (Layer 3/4 Class Maps), page 11-13.
14-32.