Cisco ASA 5512-X

To Next Page

To Previous Page

11-22

Cisco ASA Series Firewall CLI Configuration Guide

Chapter 11 Service Policy Using the Modular Policy Framework

History for Service Policies

Main Page

About this Guide3
Document Objectives3
Related Documentation3
Obtaining Documentation and Submitting a Service Request4
Introduction to Cisco ASA Firewall Services5
How to Implement Firewall Services5
Basic Access Control6
Application Filtering6
Url Filtering7
Threat Protection7
Network Address Translation8
Application Inspection9
Use Case: Expose a Server to the Public9
Access Control11
Objects for Access Control13
Guidelines for Objects13
Configure Objects14
Configure Network Objects and Groups14
Configure a Network Object14
Configure a Network Object Group15
Configure Service Objects and Service Groups16
Configure a Service Object16
Configure a Service Group17
Configure Local User Groups19
Configure Security Group Object Groups20
Configure Time Ranges21
Monitoring Objects22
History for Objects23
Access Control Lists25
About Acls25
ACL Types25
ACL Names26
Access Control Entry Order27
Permit/Deny Vs. Match/Do Not Match27
Access Control Implicit Deny27
IP Addresses Used for Extended Acls When You Use NAT28
Time-Based Aces28
Guidelines for Acls29
Configure Acls30
Basic ACL Configuration and Management Options30
Configure Extended Acls31
Add an Extended ACE for IP Address or Fully-Qualified Domain Name-Based Matching31
Add an Extended ACE for TCP or UDP-Based Matching, with Ports33
Add an Extended ACE for ICMP-Based Matching34
Add an Extended ACE for User-Based Matching (Identity Firewall)34
Add an Extended ACE for Security Group-Based Matching (Cisco Trustsec)35
Example of Converting Addresses to Objects for Extended Acls37
Configure Standard Acls37
Configure Webtype Acls38
Add a Webtype ACE for URL Matching38
Adding a Webtype ACE for IP Address Matching39
Examples for Webtype Acls40
Configure Ethertype Acls41
Examples for Ethertype Acls42
Edit Acls in an Isolated Configuration Session42
Monitoring Acls44
History for Acls45
Access Rules47
Controlling Network Access47
General Information about Rules48
Interface Access Rules and Global Access Rules48
Inbound and Outbound Rules48
Rule Order49
Implicit Permits49
Implicit Deny50
NAT and Access Rules50
Extended Access Rules50
Extended Access Rules for Returning Traffic51
Allowing Broadcast and Multicast Traffic through the Transparent Firewall Using Access Rules51
Management Access Rules51
Ethertype Rules52
Guidelines for Access Control53
Configure Access Control53
Configure an Access Group53
Configure ICMP Access Rules54
Monitoring Access Rules56
Evaluating Syslog Messages for Access Rules56
History for Access Rules58
Identity Firewall61
About the Identity Firewall61
Architecture for Identity Firewall Deployments62
Features of the Identity Firewall63
Deployment Scenarios64
Guidelines for the Identity Firewall67
Prerequisites for the Identity Firewall69
Configure the Identity Firewall70
Configure the Active Directory Domain70
Configure Active Directory Agents73
Configure Identity Options74
Configure Identity-Based Security Policy78
Collect User Statistics79
Examples for the Identity Firewall79
VPN Filter Example80
VPN with IDFW Rule -1 Example81
VPN with IDFW Rule -2 Example81
Monitoring the Identity Firewall81
History for the Identity Firewall82
ASA and Cisco Trustsec83
About Cisco Trustsec83
About SGT and SXP Support in Cisco Trustsec84
Roles in the Cisco Trustsec Feature85
Security Group Policy Enforcement85
How the ASA Enforces Security Group-Based Policies86
Effects of Changes to Security Groups on the ISE87
Speaker and Listener Roles on the ASA88
SXP Chattiness89
SXP Timers89
IP-SGT Manager Database90
Features of the ASA-Cisco Trustsec Integration90
Register the ASA with the ISE92
Create a Security Group on the ISE92
Generate the PAC File93
Guidelines for Cisco Trustsec93
Configure the AAA Server for Cisco Trustsec Integration95
Import a PAC File97
Configure the Security Exchange Protocol99
Add an SXP Connection Peer101
Refresh Environment Data102
Configure the Security Policy102
Layer 2 Security Group Tagging Imposition104
Usage Scenarios104
Configure a Security Group Tag on an Interface106
Configure IP-SGT Bindings Manually107
Troubleshooting Tips107
Example for Cisco Trustsec108
Anyconnect VPN Support for Cisco Trustsec108
Typical Steps for a Remote User Connecting to a Server108
Add an SGT to Local Users and Groups109
Monitoring Cisco Trustsec109
History for Cisco Trustsec110
ASA Firepower Module111
About the ASA Firepower Module111
How the ASA Firepower Module Works with the ASA111
ASA Firepower Inline Mode112
ASA Firepower Passive Monitor-Only Traffic Forwarding Mode114
ASA Firepower Management115
Compatibility with ASA Features115
Licensing Requirements for the ASA Firepower Module115
Guidelines for ASA Firepower115
Defaults for ASA Firepower116
Perform Initial ASA Firepower Setup117
Deploy the ASA Firepower Module in Your Network117
Access the ASA Firepower CLI119
Configure ASA Firepower Basic Settings119
Configure the ASA Firepower Module120
Configure the Security Policy on the ASA Firepower Module120
Redirect Traffic to the ASA Firepower Module120
Configure Inline or Inline Tap Monitor-Only Modes121
Configure Passive Traffic Forwarding122
Managing the ASA Firepower Module123
Install or Reimage the Module123
Install or Reimage the Software Module124
Reimage the ASA 5585-X ASA Firepower Hardware Module126
Reset the Password128
Reload or Reset the Module128
Shut down the Module129
Uninstall a Software Module Image129
Session to the Software Module from the ASA130
Upgrade the System Software130
Monitoring the ASA Firepower Module131
Showing Module Status131
Showing Module Statistics132
Monitoring Module Connections132
Examples for the ASA Firepower Module133
History for the ASA Firepower Module134
ASA and Cisco Cloud Web Security137
Information about Cisco Cloud Web Security137
User Identity and Cloud Web Security138
Authentication Keys138
Scancenter Policy138
Directory Groups139
Custom Groups139
How Groups and the Authentication Key Interoperate140
Failover from Primary to Backup Proxy Server140
Licensing Requirements for Cisco Cloud Web Security140
Guidelines for Cloud Web Security141
Configure Cisco Cloud Web Security142
Configure Communications with the Cloud Web Security Proxy Server142
Identify Whitelisted Traffic144
Configure a Service Policy to Send Traffic to Cloud Web Security145
Configure the User Identity Monitor149
Configure the Cloud Web Security Policy150
Monitoring Cloud Web Security150
Examples for Cisco Cloud Web Security151
Cloud Web Security Example with Identity Firewall151
Active Directory Integration Example for Identity Firewall153
History for Cisco Cloud Web Security155
Network Address Translation157
Network Address Translation (NAT)159
NAT Basics160
NAT Terminology160
NAT Types161
Network Object NAT and Twice NAT161
Comparing Network Object NAT and Twice NAT162
NAT Rule Order163
NAT Interfaces164
Guidelines for NAT164
Firewall Mode Guidelines for NAT165
Ipv6 NAT Guidelines165
Ipv6 NAT Recommendations165
Additional Guidelines for NAT166
Network Object NAT Guidelines for Mapped Address Objects167
Twice NAT Guidelines for Real and Mapped Address Objects168
Twice NAT Guidelines for Service Objects for Real and Mapped Ports169
Dynamic NAT170
About Dynamic NAT170
Dynamic NAT Disadvantages and Advantages171
Configure Dynamic Network Object NAT172
Configure Dynamic Twice NAT174
Dynamic PAT176
About Dynamic PAT176
Dynamic PAT Disadvantages and Advantages177
PAT Pool Object Guidelines177
Configure Dynamic Network Object PAT178
Configure Dynamic Twice PAT180
Configure Per-Session PAT or Multi-Session PAT183
About Static NAT185
Static NAT with Port Translation185
One-To-Many Static NAT187
Other Mapping Scenarios (Not Recommended)189
Configure Static Network Object NAT or Static NAT-With-Port-Translation190
Configure Static Twice NAT or Static NAT-With-Port-Translation192
Identity NAT195
Configure Identity Network Object NAT195
Configure Identity Twice NAT197
Monitoring NAT198
History for NAT199
NAT Examples and Reference205
Examples for Network Object NAT205
Providing Access to an Inside Web Server (Static NAT)205
NAT for Inside Hosts (Dynamic NAT) and NAT for an Outside Web Server (Static NAT)206
Inside Load Balancer with Multiple Mapped Addresses (Static NAT, One-To-Many)208
Examples for Twice NAT210
Different Translation Depending on the Destination (Dynamic Twice PAT)210
Example: Twice NAT with Destination Address Translation213
NAT in Routed and Transparent Mode213
NAT in Routed Mode214
NAT in Transparent Mode214
Routing NAT Packets215
Mapped Addresses and Routing216
Addresses on the same Network as the Mapped Interface216
Addresses on a Unique Network216
The same Address as the Real Address (Identity NAT)217
Transparent Mode Routing Requirements for Remote Networks218
Determining the Egress Interface218
NAT and Remote Access VPN219
NAT and Site-To-Site VPN221
NAT and VPN Management Access223
Troubleshooting NAT and VPN225
DNS Reply Modification, DNS Server on Outside226
DNS Reply Modification, DNS Server, Host, and Server on Separate Networks227
DNS Reply Modification, DNS Server on Host Network228
DNS64 Reply Modification Using Outside NAT229
PTR Modification, DNS Server on Host Network231
Service Policies and Application Inspection233
About Service Policies235
The Components of a Service Policy235
Features Configured with Service Policies238
Feature Matching Within a Service Policy239
Order in Which Multiple Feature Actions Are Applied240
Incompatibility of Certain Feature Actions240
Feature Matching for Multiple Service Policies242
Guidelines for Service Policies242
Defaults for Service Policies243
Default Service Policy Configuration243
Default Class Maps (Traffic Classes)244
Configure Service Policies245
Identify Traffic (Layer 3/4 Class Maps)247
Create a Layer 3/4 Class Map for through Traffic247
Create a Layer 3/4 Class Map for Management Traffic249
Define Actions (Layer 3/4 Policy Map)250
Apply Actions to an Interface (Service Policy)251
Monitoring Service Policies252
Examples for Service Policies (Modular Policy Framework)252
History for Service Policies255
Application Layer Protocol Inspection257
How Inspection Engines Work257
When to Use Application Protocol Inspection258
Inspection Policy Maps259
Replacing an In-Use Inspection Policy Map259
How Multiple Traffic Classes Are Handled260
Guidelines for Application Inspection261
Defaults for Application Inspection262
Default Inspections and NAT Limitations262
Default Inspection Policy Maps265
Configure Application Layer Protocol Inspection265
Choosing the Right Traffic Class for Inspection270
Configure Regular Expressions271
Create a Regular Expression271
Create a Regular Expression Class Map273
History for Application Inspection274
DNS Inspection275
DNS Inspection Actions276
Defaults for DNS Inspection276
Configure DNS Inspection276
Configure DNS Inspection Policy Map277
Configure the DNS Inspection Service Policy280
Monitoring DNS Inspection282
Strict FTP283
ICMP Inspection295
ICMP Error Inspection295
Instant Messaging Inspection295
Configure an Instant Messaging Inspection Policy Map296
Configure the IM Inspection Service Policy298
IP Options Inspection300
IP Options Inspection Overview300
What Happens When You Clear an Option300
Supported IP Options for Inspection301
Defaults for IP Options Inspection301
Configure IP Options Inspection301
Configure an IP Options Inspection Policy Map302
Configure the IP Options Inspection Service Policy302
Monitoring IP Options Inspection304
Ipsec Pass through Inspection304
Ipsec Pass through Inspection Overview304
Configure Ipsec Pass through Inspection304
Configure an Ipsec Pass through Inspection Policy Map305
Configure the Ipsec Pass through Inspection Service Policy306
Ipv6 Inspection307
Defaults for Ipv6 Inspection307
Configure Ipv6 Inspection308
Configure an Ipv6 Inspection Policy Map308
Configure the Ipv6 Inspection Service Policy309
Netbios Inspection311
Configure a Netbios Inspection Policy Map for Additional Inspection Control311
Configure the Netbios Inspection Service Policy312
PPTP Inspection313
SMTP and Extended SMTP Inspection313
SMTP and ESMTP Inspection Overview314
Defaults for ESMTP Inspection315
Configure ESMTP Inspection316
Configure an ESMTP Inspection Policy Map316
Configure the ESMTP Inspection Service Policy318
TFTP Inspection319
Inspection for Voice and Video Protocols321
CTIQBE Inspection321
Limitations for CTIQBE Inspection321
Verifying and Monitoring CTIQBE Inspection322
Inspection Overview323
How H.323 Works324
Limitations for H.323 Inspection325
Configure H.323 Inspection326
Configure H.323 Inspection Policy Map326
Configure the H.323 Inspection Service Policy329
Verifying and Monitoring H.323 Inspection330
Monitoring H.225 Sessions330
Monitoring H.245 Sessions331
Monitoring H.323 RAS Sessions332
MGCP Inspection Overview332
Configure MGCP Inspection333
Configuring an MGCP Inspection Policy Map for Additional Inspection Control334
Configure the MGCP Inspection Service Policy335
Configuring MGCP Timeout Values336
Verifying and Monitoring MGCP Inspection336
RTSP Inspection Overview337
Realplayer Configuration Requirements338
Limitations for RSTP Inspection338
Configure RTSP Inspection338
Configure RTSP Inspection Policy Map339
Configure the RTSP Inspection Service Policy341
SIP Inspection342
SIP Inspection Overview343
Limitations for SIP Inspection343
Default SIP Inspection344
Configure SIP Inspection344
Configure SIP Inspection Policy Map344
Configure the SIP Inspection Service Policy348
Configure SIP Timeout Values349
Verifying and Monitoring SIP Inspection349
Skinny (SCCP) Inspection350
SCCP Inspection Overview350
Supporting Cisco IP Phones351
Limitations for SCCP Inspection351
Default SCCP Inspection351
Configure SCCP (Skinny) Inspection352
Configure a Skinny (SCCP) Inspection Policy Map for Additional Inspection Control352
Configure the SCCP Inspection Service Policy353
Verifying and Monitoring SCCP Inspection355
History for Voice and Video Protocol Inspection355
Inspection of Database, Directory, and Management Protocols357
DCERPC Inspection357
DCERPC Overview357
Configure DCERPC Inspection358
GTP Inspection Overview361
Defaults for GTP Inspection362
Configure GTP Inspection362
Configure a GTP Inspection Policy Map363
Configure the GTP Inspection Service Policy365
Verifying and Monitoring GTP Inspection367
ILS Inspection368
RADIUS Accounting Inspection369
RADIUS Accounting Inspection Overview369
Configure RADIUS Accounting Inspection369
Configure a RADIUS Accounting Inspection Policy Map370
Configure the RADIUS Accounting Inspection Service Policy371
RSH Inspection372
SNMP Inspection372
Sql*Net Inspection374
Sun RPC Inspection Overview375
Managing Sun RPC Services375
Verifying and Monitoring Sun RPC Inspection376
XDMCP Inspection377
VXLAN Inspection378
History for Database, Directory, and Management Protocol Inspection378
Connection Management and Threat Detection379
Connection Settings381
What Are Connection Settings381
Configure Connection Settings382
Configure Global Timeouts383
Protect Servers from a SYN Flood Dos Attack (TCP Intercept)384
Customize Abnormal TCP Packet Handling (TCP Maps, TCP Normalizer)387
Bypass TCP State Checks for Asynchronous Routing (TCP State Bypass)390
The Asynchronous Routing Problem390
Guidelines for TCP State Bypass391
Configure TCP State Bypass392
Disable TCP Sequence Randomization393
Configure Connection Settings for Specific Traffic Classes (All Services)394
Monitoring Connections397
History for Connection Settings398
Quality of Service401
About Qos401
Supported Qos Features402
What Is a Token Bucket402
Priority Queuing403
How Qos Features Interact403
DSCP (Diffserv) Preservation403
Guidelines for Qos403
Configure Qos404
Determine the Queue and TX Ring Limits for a Priority Queue404
TX Ring Limit Worksheet405
Configure the Priority Queue for an Interface406
Configure a Service Rule for Priority Queuing and Policing407
Monitor Qos409
Qos Police Statistics409
Qos Priority Statistics410
Qos Priority Queue Statistics410
Configuration Examples for Priority Queuing and Policing411
Class Map Examples for VPN Traffic411
Priority and Policing Example412
History for Qos413
Threat Detection415
Detecting Threats415
Basic Threat Detection Statistics416
Advanced Threat Detection Statistics416
Scanning Threat Detection417
Guidelines for Threat Detection417
Defaults for Threat Detection418
Configure Threat Detection418
Configure Basic Threat Detection Statistics419
Configure Advanced Threat Detection Statistics419
Configure Scanning Threat Detection421
Monitoring Threat Detection422
Monitoring Basic Threat Detection Statistics422
Monitoring Advanced Threat Detection Statistics423
Evaluating Host Threat Detection Statistics424
Monitoring Shunned Hosts, Attackers, and Targets426
Examples for Threat Detection427
History for Threat Detection428

Table of Contents

Other manuals for Cisco ASA 5512-X

Related product manuals