No class inspection_default on 5505?

[Colin Higgins]

I was under the impression that all Cisco ASA firewalls shipped with a default inspection policy.

Example

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect rsh

  inspect rtsp

  inspect esmtp

  inspect sqlnet

  inspect skinny 

  inspect sunrpc

  inspect xdmcp

  inspect sip 

  inspect netbios

  inspect tftp

  inspect ip-options

  inspect http

  inspect ipsec-pass-thru

However, looking at a 5505 I have here, there is NO default inspection policy defined. If I try to add

policy-map global_policy

class inspection_default

It tells me there is no class inspection_default

can I build this myself? Why is it missing (I have two other ASA 5505s here that also do not have it). What would I do to rebuild it?

[Colin Higgins]

Ah, nevermind: figured out what the issue was

you need the

class-map inspection_default
 match default-inspection-traffic

[Maykol Rojas]

Hello Collin,

When there is no inspection default, you can also add "Clear config fixup" and the default policy will appear.

Mike

[ziggitarrius]

clear config fixup is a nifty trick.

Thank you!