topic Re: ASA 5520 Inspection_Default missing in Network Security

ASA 5520 Inspection_Default missing

Steve Babcock — Fri, 24 Apr 2020 14:00:27 GMT

my ASA 5520 (9.1(7) 32) was reset to defaults

In ASDM, there were no Service Policies (class-map and inspection_default) so I tried to create them with the following

I now have a global-policy and class-default but no inspection_default

Not sure what's missing ?

This is what that portion of the config looks like

class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect ip-options
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
policy-map global-policy
class class-default
user-statistics accounting
!
service-policy global-policy global

Re: ASA 5520 Inspection_Default missing

Sheraz.Salim — Fri, 24 Apr 2020 14:10:55 GMT

Your config look okay to me.

This is the config i have in my firewall as out of box. you good your config look good. what you want to achieve?

policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
no tcp-inspection
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
inspect icmp
inspect icmp error
policy-map type inspect dns migrated_dns_map_2
parameters
message-length maximum client auto
message-length maximum 512
no tcp-inspection
policy-map type inspect dns migrated_dns_map_1
parameters
message-length maximum client auto
message-length maximum 512
no tcp-inspection

Re: ASA 5520 Inspection_Default missing

Steve Babcock — Fri, 24 Apr 2020 14:24:57 GMT

ASDM does not show the inspection_default in the Service Policy Rules

only Global; Policy:global-policy

class-default

There should be an inspection_default listed there too

Re: ASA 5520 Inspection_Default missing

Sheraz.Salim — Fri, 24 Apr 2020 14:48:36 GMT

Is this what you mean

Re: ASA 5520 Inspection_Default missing

Steve Babcock — Fri, 24 Apr 2020 14:51:12 GMT

exactly !! 🙂

Not sure why it's not there

Re: ASA 5520 Inspection_Default missing

Sheraz.Salim — Fri, 24 Apr 2020 16:36:20 GMT

ASDM-->Configuration-->Firewall-->Service Policy Rules-->Globale;Policy:golabl_policy-->under here double click "inspection_default" a popup will come up with name "Edit Service Policy Rule" click "Traffic Classification" and check Default Inspection Traffic.

Re: ASA 5520 Inspection_Default missing

Steve Babcock — Fri, 24 Apr 2020 18:32:30 GMT

Inspection_Default is not showing in the list