Click View Configuration in Device > Advanced Configuration.

Click FlexConfig > FlexConfig Objects in the Advanced Configuration table of contents.

Create the object to enable PPTP inspection.

1. Click the + button to create a new object.

2. Enter a name for the object. For example, Enable_PPTP_Global_Inspection.

3. In the Template editor, enter the following lines, including indentations.

   
   policy-map global_policy
    class inspection_default
     inspect pptp
   
   

4. In the Negate Template editor, enter the lines required to undo this configuration.

   Just as you need to include the parent commands to enter the correct sub-mode for a command to enable it, you also need to include those commands in the negate template.

   The negate template will be applied if you remove this object from the FlexConfig policy (after having deployed it successfully), and also during an unsuccessful deployment (to reset the configuration to its previous condition).

   Thus, for this example, the negate template would be the following:

   
   policy-map global_policy
    class inspection_default
     no inspect pptp
   
   

   The object should look like the following:

   
   

   

   
   

   Note	Because the inspection_default class has other inspection commands enabled, you do not want to negate the entire class. Similarly, the global_policy policy map includes these other inspections, and you do not want to negate the policy map either.

5. Click OK to save the object.

Create the object to disable SIP inspection.

1. Click the + button to create a new object.

2. Enter a name for the object. For example, Disable_SIP_Global_Inspection.

3. In the Template editor, enter the following lines, including indentations.

   
   policy-map global_policy
    class inspection_default
     no inspect sip
   
   

4. In the Negate Template editor, enter the lines required to undo this configuration.

   The “negate” command for a disabling “no” command is the command that enables the feature. Thus, the “negate” template is not just the commands to disable a feature, it is the commands to reverse whatever you do in the “positive” template. The point of the negate template is to undo your changes.

   Thus, for this example, the negate template would be the following:

   
   policy-map global_policy
    class inspection_default
     inspect sip
   
   

   The object should look like the following:

   
   

   

   
   

5. Click OK to save the object.

Add the objects to the FlexConfig policy.

1. Click FlexConfig Policy in the table of contents.

2. Click + in the Group List.

3. Select the Enable_PPTP_Global_Inspection and Disable_SIP_Global_Inspection objects and click OK.

   The group list should look like the following:

   
   

   

   
   

   The preview should update with the commands in the template. Verify you are seeing the expected commands.

   
   

   

   
   

4. Click Save.

   You can now deploy the policy.

Commit your changes.

1. Click the Deploy Changes icon in the upper right of the web page.

   

2. Click the Deploy Now button.

   Wait for deployment to finish. The deployment summary should indicate that you have successfully deployed your changes, and the task status for the job should be Deployed.

In CLI Console or an SSH session, use the show running-config policy-map command and verify that the running configuration has the correct changes.

> show running-config policy-map 
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
  no tcp-inspection
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map 
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect rsh 
  inspect rtsp 
  inspect sqlnet 
  inspect skinny  
  inspect sunrpc 
  inspect xdmcp 
  inspect netbios 
  inspect tftp 
  inspect ip-options 
  inspect icmp 
  inspect icmp error 
  inspect pptp 
!

Click View Configuration in Device > Advanced Configuration.

Click FlexConfig > FlexConfig Policy in the Advanced Configuration table of contents.

Click the X on the right side of the Disable_SIP_Global_Inspection object’s entry in the FlexConfig policy to delete it from the policy.

The commands from the object are removed from the preview. The negate commands are not added to the preview, these will be executed behind the scenes.

Click Save.

Commit your changes.

1. Click the Deploy Changes icon in the upper right of the web page.

   

2. Click the Deploy Now button.

   Wait for deployment to finish. The deployment summary should indicate that you have successfully deployed your changes, and the task status for the job should be Deployed.

In CLI Console or an SSH session, use the show running-config policy-map command and verify that the running configuration has the correct changes.

> show running-config policy-map 
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
  no tcp-inspection
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map 
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect rsh 
  inspect rtsp 
  inspect sqlnet 
  inspect skinny  
  inspect sunrpc 
  inspect xdmcp 
  inspect netbios 
  inspect tftp 
  inspect ip-options 
  inspect icmp 
  inspect icmp error 
  inspect pptp 
  inspect sip  
!

Click View Configuration in Device > Advanced Configuration.

Click FlexConfig > FlexConfig Objects in the Advanced Configuration table of contents.

Click the + button to create a new object.

Enter a name for the object. For example, Enable_PPTP_Inspection_on_Interface.

Add a variable for the inside interface.

1. Click + above the Variables list.

2. Enter a name for the variable, for example, pptp-if.

3. For Type, select Interface.

4. For Value, select the inside interface.

   The dialog box should look like the following:

   
   

   

   
   

5. Click Add.

In the Template editor, enter the following lines, including indentations.

access-list MATCH_ACL permit ip host 192.168.1.55 host 198.51.100.1 
class-map MATCH_CMAP
 match access-list MATCH_ACL
policy-map PPTP_POLICY
 class MATCH_CMAP
  inspect pptp
service-policy PPTP_POLICY interface {{pptp-if.name}}

In the Negate Template editor, enter the lines required to undo this configuration.

For this example, we will assume that the class map, policy map, and service policy exist for the sole purpose of applying PPTP inspection. Thus, in the negate template, we want to remove all of these.

If, however, you are actually adding PPTP inspection to an existing service policy on an interface, you would not negate the policy map or service policy. You would either negate the class from the policy map, or simply turn off inspection within the class within the policy map. You need to have a clear understanding of what you are implementing in other FlexConfig objects to ensure that your negate template does not have unintended consequences.

When deleting nested items, you need to do it in the reverse order in which you created them. Thus, you start by deleting the service policy, and end by deleting the access list. Otherwise, you would be trying to delete objects that are in use, and the system will return errors and not let you do that.

no service-policy PPTP_POLICY interface {{pptp-if.name}}
no policy-map PPTP_POLICY
no class-map MATCH_CMAP
no access-list MATCH_ACL permit ip host 192.168.1.55 host 198.51.100.1 

The object should look like the following:

Click OK to save the object.

Add the objects to the FlexConfig policy.

1. Click FlexConfig Policy in the table of contents.

2. Click + in the Group List.

3. Select the Enable_PPTP_Inspection_on_Interface object and click OK.

   The group list should look like the following:

   
   

   

   
   

   The preview should update with the commands in the template. Verify you are seeing the expected commands, as shown in the following graphic. Notice that the interface variable resolves to the name “inside” in the preview. Pay special attention to variables: if they do not resolve correctly in the preview, they will not deploy correctly. Edit the FlexConfig object until you get the correct variable translation in the preview.

   
   

   

   
   

4. Click Save.

   You can now deploy the policy.

Commit your changes.

1. Click the Deploy Changes icon in the upper right of the web page.

   

2. Click the Deploy Now button.

   Wait for deployment to finish. The deployment summary should indicate that you have successfully deployed your changes, and the task status for the job should be Deployed.

In CLI Console or an SSH session, use variations of the show running-config command and verify that the running configuration has the correct changes.

> show running-config access-list MATCH_ACL 
access-list MATCH_ACL extended permit ip host 192.168.1.55 host 198.51.100.1 

> show running-config class 
!
class-map MATCH_CMAP
 match access-list MATCH_ACL
class-map inspection_default
 match default-inspection-traffic
!

> show running-config policy-map PPTP_POLICY 
!
policy-map PPTP_POLICY
 class MATCH_CMAP
  inspect pptp 
!
> show running-config service-policy 
service-policy global_policy global
service-policy PPTP_POLICY interface inside