topic Default FWSM inspection policy in Network Security

Default FWSM inspection policy

bourse — Mon, 11 Mar 2019 19:33:47 GMT

On FWSM (running version 4.1 in my case) the default global policy uses the following class map:

class-map inspection_default
match default-inspection-traffic

Does anyone know what "default-inspection-traffic" includes? Is it all traffic? If so, do I really want all my traffic to go through the inspection engine? I would imagine this would have a performance impact on traffic that is not part of the protocols being inspected.

Any insight would be greatly appreciated.

David W.

Re: Default FWSM inspection policy

Panos Kampanakis — Tue, 11 Jan 2011 17:42:41 GMT

The "default_inspection_traffic" is all traffic that is predefined for various protocols. For example for tcp port 21, if you have "inspect ftp" under the class-map ftp inspection will kick in. Though, port 22 will not be inspected for ftp. Do not worry about performance as far as default behavior is concerned, people rarely see issues. But it would be a good idea to only inspect protocols you need to inspect under the default_inspection_traffic.

I hope it helps.

Re: Default FWSM inspection policy

PAUL GILBERT ARIAS — Tue, 11 Jan 2011 17:51:30 GMT

On the ASA you can use the command " clear config fixup" in order to get the default inspection policies. I assume it will work the same in the FWSM.

Re: Default FWSM inspection policy

Panos Kampanakis — Tue, 11 Jan 2011 18:13:15 GMT

You would need to go under the policy-map to remove the inspections you don't need.

Re: Default FWSM inspection policy

bourse — Tue, 11 Jan 2011 18:37:19 GMT

I'm less concerned about removing fixups I don't need than having unnecesary traffic going through the inspection engine. In the document here https://supportforums.cisco.com/docs/DOC-12668 it indicates that "As a general rule, avoid enabling application inspection on any traffic unnecessarily as it will significantly impact the throughput of these flows".

So this leads me to my original question as to how to make sure we don't forward unnecessary traffic to the inspection engine. If "default-inspection-traffic" maps to specific ports (ex: 80, 21, etc...) then I'm good. But if it maps to "any" then I'm not.

What would be the impact on removing all the fixups? Would it break anything?

Re: Default FWSM inspection policy

Panos Kampanakis — Tue, 11 Jan 2011 19:19:38 GMT

For example, TCP port 80 will only meet "inspect http".

I think that answers the question.

Re: Default FWSM inspection policy

bourse — Tue, 11 Jan 2011 19:23:34 GMT

Thank you.

Re: Default FWSM inspection policy

Panos Kampanakis — Tue, 11 Jan 2011 19:32:30 GMT

Please mark this as answered if it is, for the benefit of others.

Regards,

Default FWSM inspection policy

ialonso — Fri, 16 Dec 2011 22:55:16 GMT

The CLI help in the FWSM actually displays what's included in the "default-inspection-traffic" match definition:

FWSM/context1(config)# class-map inspection_default

FWSM/context1(config-cmap)# match ?

mpf-class-map mode commands/options:

access-list Match an Access List

any Match any packet

default-inspection-traffic Match default inspection traffic:

ctiqbe----tcp--2748 dns-------udp--53

ftp-------tcp--21 gtp-------udp--2123,3386

h323-h225-tcp--1720 h323-ras--udp--1718-1719

http------tcp--80 icmp------icmp

ils-------tcp--389 mgcp------udp--2427,2727

netbios---udp--137-138 rpc-------udp--111

rsh-------tcp--514 rtsp------tcp--554

sip-------tcp--5060 sip-------udp--5060

skinny----tcp--2000 smtp------tcp--25

sqlnet----tcp--1521 tftp------udp--69

xdmcp-----udp--177

port Match TCP/UDP port(s)

Re: Default FWSM inspection policy

Moin Khan — Tue, 20 Mar 2012 14:12:22 GMT

How does traffic inspection works ?

Traffic with Inspection On is sent to the Control Point for Deep Paket Inspection and tarffic not being inspected takes Fastpath.

If I remove SQLNET from default inspection , Do I need correct ACL to permit SQLNET for Fastpath? or it's not required

Please advise