Default class/policy-maps

Unanswered Question
Jun 3rd, 2010


I'm new to comm/firewall-related things. I have a new customer that has an ASA 5505.

This ASA doesn't have any class-map or policy-map statements in its config. From what I've read there is, by default in an ASA 5505, the following configuration...

class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
  message-length maximum 512
policy-map global_policy
class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny 
  inspect sunrpc
  inspect xdmcp
  inspect sip 
  inspect netbios
  inspect tftp
service-policy global_policy global

The only problem I notice from the missing stuff is that FTP doesn't work (clients from the inside can't access or download files from FTP-servers on the internet). I've managed to solve this with the following configuration...

class-map FTP-traffic
   match port tcp eq ftp

policy-map FTP-policy
   class FTP-traffic
   inspect ftp

service-policy FTP-policy interface outside

My question is should I recreate the default class-map and policy-map? What functionality do they provide... can they introduce any latency or other problems?

Thanks in advance

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
goAtsyNasdaq Thu, 06/03/2010 - 05:40

Thanks for your answer

Currently FTP and DNS are the only protocols in the default-inspection-list that is permitted outbound in the firewall configuration. I think I´ll go ahead and enable the defaults anyway.

naumoskivladimir Mon, 07/05/2010 - 03:21

According to this link I configure my CISCO OIOS (tm) C1700 Software (C1700-Y-M), Version 12.3(17a), router to filter HTML trafic. It works perfectly.

     Could you tell me how to configure it to not filter traffic for specific IP addresses ex. administrators and other privileged users in my network?

Thanks a lot..


This Discussion

Related Content