CLI Book 2: Cisco ASA Series Firewall CLI Configuration Guide, 9.1

How Inspection Engines Work

As illustrated in Figure 9-1, the ASA uses three databases for its basic operation:

• ACLs—Used for authentication and authorization of connections based on specific networks, hosts, and services (TCP/UDP port numbers).
• Inspections—Contains a static, predefined set of application-level inspection functions.
• Connections (XLATE and CONN tables)—Maintains state and other information about each established connection. This information is used by the Adaptive Security Algorithm and cut-through proxy to efficiently forward traffic within established sessions.

Figure 9-1 How Inspection Engines Work

In Figure 9-1, operations are numbered in the order they occur, and are described as follows:

1. A TCP SYN packet arrives at the ASA to establish a new connection.

2. The ASA checks the ACL database to determine if the connection is permitted.

3. The ASA creates a new entry in the connection database (XLATE and CONN tables).

4. The ASA checks the Inspections database to determine if the connection requires application-level inspection.

5. After the application inspection engine completes any required operations for the packet, the ASA forwards the packet to the destination system.

6. The destination system responds to the initial request.

7. The ASA receives the reply packet, looks up the connection in the connection database, and forwards the packet because it belongs to an established session.

The default configuration of the ASA includes a set of application inspection entries that associate supported protocols with specific TCP or UDP port numbers and that identify any special handling required.

When to Use Application Protocol Inspection

When a user establishes a connection, the ASA checks the packet against ACLs, creates an address translation, and creates an entry for the session in the fast path, so that further packets can bypass time-consuming checks. However, the fast path relies on predictable port numbers and does not perform address translations inside a packet.

Many protocols open secondary TCP or UDP ports. The initial session on a well-known port is used to negotiate dynamically assigned port numbers.

Other applications embed an IP address in the packet that needs to match the source address that is normally translated when it goes through the ASA.

If you use applications like these, then you need to enable application inspection.

When you enable application inspection for a service that embeds IP addresses, the ASA translates embedded addresses and updates any checksum or other fields that are affected by the translation.

When you enable application inspection for a service that uses dynamically assigned ports, the ASA monitors sessions to identify the dynamic port assignments, and permits data exchange on these ports for the duration of the specific session.

Detailed Steps

Step 1 To identify the traffic to which you want to apply inspections, add either a Layer 3/4 class map for through traffic or a Layer 3/4 class map for management traffic. See the “Creating a Layer 3/4 Class Map for Through Traffic” section and “Creating a Layer 3/4 Class Map for Management Traffic” section for detailed information. The management Layer 3/4 class map can be used only with the RADIUS accounting inspection.

The default Layer 3/4 class map for through traffic is called “inspection_default.” It matches traffic using a special match command, match default-inspection-traffic , to match the default ports for each application protocol. This traffic class (along with match any , which is not typically used for inspection) matches both IPv4 and IPv6 traffic for inspections that support IPv6. See the “Guidelines and Limitations” section for a list of IPv6-enabled inspections.

You can specify a match access-list command along with the match default-inspection-traffic command to narrow the matched traffic to specific IP addresses. Because the match default-inspection-traffic command specifies the ports to match, any ports in the ACL are ignored.

Tip We suggest that you only inspect traffic on ports on which you expect application traffic; if you inspect all traffic, for example using match any, the ASA performance can be impacted.

If you want to match non-standard ports, then create a new class map for the non-standard ports. See the “Default Settings and NAT Limitations” section for the standard ports for each inspection engine. You can combine multiple class maps in the same policy if desired, so you can create one class map to match certain traffic, and another to match different traffic. However, if traffic matches a class map that contains an inspection command, and then matches another class map that also has an inspection command, only the first matching class is used. For example, SNMP matches the inspection_default class. To enable SNMP inspection, enable SNMP inspection for the default class in Step 5. Do not add another class that matches SNMP.

For example, to limit inspection to traffic from 10.1.1.0 to 192.168.1.0 using the default class map, enter the following commands:

View the entire class map using the following command:

To inspect FTP traffic on port 21 as well as 1056 (a non-standard port), create an ACL that specifies the ports, and assign it to a new class map:

Step 2 (Optional) Some inspection engines let you control additional parameters when you apply the inspection to the traffic. See the following sections to configure an inspection policy map for your application:

• DCERPC—See the “Configuring a DCERPC Inspection Policy Map for Additional Inspection Control” section
• DNS—See the “(Optional) Configuring a DNS Inspection Policy Map and Class Map” section
• ESMTP—See the “Configuring an ESMTP Inspection Policy Map for Additional Inspection Control” section
• FTP—See the “Configuring an FTP Inspection Policy Map for Additional Inspection Control” section.
• GTP—See the “Configuring a GTP Inspection Policy Map for Additional Inspection Control” section.
• H323—See the “Configuring an H.323 Inspection Policy Map for Additional Inspection Control” section
• HTTP—See the “Configuring an HTTP Inspection Policy Map for Additional Inspection Control” section.
• Instant Messaging—See the “Configuring an Instant Messaging Inspection Policy Map for Additional Inspection Control” section
• IP Options—See the “Configuring an IP Options Inspection Policy Map for Additional Inspection Control” section
• IPsec Pass Through—See the “IPsec Pass Through Inspection” section
• IPv6—See the “(Optional) Configuring an IPv6 Inspection Policy Map” section
• MGCP—See the “Configuring an MGCP Inspection Policy Map for Additional Inspection Control” section.
• NetBIOS—See the “Configuring a NetBIOS Inspection Policy Map for Additional Inspection Control” section
• RADIUS Accounting—See the “Configuring a RADIUS Inspection Policy Map for Additional Inspection Control” section
• RTSP—See the “Configuring an RTSP Inspection Policy Map for Additional Inspection Control” section
• ScanSafe (Cloud Web Security)—See the “Configuring a Service Policy to Send Traffic to Cloud Web Security” section
• SIP—See the “Configuring a SIP Inspection Policy Map for Additional Inspection Control” section
• Skinny—See the “Configuring a Skinny (SCCP) Inspection Policy Map for Additional Inspection Control” section
• SNMP—See the “Configuring an SNMP Inspection Policy Map for Additional Inspection Control” section.

Step 3 To add or edit a Layer 3/4 policy map that sets the actions to take with the class map traffic, enter the following command:

The default policy map is called “global_policy.” This policy map includes the default inspections listed in the “Default Settings and NAT Limitations” section. If you want to modify the default policy (for example, to add or delete an inspection, or to identify an additional class map for your actions), then enter global_policy as the name.

Step 4 To identify the class map from Step 1 to which you want to assign an action, enter the following command:

If you are editing the default policy map, it includes the inspection_default class map. You can edit the actions for this class by entering inspection_default as the name. To add an additional class map to this policy map, identify a different name. You can combine multiple class maps in the same policy if desired, so you can create one class map to match certain traffic, and another to match different traffic. However, if traffic matches a class map that contains an inspection command, and then matches another class map that also has an inspection command, only the first matching class is used. For example, SNMP matches the inspection_default class map.To enable SNMP inspection, enable SNMP inspection for the default class in Step 5. Do not add another class that matches SNMP.

Step 5 Enable application inspection by entering the following command:

The protocol is one of the following values:

Step 6 To activate the policy map on one or more interfaces, enter the following command:

Where global applies the policy map to all interfaces, and interface applies the policy to one interface. By default, the default policy map, “global_policy,” is applied globally. Only one global policy is allowed. You can override the global policy on an interface by applying a service policy to that interface. You can only apply one policy map to each interface.