ASA Inspection clarity

Robbo777Robbo777 Posts: 330Member
Hi, i want to make sure i get this because it's driving me a bit mad.
class-map ftp
match port tcp eq 21
class-map http
match port tcp eq 21 [it should be 80]
policy-map test
class ftp
inspect ftp
class http
inspect http



This example on Cisco's site, they say "traffic destined to port 21 is mistakenly configured for both FTP and HTTP inspection". So does that mean that the firewall creates a dynamic ACL for HTTP but how does that work with the destination port being port 21? This really confused me.
I'm assuming also that the purpose of the "inspect" command is to create a dynamic ACL or an exception in the firewall to all the traffic back into the network?


Cheers
Sign In or Register to comment.