The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
Service policies provide a consistent and flexible way to configure ASA features. For example, you can use a service policy to create a timeout configuration that is specific to a particular TCP application, as opposed to one that applies to all TCP applications. A service policy consists of multiple service policy rules applied to an interface or applied globally.
This chapter includes the following sections:
This section describes how service policies work and includes the following topics:
Table 1-1 lists the features supported by service policy rules.
|
|
|
|
---|---|---|---|
|
|||
TCP and UDP connection limits and timeouts, and TCP sequence number randomization |
|||
Actions are applied to traffic bidirectionally or unidirectionally depending on the feature. For features that are applied bidirectionally, all traffic that enters or exits the interface to which you apply the policy map is affected if the traffic matches the class map for both directions.
Note When you use a global policy, all features are unidirectional; features that are normally bidirectional when applied to a single interface only apply to the ingress of each interface when applied globally. Because the policy is applied to all interfaces, the policy will be applied in both directions so bidirectionality in this case is redundant.
For features that are applied unidirectionally, for example QoS priority queue, only traffic that enters (or exits, depending on the feature) the interface to which you apply the policy map is affected. See Table 1-2 for the directionality of each feature.
|
|
|
---|---|---|
TCP and UDP connection limits and timeouts, and TCP sequence number randomization |
||
See the following information for how a packet matches rules in a policy for a given interface:
1. A packet can match only one rule for an interface for each feature type.
2. When the packet matches a rule for a feature type, the ASA does not attempt to match it to any subsequent rules for that feature type.
3. If the packet matches a subsequent rule for a different feature type, however, then the ASA also applies the actions for the subsequent rule, if supported. See Incompatibility of Certain Feature Actions for more information about unsupported combinations.
Note Application inspection includes multiple inspection types, and most are mutually exclusive. For inspections that can be combined, each inspection is considered to be a separate feature.
For example, if a packet matches a rule for connection limits, and also matches a rule for an application inspection, then both actions are applied.
If a packet matches a rulefor HTTP inspection, but also matches another rule that includes HTTP inspection, then the second rule actions are not applied.
If a packet matches a rulefor HTTP inspection, but also matches another rule that includes FTP inspection, then the second rule actions are not applied because HTTP and FTP inspections cannpt be combined.
If a packet matches a rule for HTTP inspection, but also matches another rule that includes IPv6 inspection, then both actions are applied because the IPv6 inspection can be combined with any other type of inspection.
The order in which different types of actions in a service policy are performed is independent of the order in which the actions appear in the table.
Note NetFlow Secure Event Logging filtering and User statistics for Identity Firewall are order-independent.
Actions are performed in the following order:
2. TCP normalization, TCP and UDP connection limits and timeouts, TCP sequence number randomization, and TCP state bypass.
Note When a the ASA performs a proxy service (such as AAA or CSC) or it modifies the TCP payload (such as FTP inspection), the TCP normalizer acts in dual mode, where it is applied before and after the proxy or payload modifying service.
4. Application inspections that can be combined with other inspections:
5. Application inspections that cannot be combined with other inspections. See Incompatibility of Certain Feature Actions for more information.
Some features are not compatible with each other for the same traffic. The following list may not include all incompatibilities; for information about compatibility of each feature, see the chapter or section for your feature:
Note The Default Inspection Traffic traffic class, which is used in the default global policy, is a special CLI shortcut to match the default ports for all inspections. When used in a policy map, this class map ensures that the correct inspection is applied to each packet, based on the destination port of the traffic. For example, when UDP traffic for port 69 reaches the ASA, then the ASA applies the TFTP inspection; when TCP traffic for port 21 arrives, then the ASA applies the FTP inspection. So in this case only, you can configure multiple inspections for the same class map. Normally, the ASA does not use the port number to determine which inspection to apply, thus giving you the flexibility to apply inspections to non-standard ports, for example.
This traffic class does not include the default ports for Cloud Web Security inspection (80 and 443).
For TCP and UDP traffic (and ICMP when you enable stateful ICMP inspection), service policies operate on traffic flows, and not just individual packets. If traffic is part of an existing connection that matches a feature in a policy on one interface, that traffic flow cannot also match the same feature in a policy on another interface; only the first policy is used.
For example, if HTTP traffic matches a policy on the inside interface to inspect HTTP traffic, and you have a separate policy on the outside interface for HTTP inspection, then that traffic is not also inspected on the egress of the outside interface. Similarly, the return traffic for that connection will not be inspected by the ingress policy of the outside interface, nor by the egress policy of the inside interface.
For traffic that is not treated as a flow, for example ICMP when you do not enable stateful ICMP inspection, returning traffic can match a different policy map on the returning interface. For example, if you configure IPS on the inside and outside interfaces, but the inside policy uses virtual sensor 1 while the outside policy uses virtual sensor 2, then a non-stateful Ping will match virtual sensor 1 outbound, but will match virtual sensor 2 inbound.
|
|
---|---|
This section includes the guidelines and limitations for this feature.
Supported in single and multiple context mode.
Supported in routed and transparent firewall mode.
Supports IPv6 for the following features:
The maximum number of traffic classes of all types is 255 in single mode or per context in multiple mode. Class maps include the following types:
This limit also includes default traffic classes of all types, limiting user-configured traffic classes to approximately 235. See Default Traffic Classes.
For example, if you remove a QoS service policy from an interface, then re-add a modified version, then the show service-policy command only displays QoS counters associated with new connections that match the new service policy; existing connections on the old policy no longer show in the command output.
To ensure that all connections use the new policy, you need to disconnect the current connections so they can reconnect using the new policy. See the clear conn or clear local-host commands.
The following topics describe the default settings for Modular Policy Framework:
By default, the configuration includes a policy that matches all default application inspection traffic and applies certain inspections to the traffic on all interfaces (a global policy). Not all inspections are enabled by default. You can only apply one global policy, so if you want to alter the global policy, you need to either edit the default policy or disable it and apply a new one. (An interface policy overrides the global policy for a particular feature.)
The default policy includes the following application inspections:
The configuration includes a default traffic class that the ASA uses in the default global policy called Default Inspection Traffic; it matches the default inspection traffic. This class, which is used in the default global policy, is a special shortcut to match the default ports for all inspections. When used in a policy, this class ensures that the correct inspection is applied to each packet, based on the destination port of the traffic. For example, when UDP traffic for port 69 reaches the ASA, then the ASA applies the TFTP inspection; when TCP traffic for port 21 arrives, then the ASA applies the FTP inspection. So in this case only, you can configure multiple inspections for the same class map. Normally, the ASA does not use the port number to determine which inspection to apply, thus giving you the flexibility to apply inspections to non-standard ports, for example.
Another class map that exists in the default configuration is called class-default, and it matches all traffic. You can use the class-default class if desired, rather than using the Any traffic class. In fact, some features are only available for class-default, such as QoS traffic shaping.
This section includes the following topics:
Configuring a service policy consists of adding one or more service policy rules per interface or for the global policy. For each rule, you identify the following elements:
Step 1 Identify the interface to which you want to apply the rule, or identify the global policy.
Step 2 Identify the traffic to which you want to apply actions. You can identify Layer 3 and 4 through traffic.
Step 3 Apply actions to the traffic class. You can apply multiple actions for each traffic class.
See Supported Features for more information. To add a service policy rule for through traffic, perform the following steps:
Step 1 Choose Configuration > Firewall > Service Policy Rules pane, and click Add.
The Add Service Policy Rule Wizard - Service Policy dialog box appears.
Note When you click the Add button, and not the small arrow on the right of the Add button, you add a through traffic rule by default. If you click the arrow on the Add button, you can choose between a through traffic rule and a management traffic rule.
Step 2 In the Create a Service Policy and Apply To area, click one of the following options:
a. Choose an interface from the drop-down list.
If you choose an interface that already has a policy, then the wizard lets you add a new service policy rule to the interface.
b. If it is a new service policy, enter a name in the Policy Name field.
c. (Optional) Enter a description in the Description field.
d. (Optional) Check the Drop and log unsupported IPv6 to IPv6 traffic check box to generate a syslog (767001) for IPv6 traffic that is dropped by application inspections that do not support IPv6 traffic. By default, syslogs are not generated. For a list of inspections that support IPv6, see IPv6 Guidelines.
a. If it is a new service policy, enter a name in the Policy Name field.
b. (Optional) Enter a description in the Description field.
c. (Optional) Check the Drop and log unsupported IPv6 to IPv6 traffic check box to generate a syslog (767001) for IPv6 traffic that is dropped by application inspections that do not support IPv6 traffic. By default, syslogs are not generated. For a list of inspections that support IPv6, see IPv6 Guidelines.
The Add Service Policy Rule Wizard - Traffic Classification Criteria dialog box appears.
Step 4 Click one of the following options to specify the traffic to which to apply the policy actions:
Identify the traffic using one of several criteria:
– Default Inspection Traffic —The class matches the default TCP and UDP ports used by all applications that the ASA can inspect.
This option, which is used in the default global policy, is a special shortcut that when used in a rule, ensures that the correct inspection is applied to each packet, based on the destination port of the traffic. For example, when UDP traffic for port 69 reaches the ASA, then the ASA applies the TFTP inspection; when TCP traffic for port 21 arrives, then the ASA applies the FTP inspection. So in this case only, you can configure multiple inspections for the same rule (See Incompatibility of Certain Feature Actions for more information about combining actions). Normally, the ASA does not use the port number to determine the inspection applied, thus giving you the flexibility to apply inspections to non-standard ports, for example.
See Default Settings and NAT Limitations for a list of default ports. The ASA includes a default global policy that matches the default inspection traffic, and applies common inspections to the traffic on all interfaces. Not all applications whose ports are included in the Default Inspection Traffic class are enabled by default in the policy map.
You can specify a Source and Destination IP Address (uses ACL) class along with the Default Inspection Traffic class to narrow the matched traffic. Because the Default Inspection Traffic class specifies the ports and protocols to match, any ports and protocols in the ACL are ignored.
– Source and Destination IP Address (uses ACL) —The class matches traffic specified by an extended ACL. If the ASA is operating in transparent firewall mode, you can use an EtherType ACL.
Note When you create a new traffic class of this type, you can only specify one access control entry (ACE) initially. After you finish adding the rule, you can add additional ACEs by adding a new rule to the same interface or global policy, and then specifying Add rule to existing traffic class on the Traffic Classification dialog box (see below).
– Tunnel Group —The class matches traffic for a tunnel group to which you want to apply QoS. You can also specify one other traffic match option to refine the traffic match, excluding Any Traffic, Source and Destination IP Address (uses ACL), or Default Inspection Traffic.
– TCP or UDP Destination Port —The class matches a single port or a contiguous range of ports.
Tip For applications that use multiple, non-contiguous ports, use the Source and Destination IP Address (uses ACL) to match each port.
– RTP Range —The class map matches RTP traffic.
– IP DiffServ CodePoints (DSCP) —The class matches up to eight DSCP values in the IP header.
– IP Precedence —The class map matches up to four precedence values, represented by the TOS byte in the IP header.
– Any Traffic —Matches all traffic.
Step 6 The next dialog box depends on the traffic match criteria you chose.
Note The Any Traffic option does not have a special dialog box for additional configuration.
a. Click Match or Do Not Match.
The Match option creates a rule where traffic matching the addresses have actions applied. The Do Not Match option exempts the traffic from having the specified actions applied. For example, you want to match all traffic in 10.1.1.0/24 and apply connection limits to it, except for 10.1.1.25. In this case, create two rules, one for 10.1.1.0/24 using the Match option and one for 10.1.1.25 using the Do Not Match option. Be sure to arrange the rules so that the Do Not Match rule is above the Match rule, or else 10.1.1.25 will match the Match rule first.
b. In the Source field, enter the source IP address, or click the ... button to choose an IP address that you already defined in ASDM.
Specify the address and subnet mask using prefix/length notation, such as 10.1.1.0/24. If you enter an IP address without a mask, it is considered to be a host address, even if it ends with a 0.
Enter any to specify any source address.
Separate multiple addresses by a comma.
c. In the Destination field, enter the destination IP address, or click the ... button to choose an IP address that you already defined in ASDM.
Specify the address and subnet mask using prefix/length notation, such as 10.1.1.0/24. If you enter an IP address without a mask, it is considered to be a host address, even if it ends with a 0.
Enter any to specify any destination address.
Separate multiple addresses by a comma.
d. In the Service field, enter an IP service name or number for the destination service, or click the ... button to choose a service.
If you want to specify a TCP or UDP port number, or an ICMP service number, enter protocol / port. For example, enter TCP/8080.
By default, the service is IP.
Separate multiple services by a comma.
e. (Optional) Enter a description in the Description field.
f. (Optional) To specify a source service for TCP or UDP, click the More Options area open, and enter a TCP or UDP service in the Source Service field.
The destination service and source service must be the same. Copy and paste the destination Service field to the Source Service field.
g. (Optional) To make the rule inactive, click the More Options area open, and uncheck Enable Rule.
This setting might be useful if you do not want to remove the rule, but want to turn it off.
h. (Optional) To set a time range for the rule, click the More Options area open, and from the Time Range drop-down list, choose a time range.
To add a new time range, click the ... button. See the general operations configuration guide for more information.
This setting might be useful if you only want the rule to be active at predefined times.
To police each flow, check Match flow destination IP address. All traffic going to a unique IP destination address is considered a flow.
In the Service field, enter a port number or name, or click ... to choose one already defined in ASDM.
Add additional values as desired, or remove them using the Remove button.
Add additional values as desired, or remove them using the Remove button.
The Add Service Policy Rule - Rule Actions dialog box appears.
Step 8 Configure one or more rule actions. See Supported Features for a list of features.
You can create a service policy for traffic directed to the ASA for management purposes. See Supported Features for more information. This section includes the following topics:
To add a service policy rule for management traffic, perform the following steps:
Step 1 From the Configuration > Firewall > Service Policy Rules pane, click the down arrow next to Add.
Step 2 Choose Add Management Service Policy Rule.
The Add Management Service Policy Rule Wizard - Service Policy dialog box appears.
Step 3 In the Create a Service Policy and Apply To area, click one of the following options:
a. Choose an interface from the drop-down list.
If you choose an interface that already has a policy, then the wizard lets you add a new service policy rule to the interface.
b. If it is a new service policy, enter a name in the Policy Name field.
c. (Optional) Enter a description in the Description field.
The Add Management Service Policy Rule Wizard - Traffic Classification Criteria dialog box appears.
Step 5 Click one of the following options to specify the traffic to which to apply the policy actions:
Identify the traffic using one of several criteria:
– Source and Destination IP Address (uses ACL) —The class matches traffic specified by an extended ACL. If the ASA is operating in transparent firewall mode, you can use an EtherType ACL.
Note When you create a new traffic class of this type, you can only specify one access control entry (ACE) initially. After you finish adding the rule, you can add additional ACEs by adding a new rule to the same interface or global policy, and then specifying Add rule to existing traffic class on the Traffic Classification dialog box (see below).
– TCP or UDP Destination Port —The class matches a single port or a contiguous range of ports.
Tip For applications that use multiple, non-contiguous ports, use the Source and Destination IP Address (uses ACL) to match each port.
Step 7 The next dialog box depends on the traffic match criteria you chose.
a. Click Match or Do Not Match.
The Match option creates a rule where traffic matching the addresses have actions applied. The Do Not Match option exempts the traffic from having the specified actions applied. For example, you want to match all traffic in 10.1.1.0/24 and apply connection limits to it, except for 10.1.1.25. In this case, create two rules, one for 10.1.1.0/24 using the Match option and one for 10.1.1.25 using the Do Not Match option. Be sure to arrange the rules so that the Do Not Match rule is above the Match rule, or else 10.1.1.25 will match the Match rule first.
b. In the Source field, enter the source IP address, or click the ... button to choose an IP address that you already defined in ASDM.
Specify the address and subnet mask using prefix/length notation, such as 10.1.1.0/24. If you enter an IP address without a mask, it is considered to be a host address, even if it ends with a 0.
Enter any to specify any source address.
Separate multiple addresses by a comma.
c. In the Destination field, enter the destination IP address, or click the ... button to choose an IP address that you already defined in ASDM.
Specify the address and subnet mask using prefix/length notation, such as 10.1.1.0/24. If you enter an IP address without a mask, it is considered to be a host address, even if it ends with a 0.
Enter any to specify any destination address.
Separate multiple addresses by a comma.
d. In the Service field, enter an IP service name or number for the destination service, or click the ... button to choose a service.
If you want to specify a TCP or UDP port number, or an ICMP service number, enter protocol / port. For example, enter TCP/8080.
By default, the service is IP.
Separate multiple services by a comma.
e. (Optional) Enter a description in the Description field.
f. (Optional) To specify a source service for TCP or UDP, click the More Options area open, and enter a TCP or UDP service in the Source Service field.
The destination service and source service must be the same. Copy and paste the destination Service field to the Source Service field.
g. (Optional) To make the rule inactive, click the More Options area open, and uncheck Enable Rule.
This setting might be useful if you do not want to remove the rule, but want to turn it off.
h. (Optional) To set a time range for the rule, click the More Options area open, and from the Time Range drop-down list, choose a time range.
To add a new time range, click the ... button. See the general operations configuration guide for more information.
This setting might be useful if you only want the rule to be active at predefined times.
In the Service field, enter a port number or name, or click ... to choose one already defined in ASDM.
The Add Management Service Policy Rule - Rule Actions dialog box appears.
Step 9 To configure RADIUS accounting inspection, choose an inspect map from the RADIUS Accounting Map drop-down list, or click Configure to add a map.
See Supported Features for more information.
Step 10 To configure connection settings, see Configuring Connection Settings.
The order of service policy rules on an interface or in the global policy affects how actions are applied to traffic. See the following guidelines for how a packet matches rules in a service policy:
For example, if a packet matches a rule for connection limits, and also matches a rule for application inspection, then both rule actions are applied.
If a packet matches a rule for application inspection, but also matches another rule that includes application inspection, then the second rule actions are not applied.
If your rule includes an ACL with multiple ACEs, then the order of ACEs also affects the packet flow. The ASA tests the packet against each ACE in the order in which the entries are listed. After a match is found, no more ACEs are checked. For example, if you create an ACE at the beginning of an ACL that explicitly permits all traffic, no further statements are ever checked.
To change the order of rules or ACEs within a rule, perform the following steps:
Step 1 From the Configuration > Firewall > Service Policy Rules pane, choose the rule or ACE that you want to move up or down.
Step 2 Click the Move Up or Move Down cursor (see Figure 1-1).
Note If you rearrange ACEs in an ACL that is used in multiple service policies, then the change is inherited in all service policies.
Step 3 When you are done rearranging your rules or ACEs, click Apply.
Table 1-3 lists the release history for this feature.