Cisco ASA 5506-X Configuration Manual page 11

Chapter 1 Service Policy Using the Modular Policy Framework
When you use a global policy, all features are unidirectional; features that are normally bidirectional
Note
when applied to a single interface only apply to the ingress of each interface when applied globally.
Because the policy is applied to all interfaces, the policy will be applied in both directions so
bidirectionality in this case is redundant.
For features that are applied unidirectionally, for example QoS priority queue, only traffic that enters (or
exits, depending on the feature) the interface to which you apply the policy map is affected. See the
following table for the directionality of each feature.
Table 1-2
Feature
Application inspection (multiple types)
ASA CSC
ASA CX
ASA CX authentication proxy
ASA FirePOWER (ASA SFR)
ASA IPS
NetFlow Secure Event Logging filtering
QoS input policing
QoS output policing
QoS standard priority queue
TCP and UDP connection limits and timeouts,
and TCP sequence number randomization
TCP normalization
TCP state bypass
User statistics for Identity Firewall
Feature Matching Within a Service Policy
A packet matches class maps in a policy map for a given interface according to the following rules:
1.
2.
3.
Feature Directionality
A packet can match only one class map in the policy map for each feature type.
When the packet matches a class map for a feature type, the ASA does not attempt to match it to any
subsequent class maps for that feature type.
If the packet matches a subsequent class map for a different feature type, however, then the ASA
also applies the actions for the subsequent class map, if supported. See
Feature Actions, page 1-7
Note Application inspection includes multiple inspection types, and most are mutually exclusive.
For inspections that can be combined, each inspection is considered to be a separate feature.
Single Interface Direction Global Direction
Bidirectional
Bidirectional
Bidirectional
Ingress
Bidirectional
Bidirectional
N/A
Ingress
Egress
Egress
Bidirectional
Bidirectional
Bidirectional
Bidirectional
for more information about unsupported combinations.
Cisco ASA Series Firewall CLI Configuration Guide
About Service Policies
Ingress
Ingress
Ingress
Ingress
Ingress
Ingress
Ingress
Ingress
Egress
Egress
Ingress
Ingress
Ingress
Ingress
Incompatibility of Certain
1-5