Cisco ASA 5585-X

12-5
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 12 Getting Started with Application Layer Protocol Inspection
Guidelines for Application Inspection
match filename regex abc
class-map type inspect ftp match-all ftp3
match request-cmd get
match filename regex abc
policy-map type inspect ftp ftp
class ftp3
log
class ftp2
log
class ftp1
log
Guidelines for Application Inspection
Failover
State information for multimedia sessions that require inspection are not passed over the state link for
stateful failover. The exceptions are GTP and SIP, which are replicated over the state link.
IPv6
Supports IPv6 for the following inspections:
• DNS
• FTP
• HTTP
• ICMP
• SCCP (Skinny)
• SIP
• SMTP
• IPsec pass-through
• IPv6
• VXLAN
Supports NAT64 for the following inspections:
• DNS
• FTP
• HTTP
• ICMP
Additional Guidelines
• Some inspection engines do not support PAT, NAT, outside NAT, or NAT between same security
interfaces. For more information about NAT support, see Default Inspections and NAT Limitations,
page 12-6.
• For all the application inspections, the ASA limits the number of simultaneous, active data
connections to 200 connections. For example, if an FTP client opens multiple secondary
connections, the FTP inspection engine allows only 200 active connections and the 201 connection
is dropped and the adaptive security appliance generates a system error message.