Cisco ASA 5506-X Configuration Manual page 31

Chapter 2 Special Actions for Application Inspections (Inspection Policy Map)
Default Inspection Policy Maps
DNS inspection is enabled by default, using the preset_dns_map inspection class map:
•
•
•
•
•
See the following default commands:
policy-map type inspect dns preset_dns_map
parameters
There are other default inspection policy maps such as _default_esmtp_map. For example, inspect
Note
esmtp implicitly uses the policy map "_default_esmtp_map." All the default policy maps can be shown
by using the show running-config all policy-map command.
maps are matched according to the order they are added to the policy map. If the lowest priority
match for each class map is different, then the class map with the higher priority match command
is matched first. For example, the following three class maps contain two types of match commands:
match request-cmd (higher priority) and match filename (lower priority). The ftp3 class map
includes both commands, but it is ranked according to the lowest priority command, match
filename. The ftp1 class map includes the highest priority command, so it is matched first,
regardless of the order in the policy map. The ftp3 class map is ranked as being of the same priority
as the ftp2 class map, which also contains the match filename command. They are matched
according to the order in the policy map: ftp3 and then ftp2.
class-map type inspect ftp match-all ftp1
match request-cmd get
class-map type inspect ftp match-all ftp2
match filename regex abc
class-map type inspect ftp match-all ftp3
match request-cmd get
match filename regex abc
policy-map type inspect ftp ftp
class ftp3
log
class ftp2
log
class ftp1
log
The maximum DNS message length is 512 bytes.
The maximum client DNS message length is automatically set to match the Resource Record.
DNS Guard is enabled, so the ASA tears down the DNS session associated with a DNS query as
soon as the DNS reply is forwarded by the ASA. The ASA also monitors the message exchange to
ensure that the ID of the DNS reply matches the ID of the DNS query.
Translation of the DNS record based on the NAT configuration is enabled.
Protocol enforcement is enabled, which enables DNS message format check, including domain
name length of no more than 255 characters, label length of 63 characters, compression, and looped
pointer check.
message-length maximum client auto
message-length maximum 512
dns-guard
protocol-enforcement
nat-rewrite
Default Inspection Policy Maps
Cisco ASA Series Firewall CLI Configuration Guide
2-3