When I enter the second inspect command under policy/class-map its says, ERROR: Multiple inspect commands can't be configured for a class without 'match default-inspection-traffic|none' in it.

Why is that ?

policy-map global_policy

class inspection_default

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect sqlnet

inspect skinny

inspect sunrpc

inspect xdmcp

inspect sip

inspect netbios

inspect tftp

inspect icmp

!

5505# conf t

5505(config)# policy-map global_policy

5505(config-pmap-c)# class http

5505(config-pmap-c)# ins http

5505(config-pmap-c)# ins ftp

ERROR: Multiple inspect commands can't be configured for a class without 'match default-inspection-traffic|none' in it.

I believe this is the error that you are referring to.

You cannot add two (multiple) inspections under one class unless the class is inspection_default

Pls. see the policy-map that I pasted above.

When I do show service-policy flow etc I see a high number of packets against the policy which means that the packet is matched against the class-map (ACL). But when I do show access-list, I see no or very low hit count.

The hit count doesn't match the packets inspected on show service-policy flow display.

You can remove the service policy and put it back after clearing the access-list coutners.

cler access-l counter

Then watch the show service-policy flow again.

What code is the ASA running?