Is it possible to have more than one SFR class map?
For example
ciscoasa(config)# access-list sfr_redirect extended permit ip 192.168.100.0 255.255.255.0 any
ciscoasa(config)# access-list sfr_redirect-mon extended permit ip any any
ciscoasa(config)# class-map sfr
ciscoasa(config-cmap)# match access-list sfr_redirect
ciscoasa(config)# class-map sfr-mon
ciscoasa(config-cmap)# match access-list sfr_redirect-mon
ciscoasa(config)# policy-map global_policy
ciscoasa(config-pmap)# class sfr
ciscoasa(config-pmap-c)# sfr fail-open
ciscoasa(config)# policy-map global_policy
ciscoasa(config-pmap)# class sfr-mon
ciscoasa(config-pmap-c)# sfr fail-open monitor-only
This way anything that matches the sfr_redirect ACL I can block traffic on the SFR module, however everything else will just be monitor only.
I know the ASA will take the multiple SFR class maps in the global policy map. I just want to make sure it will function as I picture it will.
