Options
ASA Inspection clarity
Hi, i want to make sure i get this because it's driving me a bit mad.
class-map ftp
match port tcp eq 21
class-map http
match port tcp eq 21 [it should be 80]
policy-map test
class ftp
inspect ftp
class http
inspect http
This example on Cisco's site, they say "traffic destined to port 21 is mistakenly configured for both FTP and HTTP inspection". So does that mean that the firewall creates a dynamic ACL for HTTP but how does that work with the destination port being port 21? This really confused me.
I'm assuming also that the purpose of the "inspect" command is to create a dynamic ACL or an exception in the firewall to all the traffic back into the network?
Cheers
class-map ftp
match port tcp eq 21
class-map http
match port tcp eq 21 [it should be 80]
policy-map test
class ftp
inspect ftp
class http
inspect http
This example on Cisco's site, they say "traffic destined to port 21 is mistakenly configured for both FTP and HTTP inspection". So does that mean that the firewall creates a dynamic ACL for HTTP but how does that work with the destination port being port 21? This really confused me.
I'm assuming also that the purpose of the "inspect" command is to create a dynamic ACL or an exception in the firewall to all the traffic back into the network?
Cheers
Comments
-
Options
DCD
Member Posts: 473 ■■■■□□□□□□
It will create the ACL but assign the wrong port number and drop the traffic because the port will not connecting to the right port. The HTTP server will be looking for port 80 not 21 so it will not connect unless you change the on the server to responded to port 21.