Cisco 7604 Configuration Manual page 384

Configuring Special Actions for Application Inspections (Inspection Policy Map)
See the
inspection policy maps.
The policy_map_name argument is the name of the policy map up to 40 characters in length. All types
of policy maps use the same name space, so you cannot reuse a name already used by another type of
policy map. The CLI enters policy-map configuration mode.
To apply actions to matching traffic, perform the following steps:
Step 3
Specify the traffic on which you want to perform actions using one of the following methods:
a.
•
•
Specify the action you want to perform on the matching traffic by entering the following command:
b.
hostname(config-pmap-c)# {[drop | drop-connection | mask | reset] [log] | log}
Not all options are available for each application. Other actions specific to the application might also
be available. See
options available.
The drop keyword drops all packets that match.
The drop-connection keyword drops the packet and closes the connection.
The mask keyword masks out the matching portion of the packet.
The reset keyword drops the packet, closes the connection, and sends a TCP reset to the server
and/or client.
The log keyword, which you can use alone or with one of the other keywords, sends a system log
message.
You can specify multiple class or match commands in the policy map.
Note
If a packet matches multiple different match or class commands, then the order in which the FWSM
applies the actions is determined by internal FWSM rules, and not by the order they are added to the
policy map. The internal rules are determined by the application type and the logical progression of
parsing a packet, and are not user-configurable. For example for HTTP traffic, parsing a Request Method
field precedes parsing the Header Host Length field; an action for the Request Method field occurs
before the action for the Header Host Length field. For example, the following match commands can be
entered in any order, but the match request method get command is matched first.
match request header host length gt 100
reset
match request method get
log
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM
20-8
"Configuring Application Inspection" section on page 22-6
Specify the inspection class map that you created in the
Class Map" section on page 20-10
hostname(config-pmap)# class class_map_name
hostname(config-pmap-c)#
Not all applications support inspection class maps.
Specify traffic directly in the policy map using one of the match commands described for each
application in Chapter 22, "Applying Application Layer Protocol Inspection."
match not command, then any traffic that matches the criterion in the match not command does
not have the action applied.
Chapter 22, "Applying Application Layer Protocol Inspection."
Chapter 20
for a list of applications that support
"Identifying Traffic in an Inspection
by entering the following command:
Using Modular Policy Framework
If you use a
for the exact
OL-20748-01