Cisco ASA 5506-X Configuration Manual page 22

Configure Service Policies
Procedure
Step 1 Create a management class map, where class_map_name is a string up to 40 characters in length.
class-map type management class_map_name
The name "class-default" is reserved. All types of class maps use the same name space, so you cannot
reuse a name already used by another type of class map. The CLI enters class-map configuration mode.
Example:
hostname(config)# class-map all_udp
Step 2 (Optional) Add a description to the class map.
description string
Example:
hostname(config-cmap)# description All UDP traffic
Match traffic using one of the following commands.
Step 3
•
•
Define Actions (Layer 3/4 Policy Map)
After you configure Layer 3/4 class maps to identify traffic, use a Layer 3/4 policy map to associate
actions to those classes.
The maximum number of policy maps is 64, but you can only apply one policy map per interface.
Tip
Procedure
Step 1 Add the policy map.
policy-map policy_map_name
The policy_map_name argument is the name of the policy map, up to 40 characters in length. All types
of policy maps use the same name space, so you cannot reuse a name already used by another type of
policy map. The CLI enters policy-map configuration mode.
Example:
hostname(config)# policy-map global_policy
Cisco ASA Series Firewall CLI Configuration Guide
1-16
match access-list access_list_name—Matches traffic specified by an extended ACL. If the ASA is
operating in transparent firewall mode, you can use an EtherType ACL.
hostname(config-cmap)# match access-list udp
match port {tcp | udp} {eq port_num | range port_num port_num}—Matches TCP or UDP
destination ports, either a single port or a contiguous range of ports. For applications that use
multiple, non-contiguous ports, use the match access-list command and define an ACE to match
each port.
hostname(config-cmap)# match tcp eq 80
Chapter 1 Service Policy Using the Modular Policy Framework