Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

Default class/policy-maps


I'm new to comm/firewall-related things. I have a new customer that has an ASA 5505.

This ASA doesn't have any class-map or policy-map statements in its config. From what I've read there is, by default in an ASA 5505, the following configuration...

class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
  message-length maximum 512
policy-map global_policy
class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny 
  inspect sunrpc
  inspect xdmcp
  inspect sip 
  inspect netbios
  inspect tftp
service-policy global_policy global

The only problem I notice from the missing stuff is that FTP doesn't work (clients from the inside can't access or download files from FTP-servers on the internet). I've managed to solve this with the following configuration...

class-map FTP-traffic
   match port tcp eq ftp

policy-map FTP-policy
   class FTP-traffic
   inspect ftp

service-policy FTP-policy interface outside

My question is should I recreate the default class-map and policy-map? What functionality do they provide... can they introduce any latency or other problems?

Thanks in advance

Everyone's tags (2)
Cisco Employee

Re: Default class/policy-maps

You do not need to configure the default policy map inspection if none of the default protocols are needed in your environment.

Here is the description of each inspection protocol for your reference:

Hope that helps.

Community Member

Re: Default class/policy-maps

Thanks for your answer

Currently FTP and DNS are the only protocols in the default-inspection-list that is permitted outbound in the firewall configuration. I think I´ll go ahead and enable the defaults anyway.

Cisco Employee

Re: Default class/policy-maps

Yes, definitely. Go ahead and enable the default inspection policy.

Community Member

Re: Default class/policy-maps

According to this link I configure my CISCO OIOS (tm) C1700 Software (C1700-Y-M), Version 12.3(17a), router to filter HTML trafic. It works perfectly.

     Could you tell me how to configure it to not filter traffic for specific IP addresses ex. administrators and other privileged users in my network?

Thanks a lot..

CreatePlease to create content