Cisco FirePOWER ASA 5500 series Configuration Manual page 446

FTP Inspection
For the traffic that you identify in this class map, you can specify actions such as drop, drop-connection,
reset, mask, set the rate limit, and/or log the connection in the inspection policy map.
If you want to perform different actions for each match command, you should identify the traffic
directly in the policy map.
a.
b.
c.
d.
e.
.
Table 25-3
request-command deny Option
appe
cdup
dele
get
help
mkd
put
rmd
rnfr
rnto
Cisco Security Appliance Command Line Configuration Guide
25-28
Create the class map by entering the following command:
hostname(config)# class-map type inspect ftp [match-all] class_map_name
hostname(config-cmap)#
Where class_map_name is the name of the class map. The match-all keyword specifies that traffic
must match all criteria to match the class map. match-all is the default and only option. The CLI
enters class-map configuration mode, where you can enter one or more match commands.
(Optional) To add a description to the class map, enter the following command:
hostname(config-cmap)# description string
(Optional) To match a filename for FTP transfer, enter the following command:
hostname(config-cmap)# match [not] filename regex [regex_name |
class regex_class_name]
Where the regex_name is the regular expression you created in
is the regular expression class map you created in
(Optional) To match a file type for FTP transfer,, enter the following command:
hostname(config-cmap)# match [not] filetype regex [regex_name |
class regex_class_name]
Where the regex_name is the regular expression you created in
is the regular expression class map you created in
(Optional) To disallow specific FTP commands, use the following command:
hostname(config-cmap)# match [not] request-command ftp_command [ftp_command...]
Where ftp_command with one or more FTP commands that you want to restrict. See
a list of the FTP commands that you can restrict.
FTP Map request-command deny Options
Chapter 25
Step 2.
Step 2.
Purpose
Disallows the command that appends to a file.
Disallows the command that changes to the parent directory of the
current working directory.
Disallows the command that deletes a file on the server.
Disallows the client command for retrieving a file from the server.
Disallows the command that provides help information.
Disallows the command that makes a directory on the server.
Disallows the client command for sending a file to the server.
Disallows the command that deletes a directory on the server.
Disallows the command that specifies rename-from filename.
Disallows the command that specifies rename-to filename.
Configuring Application Layer Protocol Inspection
Step 1. The class regex_class_name
Step 1. The class regex_class_name
Table 25-3 for
OL-10088-01