Cisco FirePOWER ASA 5500 series User Manual

25-30
Cisco Security Appliance Command Line Configuration Guide
OL-10088-01
Chapter 25 Configuring Application Layer Protocol Inspection
FTP Inspection
The reset keyword drops the packet, closes the connection, and sends a TCP reset to the server
and/or client.
The log keyword, which you can use alone or with one of the other keywords, sends a system log
message.
The rate-limit message_rate argument limits the rate of messages.
You can specify multiple class or match commands in the policy map. For information about the order
of class and match commands, see the “Defining Actions in an Inspection Policy Map” section on
page 21-10.
Step 7 To configure parameters that affect the inspection engine, perform the following steps:
a. To enter parameters configuration mode, enter the following command:
hostname(config-pmap)# parameters
hostname(config-pmap-p)#
b. To mask the greeting banner from the FTP server, enter the following command:
hostname(config-pmap-p)# mask-banner
c. To mask the reply to syst command, enter the following command:
hostname(config-pmap-p)# mask-syst-reply
Before submitting a username and password, all FTP users are presented with a greeting banner. By
default, this banner includes version information useful to hackers trying to identify weaknesses in a
system. The following example shows how to mask this banner:
hostname(config)# policy-map type inspect ftp mymap
hostname(config-pmap)# parameters
hostname(config-pmap-p)# mask-banner
hostname(config)# class-map match-all ftp-traffic
hostname(config-cmap)# match port tcp eq ftp
hostname(config)# policy-map ftp-policy
hostname(config-pmap)# class ftp-traffic
hostname(config-pmap-c)# inspect ftp strict mymap
hostname(config)# service-policy ftp-policy interface inside
Verifying and Monitoring FTP Inspection
FTP application inspection generates the following log messages:
• An Audit record 302002 is generated for each file that is retrieved or uploaded.
• The FTP command is checked to see if it is RETR or STOR and the retrieve and store commands
are logged.
• The username is obtained by looking up a table providing the IP address.
• The username, source IP address, destination IP address, NAT address, and the file operation are
logged.

Cisco FirePOWER ASA 5500 series Specifications

General

Brand	Cisco
Model	FirePOWER ASA 5500 series
Category	Firewall
Language	English