Cisco ASA Series Configuration Manual page 340

RTSP Inspection
Where the policy_map_name is the name of the policy map. The CLI enters policy-map configuration
mode.
Step 3 (Optional) To add a description to the policy map, enter the following command:
hostname(config-pmap)# description string
To apply actions to matching traffic, perform the following steps.
Step 4
Specify the traffic on which you want to perform actions using one of the following methods:
a.
Specify the action you want to perform on the matching traffic by entering the following command:
b.
hostname(config-pmap-c)# {drop-connection [log] | log | rate-limit message_rate}
The drop-connection keyword drops the packet and closes the connection. This option is available
for URL matching.
The log keyword, which you can use alone or with drop-connection, sends a system log message.
The rate-limit message_rate argument limits the rate of messages per second. This option is
available for request method matching.
You can specify multiple class or match commands in the policy map. For information about the order
of class and match commands, see
To configure parameters that affect the inspection engine, perform the following steps:
Step 5
To enter parameters configuration mode, enter the following command:
a.
hostname(config-pmap)# parameters
hostname(config-pmap-p)#
Set one or more parameters. You can set the following options; use the no form of the command to
b.
disable the option:
Example
The following example shows a how to define an RTSP inspection policy map.
hostname(config)# regex badurl1 www.url1.com/rtsp.avi
hostname(config)# regex badurl2 www.url2.com/rtsp.rm
hostname(config)# regex badurl3 www.url3.com/rtsp.asp
hostname(config)# class-map type regex match-any badurl-list
hostname(config-cmap)# match regex badurl1
hostname(config-cmap)# match regex badurl2
hostname(config-cmap)# match regex badurl3
hostname(config)# policy-map type inspect rtsp rtsp-filter-map
hostname(config-pmap)# match url-filter regex class badurl-list
Cisco ASA Series Firewall CLI Configuration Guide
14-20
If you created an RTSP class map, specify it by entering the following command:
•
hostname(config-pmap)# class class_map_name
hostname(config-pmap-c)#
• Specify traffic directly in the policy map using one of the match commands described for RTSP
class maps. If you use a match not command, then any traffic that does not match the criterion
in the match not command has the action applied.
• reserve-port-protect—Restricts the use of reserve ports during media negotiation.
url-length-limit bytes—Sets a limit on the URL length allowed in the message, from 0 to 6000
•
bytes.
Chapter 14
How Multiple Traffic Classes are Handled, page
Inspection for Voice and Video Protocols
12-4.