Cisco ASA 5506-X Configuration Manual page 213

Chapter 8 Inspection for Voice and Video Protocols
b.
Example
The following example shows a how to define an RTSP inspection policy map.
hostname(config)# regex badurl1 www.url1.com/rtsp.avi
hostname(config)# regex badurl2 www.url2.com/rtsp.rm
hostname(config)# regex badurl3 www.url3.com/rtsp.asp
hostname(config)# class-map type regex match-any badurl-list
hostname(config-cmap)# match regex badurl1
hostname(config-cmap)# match regex badurl2
hostname(config-cmap)# match regex badurl3
hostname(config)# policy-map type inspect rtsp rtsp-filter-map
hostname(config-pmap)# match url-filter regex class badurl-list
hostname(config-pmap-p)# drop-connection
hostname(config)# class-map rtsp-traffic-class
hostname(config-cmap)# match default-inspection-traffic
hostname(config)# policy-map rtsp-traffic-policy
hostname(config-pmap)# class rtsp-traffic-class
hostname(config-pmap-c)# inspect rtsp rtsp-filter-map
hostname(config)# service-policy rtsp-traffic-policy global
Configure the RTSP Inspection Service Policy
The default ASA configuration includes RTSP inspection on the default port applied globally on all
interfaces. A common method for customizing the inspection configuration is to customize the default
global policy. You can alternatively create a new service policy as desired, for example, an
interface-specific policy.
Procedure
If necessary, create an L3/L4 class map to identify the traffic for which you want to apply the inspection.
Step 1
class-map name
match parameter
Example:
hostname(config)# class-map rtsp_class_map
hostname(config-cmap)# match access-list rtsp
In the default global policy, the inspection_default class map is a special class map that includes default
ports for all inspection types (match default-inspection-traffic). If you are using this class map in
either the default policy or for a new service policy, you can skip this step.
For information on matching statements, see
Set one or more parameters. You can set the following options; use the no form of the command to
disable the option:
• reserve-port-protect—Restricts the use of reserve ports during media negotiation.
url-length-limit bytes—Sets a limit on the URL length allowed in the message, from 0 to 6000
•
bytes.
Identify Traffic (Layer 3/4 Class Maps), page
Cisco ASA Series Firewall CLI Configuration Guide
RTSP Inspection
1-13.
8-21