Cisco ASA 5506-X Configuration Manual page 30

Guidelines and Limitations
•
Guidelines and Limitations
•
•
•
Cisco ASA Series Firewall CLI Configuration Guide
2-2
Parameters—Parameters affect the behavior of the inspection engine.
HTTP inspection policy maps—If you modify an in-use HTTP inspection policy map (policy-map
type inspect http), you must remove and reapply the inspect http map action for the changes to
take effect. For example, if you modify the "http-map" inspection policy map, you must remove and
readd the inspect http http-map command from the layer 3/4 policy:
hostname(config)# policy-map test
hostname(config-pmap)# class http
hostname(config-pmap-c)# no inspect http http-map
hostname(config-pmap-c)# inspect http http-map
All inspection policy maps—If you want to exchange an in-use inspection policy map for a different
map name, you must remove the inspect protocol map command, and readd it with the new map.
For example:
hostname(config)# policy-map test
hostname(config-pmap)# class sip
hostname(config-pmap-c)# no inspect sip sip-map1
hostname(config-pmap-c)# inspect sip sip-map2
You can specify multiple class or match commands in the inspection policy map.
If a packet matches multiple different match or class commands, then the order in which the ASA
applies the actions is determined by internal ASA rules, and not by the order they are added to the
inspection policy map. The internal rules are determined by the application type and the logical
progression of parsing a packet, and are not user-configurable. For example for HTTP traffic,
parsing a Request Method field precedes parsing the Header Host Length field; an action for the
Request Method field occurs before the action for the Header Host Length field. For example, the
following match commands can be entered in any order, but the match request method get
command is matched first.
match request header host length gt 100
reset
match request method get
log
If an action drops a packet, then no further actions are performed in the inspection policy map. For
example, if the first action is to reset the connection, then it will never match any further match or
class commands. If the first action is to log the packet, then a second action, such as resetting the
connection, can occur.
If a packet matches multiple match or class commands that are the same, then they are matched in
the order they appear in the policy map. For example, for a packet with the header length of 1001,
it will match the first command below, and be logged, and then will match the second command and
be reset. If you reverse the order of the two match commands, then the packet will be dropped and
the connection reset before it can match the second match command; it will never be logged.
match request header length gt 100
log
match request header length gt 1000
reset
A class map is determined to be the same type as another class map or match command based on
the lowest priority match command in the class map (the priority is based on the internal rules). If
a class map has the same type of lowest priority match command as another class map, then the class
Chapter 2 Special Actions for Application Inspections (Inspection Policy Map)