topic Default class/policy-maps in Network Security

Default class/policy-maps

goAtsyNasdaq — Mon, 11 Mar 2019 17:54:16 GMT

Hello,

I'm new to comm/firewall-related things. I have a new customer that has an ASA 5505.

This ASA doesn't have any class-map or policy-map statements in its config. From what I've read there is, by default in an ASA 5505, the following configuration...

class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
!
service-policy global_policy global

The only problem I notice from the missing stuff is that FTP doesn't work (clients from the inside can't access or download files from FTP-servers on the internet). I've managed to solve this with the following configuration...

class-map FTP-traffic
match port tcp eq ftp

policy-map FTP-policy
class FTP-traffic
inspect ftp

service-policy FTP-policy interface outside

My question is should I recreate the default class-map and policy-map? What functionality do they provide... can they introduce any latency or other problems?

Thanks in advance

Re: Default class/policy-maps

Jennifer Halim — Thu, 03 Jun 2010 09:18:21 GMT

You do not need to configure the default policy map inspection if none of the default protocols are needed in your environment.

Here is the description of each inspection protocol for your reference:

http://www.cisco.com/en/US/docs/security/asa/asa80/command/reference/i2.html

Hope that helps.

Re: Default class/policy-maps

goAtsyNasdaq — Thu, 03 Jun 2010 12:40:33 GMT

Thanks for your answer

Currently FTP and DNS are the only protocols in the default-inspection-list that is permitted outbound in the firewall configuration. I think I´ll go ahead and enable the defaults anyway.

Re: Default class/policy-maps

Jennifer Halim — Thu, 03 Jun 2010 12:52:01 GMT

Yes, definitely. Go ahead and enable the default inspection policy.

Re: Default class/policy-maps

naumoskivladimir — Mon, 05 Jul 2010 10:21:08 GMT

According to this link http://www.pingafrica.org/node/135 I configure my CISCO OIOS (tm) C1700 Software (C1700-Y-M), Version 12.3(17a), router to filter HTML trafic. It works perfectly.

Could you tell me how to configure it to not filter traffic for specific IP addresses ex. administrators and other privileged users in my network?

Thanks a lot..