Cisco ASA 5506-X Configuration Manual page 239

Chapter 10 Inspection for Management Application Protocols
b.
Example
The following example shows how to define a DCERPC inspection policy map with the timeout
configured for DCERPC pinholes.
hostname(config)# policy-map type inspect dcerpc dcerpc_map
hostname(config-pmap)# timeout pinhole 0:10:00
hostname(config)# class-map dcerpc
hostname(config-cmap)# match port tcp eq 135
hostname(config)# policy-map global-policy
hostname(config-pmap)# class dcerpc
hostname(config-pmap-c)# inspect dcerpc dcerpc-map
hostname(config)# service-policy global-policy global
Configure the DCERPC Inspection Service Policy
DCERPC inspection is not enabled in the default inspection policy, so you must enable it if you need
this inspection. You can simply edit the default global inspection policy to add DCERPC inspection. You
can alternatively create a new service policy as desired, for example, an interface-specific policy.
Procedure
If necessary, create an L3/L4 class map to identify the traffic for which you want to apply the inspection.
Step 1
class-map name
match parameter
Example:
hostname(config)# class-map dcerpc_class_map
hostname(config-cmap)# match access-list dcerpc
In the default global policy, the inspection_default class map is a special class map that includes default
ports for all inspection types (match default-inspection-traffic). If you are using this class map in
either the default policy or for a new service policy, you can skip this step.
For information on matching statements, see
Add or edit a policy map that sets the actions to take with the class map traffic.
Step 2
policy-map name
Set one or more parameters. You can set the following options; use the no form of the command to
disable the option:
• timeout pinhole hh:mm:ss—Configures the timeout for DCERPC pinholes and override the
global system pinhole timeout of two minutes. The timeout can be from 00:00:01 to 119:00:00.
• endpoint-mapper [epm-service-only] [lookup-operation [timeout hh:mm:ss]]—Configures
options for the endpoint mapper traffic. The epm-service-only keyword enforces endpoint
mapper service during binding so that only its service traffic is processed. The
lookup-operation keyword enables the lookup operation of the endpoint mapper service. You
can configure the timeout for pinholes generated from the lookup operation. If no timeout is
configured for the lookup operation, the timeout pinhole command or the default is used.
Identify Traffic (Layer 3/4 Class Maps), page
Cisco ASA Series Firewall CLI Configuration Guide
DCERPC Inspection
1-13.
10-3