Cisco ASA Series Cli Configuration Manual page 1066

Information About Service Policies
For example, if a packet matches a class map for connection limits, and also matches a class map for an
application inspection, then both actions are applied.
If a packet matches a class map for HTTP inspection, but also matches another class map that includes
HTTP inspection, then the second class map actions are not applied.
If a packet matches a class map for HTTP inspection, but also matches another class map that includes
FTP inspection, then the second class map actions are not applied because HTTP and FTP inspections
cannpt be combined.
If a packet matches a class map for HTTP inspection, but also matches another class map that includes
IPv6 inspection, then both actions are applied because the IPv6 inspection can be combined with any
other type of inspection.
Order in Which Multiple Feature Actions are Applied
The order in which different types of actions in a policy map are performed is independent of the order
in which the actions appear in the policy map.
Note
NetFlow Secure Event Logging filtering and User statistics for Identity Firewall are order-independent.
Actions are performed in the following order:
1.
2.
Note
3.
4.
5.
6.
7.
8.
9.
10.
Cisco ASA Series CLI Configuration Guide
1-4
Note
Application inspection includes multiple inspection types, and most are mutually exclusive.
For inspections that can be combined, each inspection is considered to be a separate feature.
QoS input policing
TCP normalization, TCP and UDP connection limits and timeouts, TCP sequence number
randomization, and TCP state bypass.
When a the ASA performs a proxy service (such as AAA or CSC) or it modifies the TCP payload
(such as FTP inspection), the TCP normalizer acts in dual mode, where it is applied before and
after the proxy or payload modifying service.
ASA CSC
Application inspections that can be combined with other inspections:
a.
IPv6
b.
IP options
c.
WAAS
Application inspections that cannot be combined with other inspections. See the
Certain Feature Actions" section on page 1-5
ASA IPS
ASA CX
QoS output policing
QoS standard priority queue
QoS traffic shaping, hierarchical priority queue
Chapter 1 Configuring a Service Policy Using the Modular Policy Framework
for more information.
"Incompatibility of