Cisco ASA 5506-X Configuration Manual page 12

About Service Policies
Examples of Packet Matching
For example:
•
•
•
•
Order in Which Multiple Feature Actions are Applied
The order in which different types of actions in a policy map are performed is independent of the order
in which the actions appear in the policy map.
Actions are performed in the following order:
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
NetFlow Secure Event Logging filtering and User statistics for Identity Firewall are order-independent.
Note
Cisco ASA Series Firewall CLI Configuration Guide
1-6
If a packet matches a class map for connection limits, and also matches a class map for an
application inspection, then both actions are applied.
If a packet matches a class map for HTTP inspection, but also matches another class map that
includes HTTP inspection, then the second class map actions are not applied.
If a packet matches a class map for HTTP inspection, but also matches another class map that
includes FTP inspection, then the second class map actions are not applied because HTTP and FTP
inspections cannot be combined.
If a packet matches a class map for HTTP inspection, but also matches another class map that
includes IPv6 inspection, then both actions are applied because the IPv6 inspection can be combined
with any other type of inspection.
QoS input policing
TCP normalization, TCP and UDP connection limits and timeouts, TCP sequence number
randomization, and TCP state bypass.
When a the ASA performs a proxy service (such as AAA or CSC) or it modifies the TCP
Note
payload (such as FTP inspection), the TCP normalizer acts in dual mode, where it is applied
before and after the proxy or payload modifying service.
ASA CSC
Application inspections that can be combined with other inspections:
a. IPv6
IP options
b.
WAAS
c.
Application inspections that cannot be combined with other inspections. See
Certain Feature Actions, page 1-7
ASA IPS
ASA CX
ASA FirePOWER (ASA SFR)
QoS output policing
QoS standard priority queue
Chapter 1 Service Policy Using the Modular Policy Framework
for more information.
Incompatibility of