Help setting up Service policy for CX module

Answered Question
Oct 16th, 2014
User Badges:
  • Blue, 1500 points or more

I want to setup a service policy rule to send traffic to the CX module. What would be the best setup for that? What interfaces? etc.

 

Mike

Correct Answer by Marvin Rhoads about 2 years 10 months ago

The Quick Start Guide covers it briefly. The User Guide goes into more detail and includes cli steps.

Ideally you'd send all traffic - that's part of the value of AVC, giving you visibility into and control over what's going on at the application level.

No, you should not inspect http on the base ASA. Any other inspections should be OK to keep.

With a default policy set there should not be any traffic disruption. Based on what policy you may have configured, you may get the blocks, warnings, etc. the product is designed to offer.

Even so we always recommend testing in a lab environment first and introducing any such significant change as part of a coordinated and approved maintenance window so that the possibility of service-affecting outage is taken into account.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (4 ratings)
Loading.
Marvin Rhoads Thu, 10/16/2014 - 13:00
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,
  • Cisco Designated VIP,

    2017 Firewalling, Network Management, VPN

Best practice is to redirect traffic to the CX via your global policy (class class-default).

burleyman Fri, 10/17/2014 - 07:53
User Badges:
  • Blue, 1500 points or more

Do I send all traffic through the CX or just some?

Which direction or both?

I did try to use the global policy and I had some issues with that. I will try again as maybe I missed something.

Also I need to make sure the ASA is not inspecting the HTTP traffic, correct?

Is there any other traffic that I should make sure the ASA does not inspect?

Will setting this up disrupt traffic?

Are there any step by steps for this? I could not seem to find any this about setting up the service policy specific to the traffic going to the CX module.

 

Mike

Correct Answer
Marvin Rhoads Fri, 10/17/2014 - 08:29
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,
  • Cisco Designated VIP,

    2017 Firewalling, Network Management, VPN

The Quick Start Guide covers it briefly. The User Guide goes into more detail and includes cli steps.

Ideally you'd send all traffic - that's part of the value of AVC, giving you visibility into and control over what's going on at the application level.

No, you should not inspect http on the base ASA. Any other inspections should be OK to keep.

With a default policy set there should not be any traffic disruption. Based on what policy you may have configured, you may get the blocks, warnings, etc. the product is designed to offer.

Even so we always recommend testing in a lab environment first and introducing any such significant change as part of a coordinated and approved maintenance window so that the possibility of service-affecting outage is taken into account.

burleyman Fri, 10/17/2014 - 09:03
User Badges:
  • Blue, 1500 points or more

Thank you for your help...so based on all this see if this is correct.

 

Current Config

policy-map global_policy
 class inspection_default
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect sqlnet
  inspect skinny  
  inspect sunrpc
  inspect xdmcp
  inspect sip  
  inspect netbios
  inspect tftp
  inspect ip-options
  inspect icmp

********************************
Make these changes

policy-map global_policy
class class-default
cxsc fail-open

*****************************

Result

policy-map global_policy
 class class-default
  cxsc fail-open
 class inspection_default
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect sqlnet
  inspect skinny  
  inspect sunrpc
  inspect xdmcp
  inspect sip  
  inspect netbios
  inspect tftp
  inspect ip-options
  inspect icmp

 

 

That's it? I actually had found that but it seemed to easy so I did not think that was it.

 

Mike

Marvin Rhoads Fri, 10/17/2014 - 10:14
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,
  • Cisco Designated VIP,

    2017 Firewalling, Network Management, VPN

Yes, that's all it takes to redirect the flows through the ASA into the CX module.

When you modify the policy-map the parser will actually put the class-default at the end of that configuration section instead of in the beginning as you showed in your reply.

burleyman Fri, 10/17/2014 - 10:51
User Badges:
  • Blue, 1500 points or more

Thanks for your help.

 

Mike

Marvin Rhoads Fri, 10/17/2014 - 11:45
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,
  • Cisco Designated VIP,

    2017 Firewalling, Network Management, VPN

You're welcome. Thanks for the ratings.

I was thinking about your question about impact. If you don't have a lab to work in ahead of time you can selectively choose to redirect only a single host or subnet to the CX module by defining it with an ACL and then trying out only that subset of your traffic in the CX policy regime.

burleyman Fri, 10/17/2014 - 12:13
User Badges:
  • Blue, 1500 points or more

Thanks for the info. I am going to do it on site early so I should be good to test and roll back as needed.

Thanks and have a great weekend.

Mike

Actions

This Discussion