topic Thanks for your help. Mike in Network Security

Help setting up Service policy for CX module

burleyman — Tue, 12 Mar 2019 04:56:55 GMT

I want to setup a service policy rule to send traffic to the CX module. What would be the best setup for that? What interfaces? etc.

Mike

Best practice is to redirect

Marvin Rhoads — Thu, 16 Oct 2014 20:00:20 GMT

Best practice is to redirect traffic to the CX via your global policy (class class-default).

Do I send all traffic through

burleyman — Fri, 17 Oct 2014 14:53:28 GMT

Do I send all traffic through the CX or just some?

Which direction or both?

I did try to use the global policy and I had some issues with that. I will try again as maybe I missed something.

Also I need to make sure the ASA is not inspecting the HTTP traffic, correct?

Is there any other traffic that I should make sure the ASA does not inspect?

Will setting this up disrupt traffic?

Are there any step by steps for this? I could not seem to find any this about setting up the service policy specific to the traffic going to the CX module.

Mike

The Quick Start Guide covers

Marvin Rhoads — Fri, 17 Oct 2014 15:29:45 GMT

The Quick Start Guide covers it briefly. The User Guide goes into more detail and includes cli steps.

Ideally you'd send all traffic - that's part of the value of AVC, giving you visibility into and control over what's going on at the application level.

No, you should not inspect http on the base ASA. Any other inspections should be OK to keep.

With a default policy set there should not be any traffic disruption. Based on what policy you may have configured, you may get the blocks, warnings, etc. the product is designed to offer.

Even so we always recommend testing in a lab environment first and introducing any such significant change as part of a coordinated and approved maintenance window so that the possibility of service-affecting outage is taken into account.

Thank you for your help...so

burleyman — Fri, 17 Oct 2014 16:03:25 GMT

Thank you for your help...so based on all this see if this is correct.

Current Config

policy-map global_policy
class inspection_default
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
inspect icmp

********************************
Make these changes

policy-map global_policy
class class-default
cxsc fail-open

*****************************

Result

policy-map global_policy
class class-default
cxsc fail-open
class inspection_default
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
inspect icmp

That's it? I actually had found that but it seemed to easy so I did not think that was it.

Mike

Yes, that's all it takes to

Marvin Rhoads — Fri, 17 Oct 2014 17:14:27 GMT

Yes, that's all it takes to redirect the flows through the ASA into the CX module.

When you modify the policy-map the parser will actually put the class-default at the end of that configuration section instead of in the beginning as you showed in your reply.

Thanks for your help. Mike

burleyman — Fri, 17 Oct 2014 17:51:19 GMT

Thanks for your help.

Mike

You're welcome. Thanks for

Marvin Rhoads — Fri, 17 Oct 2014 18:45:40 GMT

You're welcome. Thanks for the ratings.

I was thinking about your question about impact. If you don't have a lab to work in ahead of time you can selectively choose to redirect only a single host or subnet to the CX module by defining it with an ACL and then trying out only that subset of your traffic in the CX policy regime.

Thanks for the info. I am

burleyman — Fri, 17 Oct 2014 19:13:29 GMT

Thanks for the info. I am going to do it on site early so I should be good to test and roll back as needed.

Thanks and have a great weekend.

Mike