Default class/policy-maps

[goAtsyNasdaq]

Hello,

I'm new to comm/firewall-related things. I have a new customer that has an ASA 5505.

This ASA doesn't have any class-map or policy-map statements in its config. From what I've read there is, by default in an ASA 5505, the following configuration...

class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
  message-length maximum 512
policy-map global_policy
class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny 
  inspect sunrpc
  inspect xdmcp
  inspect sip 
  inspect netbios
  inspect tftp
!
service-policy global_policy global

The only problem I notice from the missing stuff is that FTP doesn't work (clients from the inside can't access or download files from FTP-servers on the internet). I've managed to solve this with the following configuration...

class-map FTP-traffic
   match port tcp eq ftp

policy-map FTP-policy
   class FTP-traffic
   inspect ftp

service-policy FTP-policy interface outside

My question is should I recreate the default class-map and policy-map? What functionality do they provide... can they introduce any latency or other problems?

Thanks in advance

[Jennifer Halim]

You do not need to configure the default policy map inspection if none of the default protocols are needed in your environment.

Here is the description of each inspection protocol for your reference:

http://www.cisco.com/en/US/docs/security/asa/asa80/command/reference/i2.html

Hope that helps.

[goAtsyNasdaq]

Thanks for your answer

Currently FTP and DNS are the only protocols in the default-inspection-list that is permitted outbound in the firewall configuration. I think I´ll go ahead and enable the defaults anyway.

[Jennifer Halim]

Yes, definitely. Go ahead and enable the default inspection policy.

[naumoskivladimir]

According to this link http://www.pingafrica.org/node/135 I configure my CISCO OIOS (tm) C1700 Software (C1700-Y-M), Version 12.3(17a), router to filter HTML trafic. It works perfectly.

     Could you tell me how to configure it to not filter traffic for specific IP addresses ex. administrators and other privileged users in my network?

Thanks a lot..