Cisco ASA 5506-X Configuration Manual page 24

Configure Service Policies
hostname(config-pmap)# class telnet_traffic
hostname(config-pmap-c)# set connection timeout idle 0:0:0
hostname(config-pmap-c)# set connection conn-max 100
hostname(config-pmap)# class ftp_traffic
hostname(config-pmap-c)# set connection timeout idle 0:5:0
hostname(config-pmap-c)# set connection conn-max 50
hostname(config-pmap)# class tcp_traffic
hostname(config-pmap-c)# set connection timeout idle 2:0:0
hostname(config-pmap-c)# set connection conn-max 2000
When a Telnet connection is initiated, it matches class telnet_traffic. Similarly, if an FTP connection is
initiated, it matches class ftp_traffic. For any TCP connection other than Telnet and FTP, it will match
class tcp_traffic. Even though a Telnet or FTP connection can match class tcp_traffic, the ASA does
not make this match because they previously matched other classes.
Apply Actions to an Interface (Service Policy)
To activate the Layer 3/4 policy map, create a service policy that applies it to one or more interfaces or
that applies it globally to all interfaces. Use the following command:
service-policy policy_map_name {global | interface interface_name} [fail-close]
Where:
•
•
•
•
Examples
For example, the following command enables the inbound_policy policy map on the outside interface:
hostname(config)# service-policy inbound_policy interface outside
The following commands disable the default global policy, and enables a new one called
new_global_policy on all other ASA interfaces:
hostname(config)# no service-policy global_policy global
hostname(config)# service-policy new_global_policy global
Cisco ASA Series Firewall CLI Configuration Guide
1-18
policy_map_name is the name of the policy map.
global creates a service policy that applies to all interfaces that do not have a specific policy.
You can only apply one global policy, so if you want to alter the global policy, you need to either
edit the default policy or disable it and apply a new one. By default, the configuration includes a
global policy that matches all default application inspection traffic and applies inspection to the
traffic globally. The default service policy includes the following command: service-policy
global_policy global.
interface interface_name creates a service policy by associating a policy map with an interface.
fail-close generates a syslog (767001) for IPv6 traffic that is dropped by application inspections that
do not support IPv6 traffic. By default, syslogs are not generated. For a list of inspections that
support IPv6, see IPv6 Guidelines, page
Chapter 1 Service Policy Using the Modular Policy Framework
1-8.