Cisco ASA 5506-X Configuration Manual page 20

Configure Service Policies
Procedure
Step 1 Create a Layer 3/4 class map, where class_map_name is a string up to 40 characters in length.
class-map class_map_name
The name "class-default" is reserved. All types of class maps use the same name space, so you cannot
reuse a name already used by another type of class map. The CLI enters class-map configuration mode.
Example:
hostname(config)# class-map all_udp
Step 2 (Optional) Add a description to the class map.
description string
Example:
hostname(config-cmap)# description All UDP traffic
Match traffic using one of the following commands. Unless otherwise specified, you can include only
Step 3
one match command in the class map.
• match any—Matches all traffic.
hostname(config-cmap)# match any
match access-list access_list_name—Matches traffic specified by an extended ACL. If the ASA is
•
operating in transparent firewall mode, you can use an EtherType ACL.
hostname(config-cmap)# match access-list udp
• match port {tcp | udp} {eq port_num | range port_num port_num}—Matches TCP or UDP
destination ports, either a single port or a contiguous range of ports. For applications that use
multiple, non-contiguous ports, use the match access-list command and define an ACE to match
each port.
hostname(config-cmap)# match tcp eq 80
match default-inspection-traffic—Matches default traffic for inspection: the default TCP and
•
UDP ports used by all applications that the ASA can inspect.
hostname(config-cmap)# match default-inspection-traffic
This command, which is used in the default global policy, is a special CLI shortcut that when used
in a policy map, ensures that the correct inspection is applied to each packet, based on the
destination port of the traffic. For example, when UDP traffic for port 69 reaches the ASA, then the
ASA applies the TFTP inspection; when TCP traffic for port 21 arrives, then the ASA applies the
FTP inspection. So in this case only, you can configure multiple inspections for the same class map
(with the exception of WAAS inspection, which can be configured with other inspections. See
Incompatibility of Certain Feature Actions, page 1-7
actions). Normally, the ASA does not use the port number to determine the inspection applied, thus
giving you the flexibility to apply inspections to non-standard ports, for example.
See
applications whose ports are included in the match default-inspection-traffic command are
enabled by default in the policy map.
You can specify a match access-list command along with the match default-inspection-traffic
command to narrow the matched traffic. Because the match default-inspection-traffic command
specifies the ports and protocols to match, any ports and protocols in the ACL are ignored.
Cisco ASA Series Firewall CLI Configuration Guide
1-14
Default Inspections and NAT Limitations, page 6-6
Chapter 1 Service Policy Using the Modular Policy Framework
for more information about combining
for a list of default ports. Not all