Cisco ASA 5506-X Configuration Manual page 153

Chapter 7 Inspection of Basic Internet Protocols
policy-map name
Example:
hostname(config)# policy-map global_policy
In the default configuration, the global_policy policy map is assigned globally to all interfaces. If you
want to edit the global_policy, enter global_policy as the policy name.
Identify the L3/L4 class map you are using for DNS inspection.
Step 3
class name
Example:
hostname(config-pmap)# class inspection_default
To edit the default policy, or to use the special inspection_default class map in a new policy, specify
inspection_default for the name. Otherwise, you are specifying the class you created earlier in this
procedure.
Step 4 Configure DNS inspection.
inspect dns [dns_policy_map] [dynamic-filter-snoop]
Where:
dns_policy_map is the optional DNS inspection policy map. You need a map only if you want
•
non-default inspection processing. For information on creating the DNS inspection policy map, see
Configure DNS Inspection Policy Map, page
• dynamic-filter-snoop enables dynamic filter snooping, which is used exclusively by the Botnet
Traffic Filter. Include this keyword only if you use Botnet Traffic Filtering. We suggest that you
enable DNS snooping only on interfaces where external DNS requests are going. Enabling DNS
snooping on all UDP DNS traffic, including that going to an internal DNS server, creates
unnecessary load on the ASA.
Example:
hostname(config-class)# no inspect dns
hostname(config-class)# inspect dns dns-map
Note
If you are editing an existing service policy (such as the default global policy called global_policy), you
Step 5
are done. Otherwise, activate the policy map on one or more interfaces.
service-policy policymap_name {global | interface interface_name}
Example:
hostname(config)# service-policy global_policy global
The global keyword applies the policy map to all interfaces, and interface applies the policy to one
interface. Only one global policy is allowed. You can override the global policy on an interface by
applying a service policy to that interface. You can only apply one policy map to each interface.
If you are editing the default global policy (or any in-use policy) to use a different DNS
inspection policy map (for example, you are replacing the default preset_dns_map), you must
remove the DNS inspection with the no inspect dns command, and then re-add it with the new
DNS inspection policy map name.
7-3.
Cisco ASA Series Firewall CLI Configuration Guide
DNS Inspection
7-7