Cisco 7604 Configuration Guide - Page 384

Configuring Special Actions for Application Inspections (Inspection Policy Map) Chapter 20 Using Modular Policy Framework Step 3 See the "Configuring Application Inspection" section on page 22-6 for a list of applications that support inspection policy maps. The policy_map_name argument is the name of the policy map up to 40 characters in length. All types of policy maps use the same name space, so you cannot reuse a name already used by another type of policy map. The CLI enters policy-map configuration mode. To apply actions to matching traffic, perform the following steps: a. Specify the traffic on which you want to perform actions using one of the following methods: • Specify the inspection class map that you created in the "Identifying Traffic in an Inspection Class Map" section on page 20-10 by entering the following command: hostname(config-pmap)# class class_map_name hostname(config-pmap-c)# Not all applications support inspection class maps. • Specify traffic directly in the policy map using one of the match commands described for each application in Chapter 22, "Applying Application Layer Protocol Inspection." If you use a match not command, then any traffic that matches the criterion in the match not command does not have the action applied. b. Specify the action you want to perform on the matching traffic by entering the following command: hostname(config-pmap-c)# {[drop | drop-connection | mask | reset] [log] | log} Not all options are available for each application. Other actions specific to the application might also be available. See Chapter 22, "Applying Application Layer Protocol Inspection." for the exact options available. The drop keyword drops all packets that match. The drop-connection keyword drops the packet and closes the connection. The mask keyword masks out the matching portion of the packet. The reset keyword drops the packet, closes the connection, and sends a TCP reset to the server and/or client. The log keyword, which you can use alone or with one of the other keywords, sends a system log message. Note You can specify multiple class or match commands in the policy map. If a packet matches multiple different match or class commands, then the order in which the FWSM applies the actions is determined by internal FWSM rules, and not by the order they are added to the policy map. The internal rules are determined by the application type and the logical progression of parsing a packet, and are not user-configurable. For example for HTTP traffic, parsing a Request Method field precedes parsing the Header Host Length field; an action for the Request Method field occurs before the action for the Header Host Length field. For example, the following match commands can be entered in any order, but the match request method get command is matched first. match request header host length gt 100 reset match request method get log 20-8 Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM OL-20748-01