ASA Inspection clarity
Robbo777
Member Posts: 331 ■■■□□□□□□□
Hi, i want to make sure i get this because it's driving me a bit mad.
class-map ftp
match port tcp eq 21
class-map http
match port tcp eq 21 [it should be 80]
policy-map test
class ftp
inspect ftp
class http
inspect http
This example on Cisco's site, they say "traffic destined to port 21 is mistakenly configured for both FTP and HTTP inspection". So does that mean that the firewall creates a dynamic ACL for HTTP but how does that work with the destination port being port 21? This really confused me.
I'm assuming also that the purpose of the "inspect" command is to create a dynamic ACL or an exception in the firewall to all the traffic back into the network?
Cheers
class-map ftp
match port tcp eq 21
class-map http
match port tcp eq 21 [it should be 80]
policy-map test
class ftp
inspect ftp
class http
inspect http
This example on Cisco's site, they say "traffic destined to port 21 is mistakenly configured for both FTP and HTTP inspection". So does that mean that the firewall creates a dynamic ACL for HTTP but how does that work with the destination port being port 21? This really confused me.
I'm assuming also that the purpose of the "inspect" command is to create a dynamic ACL or an exception in the firewall to all the traffic back into the network?
Cheers