Buy or Renew
Buy or Renew
Duo Security forums now LIVE! Get answers to all your Duo Security questions. Learn more
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
3114
Views
0
Helpful
3
Replies

ASA Interface/global Service policy

Go to solution
benny
Level 1
Level 1

‎04-05-2007 03:41 AM - edited ‎03-11-2019 02:56 AM

Hi All...

My ASA have a default Global Service policy where it does Inspection.

And i wish to know is that if i apply an Interface Service policy which does MSS Exceed Allow for only HTTP/HTTPS/SMTP.

Is the ASA still doing the default Inspection as it's stated that it will override the default policy?

Rgds

Labels:
0 Helpful
1 Accepted Solution

Accepted Solutions

Go to solution
jgervia_2
Level 1
Level 1
In response to benny

‎04-05-2007 07:57 AM

Yes, that should work.

Alternatively, you might want to turn it on for the whole box:

tcp-map mss-map

exceed-mss allow

class-map match-any

match any

class-map inspection_default

match default-inspection-traffic

policy-map global_policy

class match-any

set connection advanced-options mss-map

class inspection_default

inspect ftp

inspect icmp

inspect whateveryouwanttoinspect

service-policy global_policy global

Feel free to ping me @ work on sametime if you have more questions.

--Jason

View solution in original post

0 Helpful
3 Replies 3

Go to solution
David White
Cisco Employee
Cisco Employee

‎04-05-2007 07:29 AM

The default policy will still take affect. The interface policy will also be used. If there is a conflict between the two policies, then the more specific Interface policy wins.

Sincerely,

David.

PS> If this answers your questions, please don't forget to check the box so we can cross this off our list.

0 Helpful

Go to solution
benny
Level 1
Level 1
In response to David White

‎04-05-2007 07:39 AM

Hi David..

Just a quick check, so does it still do HTTP/HTTPS/ESMTP inspection?

A rough config as follows. I have 2 Policy list for HTTP, 1 to allow MSS exceed and 1 for HTTP inspection.

access-list MSS extended permit tcp any any eq www

!

tcp-map TCPMSS

exceed-mss allow

class-map inspection_default

match default-inspection-traffic

class-map MSS-MAP

match access-list MSS

!

!

policy-map global_policy

class inspection_default

inspect http

policy-map SPHMSS-MAP

class SPHMSS-MAP

set connection advanced-options TCPMSS

!

service-policy global_policy global

service-policy MSS-MAP interface outside

Tks & Rgds

0 Helpful

Go to solution
jgervia_2
Level 1
Level 1
In response to benny

‎04-05-2007 07:57 AM

Yes, that should work.

Alternatively, you might want to turn it on for the whole box:

tcp-map mss-map

exceed-mss allow

class-map match-any

match any

class-map inspection_default

match default-inspection-traffic

policy-map global_policy

class match-any

set connection advanced-options mss-map

class inspection_default

inspect ftp

inspect icmp

inspect whateveryouwanttoinspect

service-policy global_policy global

Feel free to ping me @ work on sametime if you have more questions.

--Jason

0 Helpful
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Customers Also Viewed These Support Documents
Review Cisco Networking products for a $25 gift card