Modular Framework Policy - Practical Uses

[yuchenglai]

Hello All,

I was wondering if anyone has made practical uses of the ASA's Modular Framework Policy, especially in creating customized inspection engines via creating inspection-policy maps and matching regex expressions in the inspection-policy. How does a firewall administrator know what inspection-policy map to create and implement to keep up with the latest security threats? What resources or forums can a firewall administrator go to to find security threats that can be thwarted by creating inspection-policy maps? I see this as a very powerful tool, but where does one begin?

[cleidh_mor]

Hi,

The first step, as always, is to identify what threats you are trying to protect against. Once you know what to block, you should create a semi-formal policy definition and use the CCO documentation to tranfer this to the ASA.

In terms of forums, this one is pretty good for specific queries; CCO and Google are your friends.

HTH

[yuchenglai]

I will probably dig through CCO. Thanks for the suggestion