PIX - Advanced Protocol Handling

When using a "inspect policy map" you need to add it to a "standard policy-map" to allow you to add it to the service policy.
For each policy map there would be a class map, the inspect would match the FTP command, and then use the classmap “inspection-default” in the standard policy map.

Running Config

policy-map type inspect dns preset_dns_map
  message-length maximum 512

policy-map type inspect ftp FTPPOL
  reset log

policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect netbios
  inspect rsh
  inspect rtsp
  inspect skinny
  inspect esmtp
  inspect sqlnet
 inspect sunrpc
  inspect sip
  inspect xdmcp
policy-map FTPPOLICY2
 class inspection_default
  inspect ftp strict FTPPOL
service-policy global_policy global

Tags: Cisco, MPF

About the Author


R Donato

Rick Donato is the Founder and Chief Editor of He currently works as an SDN/NFV Solutions Architect and has a keen interest in automation and the cloud.

You can find Rick on Twitter @f3lix001