Cisco Asdm 7 User Guide

							 
1-5
Cisco ASA Series Firewall ASDM Configuration Guide
 
Chapter 1      Configuring a Service Policy
  Licensing Requirements for Service Policies
Incompatibility of Certain Feature Actions
Some features are not compatible with each other for the same traffic. The following list may not include 
all incompatibilities; for information about compatibility of each feature, see the chapter or section for 
your feature:
You cannot configure QoS priority queueing and QoS policing for the same set of traffic. 
Most inspections should not be combined with another inspection, so the ASA only applies one 
inspection if you configure multiple inspections for the same traffic. HTTP inspection can be 
combined with the Cloud Web Security inspection. Other exceptions are listed in the “Order in 
Which Multiple Feature Actions are Applied” section on page 1-4.
You cannot configure traffic to be sent to multiple modules, such as the ASA CX and ASA IPS.
HTTP inspection is not compatible with the ASA CX.
The ASA CX is not compatible with Cloud Web Security.
NoteThe Default Inspection Traffic traffic class, which is used in the default global policy, is a special CLI 
shortcut to match the default ports for all inspections. When used in a policy map, this class map ensures 
that the correct inspection is applied to each packet, based on the destination port of the traffic. For 
example, when UDP traffic for port 69 reaches the ASA, then the ASA applies the TFTP inspection; 
when TCP traffic for port 21 arrives, then the ASA applies the FTP inspection. So in this case only, you 
can configure multiple inspections for the same class map. Normally, the ASA does not use the port 
number to determine which inspection to apply, thus giving you the flexibility to apply inspections to 
non-standard ports, for example.
This traffic class does not include the default ports for Cloud Web Security inspection (80 and 443).
Feature Matching for Multiple Service Policies
For TCP and UDP traffic (and ICMP when you enable stateful ICMP inspection), service policies 
operate on traffic flows, and not just individual packets. If traffic is part of an existing connection that 
matches a feature in a policy on one interface, that traffic flow cannot also match the same feature in a 
policy on another interface; only the first policy is used.
For example, if HTTP traffic matches a policy on the inside interface to inspect HTTP traffic, and you 
have a separate policy on the outside interface for HTTP inspection, then that traffic is not also inspected 
on the egress of the outside interface. Similarly, the return traffic for that connection will not be 
inspected by the ingress policy of the outside interface, nor by the egress policy of the inside interface.
For traffic that is not treated as a flow, for example ICMP when you do not enable stateful ICMP 
inspection, returning traffic can match a different policy map on the returning interface. For example, if 
you configure IPS on the inside and outside interfaces, but the inside policy uses virtual sensor 1 while 
the outside policy uses virtual sensor 2, then a non-stateful Ping will match virtual sensor 1 outbound, 
but will match virtual sensor 2 inbound.
Licensing Requirements for Service Policies 
						

							 
1-6
Cisco ASA Series Firewall ASDM Configuration Guide
 
Chapter 1      Configuring a Service Policy
  Guidelines and Limitations
Guidelines and Limitations
This section includes the guidelines and limitations for this feature.
Context Mode Guidelines
Supported in single and multiple context mode.
Firewall Mode Guidelines
Supported in routed and transparent firewall mode.
IPv6 Guidelines
Supports IPv6 for the following features:
Application inspection for DNS, FTP, HTTP, ICMP, ScanSafe, SIP, SMTP, IPsec-pass-thru, and 
IPv6.
ASA IPS
ASA CX
NetFlow Secure Event Logging filtering
TCP and UDP connection limits and timeouts, TCP sequence number randomization
TCP normalization
TCP state bypass
User statistics for Identity Firewall
 Traffic Class Guidelines
The maximum number of traffic classes of all types is 255 in single mode or per context in multiple 
mode. Class maps include the following types:
Layer 3/4 class maps (for through traffic and management traffic).
Inspection class maps
Regular expression class maps
match commands used directly underneath an inspection policy map
This limit also includes default traffic classes of all types, limiting user-configured traffic classes to 
approximately 235. See the “Default Traffic Classes” section on page 1-8.
Service Policy Guidelines
Interface service policies take precedence over the global service policy for a given feature. For 
example, if you have a global policy with FTP inspection, and an interface policy with TCP 
normalization, then both FTP inspection and TCP normalization are applied to the interface. 
However, if you have a global policy with FTP inspection, and an interface policy with FTP 
inspection, then only the interface policy FTP inspection is applied to that interface. Model License Requirement
All models Base License. 
						

							 
1-7
Cisco ASA Series Firewall ASDM Configuration Guide
 
Chapter 1      Configuring a Service Policy
  Default Settings
You can only apply one global policy. For example, you cannot create a global policy that includes 
feature set 1, and a separate global policy that includes feature set 2. All features must be included 
in a single policy.
When you make service policy changes to the configuration, all new connections use the new service 
policy. Existing connections continue to use the policy that was configured at the time of the 
connection establishment. show command output will not include data about the old connections.
For example, if you remove a QoS service policy from an interface, then re-add a modified version, 
then the show service-policy command only displays QoS counters associated with new 
connections that match the new service policy; existing connections on the old policy no longer 
show in the command output.
To ensure that all connections use the new policy, you need to disconnect the current connections so 
they can reconnect using the new policy. See the clear conn or clear local-host commands.
Default Settings
The following topics describe the default settings for Modular Policy Framework:
Default Configuration, page 1-7
Default Traffic Classes, page 1-8
Default Configuration
By default, the configuration includes a policy that matches all default application inspection traffic and 
applies certain inspections to the traffic on all interfaces (a global policy). Not all inspections are enabled 
by default. You can only apply one global policy, so if you want to alter the global policy, you need to 
either edit the default policy or disable it and apply a new one. (An interface policy overrides the global 
policy for a particular feature.)
The default policy includes the following application inspections:
DNS
FTP
H323 (H225)
H323 (RAS)
RSH
RT S P
ESMTP
SQLnet
Skinny (SCCP)
SunRPC
XDMCP
SIP
NetBios
TFTP  
						

							 
1-8
Cisco ASA Series Firewall ASDM Configuration Guide
 
Chapter 1      Configuring a Service Policy
  Task Flows for Configuring Service Policies
IP Options
Default Traffic Classes
The configuration includes a default traffic class that the ASA uses in the default global policy called 
Default Inspection Traffic; it matches the default inspection traffic. This class, which is used in the 
default global policy, is a special shortcut to match the default ports for all inspections. When used in a 
policy, this class ensures that the correct inspection is applied to each packet, based on the destination 
port of the traffic. For example, when UDP traffic for port 69 reaches the ASA, then the ASA applies the 
TFTP inspection; when TCP traffic for port 21 arrives, then the ASA applies the FTP inspection. So in 
this case only, you can configure multiple inspections for the same class map. Normally, the ASA does 
not use the port number to determine which inspection to apply, thus giving you the flexibility to apply 
inspections to non-standard ports, for example.
Another class map that exists in the default configuration is called class-default, and it matches all 
traffic. You can use the class-default class if desired, rather than using the Any traffic class. In fact, some 
features are only available for class-default, such as QoS traffic shaping.
Task Flows for Configuring Service Policies
This section includes the following topics:
Task Flow for Configuring a Service Policy Rule, page 1-8
Task Flow for Configuring a Service Policy Rule
Configuring a service policy consists of adding one or more service policy rules per interface or for the 
global policy. For each rule, you identify the following elements:
Step 1Identify the interface to which you want to apply the rule, or identify the global policy.
Step 2Identify the traffic to which you want to apply actions. You can identify Layer 3 and 4 through traffic.
Step 3Apply actions to the traffic class. You can apply multiple actions for each traffic class.
Adding a Service Policy Rule for Through Traffic
See the “Supported Features” section on page 1-1 for more information. To add a service policy rule for 
through traffic, perform the following steps:
Step 1Choose Configuration > Firewall > Service Policy Rules pane, and click Add.
The Add Service Policy Rule Wizard - Service Policy dialog box appears. 
						

							 
1-9
Cisco ASA Series Firewall ASDM Configuration Guide
 
Chapter 1      Configuring a Service Policy
  Adding a Service Policy Rule for Through Traffic
NoteWhen you click the Add button, and not the small arrow on the right of the Add button, you add 
a through traffic rule by default. If you click the arrow on the Add button, you can choose 
between a through traffic rule and a management traffic rule.
Step 2In the Create a Service Policy and Apply To area, click one of the following options:
Interface. This option applies the service policy to a single interface. Interface service policies take 
precedence over the global service policy for a given feature. For example, if you have a global 
policy with FTP inspection, and an interface policy with TCP connection limits, then both FTP 
inspection and TCP connection limits are applied to the interface. However, if you have a global 
policy with FTP inspection, and an interface policy with FTP inspection, then only the interface 
policy FTP inspection is applied to that interface.
a.Choose an interface from the drop-down list.
If you choose an interface that already has a policy, then the wizard lets you add a new service 
policy rule to the interface.
b.If it is a new service policy, enter a name in the Policy Name field.
c.(Optional) Enter a description in the Description field.
d.(Optional) Check the Drop and log unsupported IPv6 to IPv6 traffic check box to generate a 
syslog (767001) for IPv6 traffic that is dropped by application inspections that do not support 
IPv6 traffic. By default, syslogs are not generated. For a list of inspections that support IPv6, 
see the “IPv6 Guidelines” section on page 1-6. 
						

							 
1-10
Cisco ASA Series Firewall ASDM Configuration Guide
 
Chapter 1      Configuring a Service Policy
  Adding a Service Policy Rule for Through Traffic
Global - applies to all interfaces. This option applies the service policy globally to all interfaces. 
By default, a global policy exists that includes a service policy rule for default application 
inspection. See the “Default Settings” section on page 1-7 for more information. You can add a rule 
to the global policy using the wizard.
a.If it is a new service policy, enter a name in the Policy Name field.
b.(Optional) Enter a description in the Description field.
c.(Optional) Check the Drop and log unsupported IPv6 to IPv6 traffic check box to generate a 
syslog (767001) for IPv6 traffic that is dropped by application inspections that do not support 
IPv6 traffic. By default, syslogs are not generated. For a list of inspections that support IPv6, 
see the “IPv6 Guidelines” section on page 1-6.
Step 3Click Next.
The Add Service Policy Rule Wizard - Traffic Classification Criteria dialog box appears.
Step 4Click one of the following options to specify the traffic to which to apply the policy actions:
Create a new traffic class. Enter a traffic class name in the Create a new traffic class field, and enter 
an optional description.
Identify the traffic using one of several criteria:
–Default Inspection Traffic—The class matches the default TCP and UDP ports used by all 
applications that the ASA can inspect.
This option, which is used in the default global policy, is a special shortcut that when used in a 
rule, ensures that the correct inspection is applied to each packet, based on the destination port 
of the traffic. For example, when UDP traffic for port 69 reaches the ASA, then the ASA applies 
the TFTP inspection; when TCP traffic for port 21 arrives, then the ASA applies the FTP 
inspection. So in this case only, you can configure multiple inspections for the same rule (See 
the “Incompatibility of Certain Feature Actions” section on page 1-5 for more information 
about combining actions). Normally, the ASA does not use the port number to determine the 
inspection applied, thus giving you the flexibility to apply inspections to non-standard ports, for 
example. 
See the “Default Settings and NAT Limitations” section on page 10-4 for a list of default ports. 
The ASA includes a default global policy that matches the default inspection traffic, and applies 
common inspections to the traffic on all interfaces. Not all applications whose ports are included 
in the Default Inspection Traffic class are enabled by default in the policy map.
You can specify a Source and Destination IP Address (uses ACL) class along with the Default 
Inspection Traffic class to narrow the matched traffic. Because the Default Inspection Traffic 
class specifies the ports and protocols to match, any ports and protocols in the ACL are ignored.
–Source and Destination IP Address (uses ACL)—The class matches traffic specified by an 
extended ACL. If the ASA is operating in transparent firewall mode, you can use an EtherType 
ACL.
NoteWhen you create a new traffic class of this type, you can only specify one access control 
entry (ACE) initially. After you finish adding the rule, you can add additional ACEs by 
adding a new rule to the same interface or global policy, and then specifying Add rule 
to existing traffic class on the Traffic Classification dialog box (see below).
–Tunnel Group—The class matches traffic for a tunnel group to which you want to apply QoS. 
You can also specify one other traffic match option to refine the traffic match, excluding Any 
Traffic, Source and Destination IP Address (uses ACL), or Default Inspection Traffic. 
						

							 
1-11
Cisco ASA Series Firewall ASDM Configuration Guide
 
Chapter 1      Configuring a Service Policy
  Adding a Service Policy Rule for Through Traffic
–TCP or UDP Destination Port—The class matches a single port or a contiguous range of ports.
TipFor applications that use multiple, non-contiguous ports, use the Source and Destination IP 
Address (uses ACL) to match each port.
–RTP Range—The class map matches RTP traffic.
–IP DiffServ CodePoints (DSCP)—The class matches up to eight DSCP values in the IP header.
–IP Precedence—The class map matches up to four precedence values, represented by the TOS 
byte in the IP header.
–Any Traffic—Matches all traffic.
Add rule to existing traffic class. If you already have a service policy rule on the same interface, 
or you are adding to the global service policy, this option lets you add an ACE to an existing ACL. 
You can add an ACE to any ACL that you previously created when you chose the Source and 
Destination IP Address (uses ACL) option for a service policy rule on this interface. For this traffic 
class, you can have only one set of rule actions even if you add multiple ACEs. You can add multiple 
ACEs to the same traffic class by repeating this entire procedure. See the “Managing the Order of 
Service Policy Rules” section on page 1-15 for information about changing the order of ACEs.
Use an existing traffic class. If you created a traffic class used by a rule on a different interface, 
you can reuse the traffic class definition for this rule. Note that if you alter the traffic class for one 
rule, the change is inherited by all rules that use that traffic class. If your configuration includes any 
class-map commands that you entered at the CLI, those traffic class names are also available 
(although to view the definition of the traffic class, you need to create the rule).
Use class default as the traffic class. This option uses the class-default class, which matches all 
traffic. The class-default class is created automatically by the ASA and placed at the end of the 
policy. If you do not apply any actions to it, it is still created by the ASA, but for internal purposes 
only. You can apply actions to this class, if desired, which might be more convenient than creating 
a new traffic class that matches all traffic. You can only create one rule for this service policy using 
the class-default class, because each traffic class can only be associated with a single rule per service 
policy.
Step 5Click Next.
Step 6The next dialog box depends on the traffic match criteria you chose.
NoteThe Any Traffic option does not have a special dialog box for additional configuration.
Default Inspections—This dialog box is informational only, and shows the applications and the ports 
that are included in the traffic class.
Source and Destination Address—This dialog box lets you set the source and destination addresses:
a.Click Match or Do Not Match.
The Match option creates a rule where traffic matching the addresses have actions applied. The 
Do Not Match option exempts the traffic from having the specified actions applied. For 
example, you want to match all traffic in 10.1.1.0/24 and apply connection limits to it, except 
for 10.1.1.25. In this case, create two rules, one for 10.1.1.0/24 using the Match option and one 
for 10.1.1.25 using the Do Not Match option. Be sure to arrange the rules so that the Do Not 
Match rule is above the Match rule, or else 10.1.1.25 will match the Match rule first.
b.In the Source field, enter the source IP address, or click the ... button to choose an IP address 
that you already defined in ASDM. 
						

							 
1-12
Cisco ASA Series Firewall ASDM Configuration Guide
 
Chapter 1      Configuring a Service Policy
  Adding a Service Policy Rule for Through Traffic
Specify the address and subnet mask using prefix/length notation, such as 10.1.1.0/24. If you 
enter an IP address without a mask, it is considered to be a host address, even if it ends with a 0.
Enter any to specify any source address.
Separate multiple addresses by a comma.
c.In the Destination field, enter the destination IP address, or click the ... button to choose an IP 
address that you already defined in ASDM.
Specify the address and subnet mask using prefix/length notation, such as 10.1.1.0/24. If you 
enter an IP address without a mask, it is considered to be a host address, even if it ends with a 0.
Enter any to specify any destination address.
Separate multiple addresses by a comma.
d.In the Service field, enter an IP service name or number for the destination service, or click the 
... button to choose a service.
If you want to specify a TCP or UDP port number, or an ICMP service number, enter 
protocol/port. For example, enter TCP/8080.
By default, the service is IP.
Separate multiple services by a comma.
e.(Optional) Enter a description in the Description field.
f.(Optional) To specify a source service for TCP or UDP, click the More Options area open, and 
enter a TCP or UDP service in the Source Service field.
The destination service and source service must be the same. Copy and paste the destination 
Service field to the Source Service field.
g.(Optional) To make the rule inactive, click the More Options area open, and uncheck Enable 
Rule.
This setting might be useful if you do not want to remove the rule, but want to turn it off.
h.(Optional) To set a time range for the rule, click the More Options area open, and from the Time 
Range drop-down list, choose a time range.
To add a new time range, click the ... button. See the “Configuring Time Ranges” section on 
page 20-26 in the general operations configuration guide for more information.
This setting might be useful if you only want the rule to be active at predefined times.
Tunnel Group—Choose a tunnel group from the Tunnel Group drop-down list, or click New to add 
a new tunnel group. See the “Add or Edit an IPsec Remote Access Connection Profile” section on 
page 75-81 in the VPN configuration guide for more information.
To police each flow, check Match flow destination IP address. All traffic going to a unique IP 
destination address is considered a flow.
Destination Port—Click TCP or UDP.
In the Service field, enter a port number or name, or click ... to choose one already defined in ASDM.
RTP Range—Enter an RTP port range, between 2000 and 65534. The maximum number of port sin 
the range is 16383.
IP DiffServ CodePoints (DSCP)—In the DSCP Value to Add area, choose a value from the Select 
Named DSCP Values or enter a value in the Enter DSCP Value (0-63) field, and click Add.
Add additional values as desired, or remove them using the Remove button.
IP Precedence—From the Available IP Precedence area, choose a value and click Add. 
						

							 
1-13
Cisco ASA Series Firewall ASDM Configuration Guide
 
Chapter 1      Configuring a Service Policy
  Adding a Service Policy Rule for Management Traffic
Add additional values as desired, or remove them using the Remove button.
Step 7Click Next.
The Add Service Policy Rule - Rule Actions dialog box appears.
Step 8Configure one or more rule actions. See the “Supported Features” section on page 1-1 for a list of 
features.
Step 9Click Finish.
Adding a Service Policy Rule for Management Traffic
You can create a service policy for traffic directed to the ASA for management purposes. See the 
“Supported Features” section on page 1-1 for more information. This section includes the following 
topics:
Configuring a Service Policy Rule for Management Traffic
To add a service policy rule for management traffic, perform the following steps:
Step 1From the Configuration > Firewall > Service Policy Rules pane, click the down arrow next to Add.
Step 2Choose Add Management Service Policy Rule.
The Add Management Service Policy Rule Wizard - Service Policy dialog box appears.
Step 3In the Create a Service Policy and Apply To area, click one of the following options:
Interface. This option applies the service policy to a single interface. Interface service policies take 
precedence over the global service policy for a given feature. For example, if you have a global 
policy with RADIUS accounting inspection, and an interface policy with connection limits, then 
both RADIUS accounting and connection limits are applied to the interface. However, if you have 
a global policy with RADIUS accounting, and an interface policy with RADIUS accounting, then 
only the interface policy RADIUS accounting is applied to that interface.
a.Choose an interface from the drop-down list.
If you choose an interface that already has a policy, then the wizard lets you add a new service 
policy rule to the interface.
b.If it is a new service policy, enter a name in the Policy Name field.
c.(Optional) Enter a description in the Description field.
Global - applies to all interfaces. This option applies the service policy globally to all interfaces. 
By default, a global policy exists that includes a service policy rule for default application 
inspection. See the “Default Settings” section on page 1-7 for more information. You can add a rule 
to the global policy using the wizard.
Step 4Click Next.
The Add Management Service Policy Rule Wizard - Traffic Classification Criteria dialog box appears.
Step 5Click one of the following options to specify the traffic to which to apply the policy actions:
Create a new traffic class. Enter a traffic class name in the Create a new traffic class field, and enter 
an optional description. 
						

							 
1-14
Cisco ASA Series Firewall ASDM Configuration Guide
 
Chapter 1      Configuring a Service Policy
  Adding a Service Policy Rule for Management Traffic
Identify the traffic using one of several criteria:
–Source and Destination IP Address (uses ACL)—The class matches traffic specified by an 
extended ACL. If the ASA is operating in transparent firewall mode, you can use an EtherType 
ACL.
NoteWhen you create a new traffic class of this type, you can only specify one access control 
entry (ACE) initially. After you finish adding the rule, you can add additional ACEs by 
adding a new rule to the same interface or global policy, and then specifying Add rule 
to existing traffic class on the Traffic Classification dialog box (see below).
–TCP or UDP Destination Port—The class matches a single port or a contiguous range of ports.
TipFor applications that use multiple, non-contiguous ports, use the Source and Destination IP 
Address (uses ACL) to match each port.
Add rule to existing traffic class. If you already have a service policy rule on the same interface, 
or you are adding to the global service policy, this option lets you add an ACE to an existing ACL. 
You can add an ACE to any ACL that you previously created when you chose the Source and 
Destination IP Address (uses ACL) option for a service policy rule on this interface. For this traffic 
class, you can have only one set of rule actions even if you add multiple ACEs. You can add multiple 
ACEs to the same traffic class by repeating this entire procedure. See the “Managing the Order of 
Service Policy Rules” section on page 1-15 for information about changing the order of ACEs.
Use an existing traffic class. If you created a traffic class used by a rule on a different interface, 
you can reuse the traffic class definition for this rule. Note that if you alter the traffic class for one 
rule, the change is inherited by all rules that use that traffic class. If your configuration includes any 
class-map commands that you entered at the CLI, those traffic class names are also available 
(although to view the definition of the traffic class, you need to create the rule).
Step 6Click Next.
Step 7The next dialog box depends on the traffic match criteria you chose.
Source and Destination Address—This dialog box lets you set the source and destination addresses:
a.Click Match or Do Not Match.
The Match option creates a rule where traffic matching the addresses have actions applied. The 
Do Not Match option exempts the traffic from having the specified actions applied. For 
example, you want to match all traffic in 10.1.1.0/24 and apply connection limits to it, except 
for 10.1.1.25. In this case, create two rules, one for 10.1.1.0/24 using the Match option and one 
for 10.1.1.25 using the Do Not Match option. Be sure to arrange the rules so that the Do Not 
Match rule is above the Match rule, or else 10.1.1.25 will match the Match rule first.
b.In the Source field, enter the source IP address, or click the ... button to choose an IP address 
that you already defined in ASDM.
Specify the address and subnet mask using prefix/length notation, such as 10.1.1.0/24. If you 
enter an IP address without a mask, it is considered to be a host address, even if it ends with a 0.
Enter any to specify any source address.
Separate multiple addresses by a comma.
c.In the Destination field, enter the destination IP address, or click the ... button to choose an IP 
address that you already defined in ASDM.