Cisco ASA 5506-X Configuration Manual page 157

Chapter 7 Inspection of Basic Internet Protocols
For the traffic that you identify in this class map, you specify actions to take on the traffic in the
inspection policy map.
If you want to perform different actions for each match command, you should identify the traffic directly
in the policy map.
a. Create the class map by entering the following command:
hostname(config)# class-map type inspect ftp [match-all | match-any] class_map_name
hostname(config-cmap)#
Where the class_map_name is the name of the class map. The match-all keyword is the default, and
specifies that traffic must match all criteria to match the class map. The match-any keyword
specifies that the traffic matches the class map if it matches at least one match statement. The CLI
enters class-map configuration mode, where you can enter one or more match commands.
b. (Optional) To add a description to the class map, enter the following command:
hostname(config-cmap)# description string
Where string is the description of the class map (up to 200 characters).
Specify the traffic on which you want to perform actions using one of the following match
c.
commands. If you use a match not command, then any traffic that does not match the criterion in
the match not command has the action applied.
•
•
•
•
•
Enter exit to leave class map configuration mode.
d.
match [not] filename regex {regex_name | class class_name}—Matches the filename in the
FTP transfer against the specified regular expression or regular expression class.
match [not] filetype regex {regex_name | class class_name}—Matches the file type in the FTP
transfer against the specified regular expression or regular expression class.
match [not] request-command ftp_command [ ftp_command...]—Matches the FTP command,
one or more of the following:
APPE—Append to a file.
CDUP—Changes to the parent directory of the current working directory.
DELE—Delete a file on the server.
GET—Gets a file from the server.
HELP—Provides help information.
MKD—Makes a directory on the server.
PUT—Sends a file to the server.
RMD—Deletes a directory on the server.
RNFR—Specifies the "rename-from" filename.
RNTO—Specifies the "rename-to" filename.
SITE—Used to specify a server-specific command. This is usually used for remote
administration.
STOU—Stores a file using a unique file name.
match [not] server regex {regex_name | class class_name}—Matches the FTP server name
against the specified regular expression or regular expression class.
match [not] username regex {regex_name | class class_name}—Matches the FTP username
against the specified regular expression or regular expression class.
Cisco ASA Series Firewall CLI Configuration Guide
FTP Inspection
7-11