Cisco ASA 5506-X Configuration Manual page 133

Chapter 6 Getting Started with Application Layer Protocol Inspection
match filename regex abc
class-map type inspect ftp match-all ftp3
match request-cmd get
match filename regex abc
policy-map type inspect ftp ftp
class ftp3
class ftp2
class ftp1
Guidelines for Application Inspection
Failover Guidelines
State information for multimedia sessions that require inspection are not passed over the state link for
stateful failover. The exceptions are GTP and SIP, which are replicated over the state link.
IPv6 Guidelines
Supports IPv6 for the following inspections:
•
•
•
•
•
•
•
•
•
Supports NAT64 for the following inspections:
•
•
•
•
Additional Guidelines and Limitations
•
•
log
log
log
DNS
FTP
HTTP
ICMP
SCCP (Skinny)
SIP
SMTP
IPsec pass-through
IPv6
DNS
FTP
HTTP
ICMP
Some inspection engines do not support PAT, NAT, outside NAT, or NAT between same security
interfaces. For more information about NAT support, see
page 6-6.
For all the application inspections, the ASA limits the number of simultaneous, active data
connections to 200 connections. For example, if an FTP client opens multiple secondary
connections, the FTP inspection engine allows only 200 active connections and the 201 connection
is dropped and the adaptive security appliance generates a system error message.
Guidelines for Application Inspection
Default Inspections and NAT Limitations,
Cisco ASA Series Firewall CLI Configuration Guide
6-5