Default Layer 3/4 Policy Map - Cisco FirePOWER ASA 5500 series Configuration Manual

Defining Actions Using a Layer 3/4 Policy Map
For features that are applied unidirectionally, for example QoS priority queue, only traffic that exits the
interface to which you apply the policy map is affected. See
feature.
Table 21-2
Feature
TCP normalization, TCP and UDP connection
limits and timeouts, and TCP sequence number
randomization
CSC
Application inspection
IPS
QoS input policing
QoS output policing
QoS priority queue
The order in which different types of actions in a policy map are performed is independent of the order
in which the actions appear in the policy map. Actions are performed in the following order:
•
Note
•
•
•
•
•
•
You can only assign one policy map per interface, but you can apply the same policy map to multiple
interfaces.

Default Layer 3/4 Policy Map

The configuration includes a default Layer 3/4 policy map that the security appliance uses in the default
global policy. It is called global_policy and performs inspection on the default inspection traffic. You
can only apply one global policy, so if you want to alter the global policy, you need to either reconfigure
the default policy or disable it and apply a new one.
The default policy map configuration includes the following commands:
policy-map global_policy
class inspection_default
Cisco Security Appliance Command Line Configuration Guide
21-14
Feature Directionality
TCP normalization, TCP and UDP connection limits and timeouts, and TCP sequence number
randomization
When a the security appliance performs a proxy service (such as AAA or CSC) or it modifies
the TCP payload (such as FTP inspection), the TCP normalizer acts in dual mode, where it is
applied before and after the proxy or payload modifying service.
CSC
Application inspection
IPS
QoS input policing
QoS output policing
QoS priority queue
Chapter 21
Table 21-2 for the directionality of each
Single Interface Direction Global Direction
Bidirectional
Bidirectional
Bidirectional
Bidirectional
Ingress
Egress
Egress
Using Modular Policy Framework
Ingress
Ingress
Ingress
Ingress
Ingress
Egress
Egress
OL-10088-01