Cisco ASA Series Command Reference
match ehlo-reply-parameter -- match question
Downloads: This chapterpdf (PDF - 366.0KB) The complete bookPDF (PDF - 31.85MB) | The complete bookePub (ePub - 2.33MB) | The complete bookMobi (Mobi - 9.5MB) | Feedback

Table of Contents

m atch ehlo-reply-parameter through match question Commands

m atch ehlo-reply-parameter

m atch filename

m atch filetype

m atch flow ip destination-address

m atch header (policy-map type inspect esmtp)

m atch header (policy-map type inspect ipv6)

m atch header-flag

m atch im-subscriber

m atch interface

m atch invalid-recipients

m atch ip address

m atch ip v6 address

m atch ip next-hop

m atch ip route-source

m atch login-name

m atch media-type

m atch message id

m atch message length

match message-path

m atch metric

match mime

m atch peer-ip-address

m atch peer-login-name

m atch port

m atch precedence

m atch protocol

match question

match ehlo-reply-parameter through match question Commands

match ehlo-reply-parameter

To configure a match condition on the ESMTP ehlo reply parameter, use the match ehlo-reply-parameter command in policy-map configuration mode. To disable this feature, use the no form of this command.

match [not] ehlo-reply-parameter parameter

no match [not] ehlo-reply-parameter parameter

 
Syntax Description

parameter

Specifies the ehlo reply parameter.

 
Defaults

No default behavior or values.

 
Command Modes

The following table shows the modes in which you can enter the command:

 

Command Mode
Firewall Mode
Security Context
Routed
Transparent
Single
Multiple
Context
System

Policy map configuration

  •  
  •  
  •  
  •  

 
Command History

Release
Modification

7.2(1)

This command was introduced.

Examples

The following example shows how to configure a match condition for an ehlo reply parameter in an ESMTP inspection policy map:

ciscoasa(config)# policy-map type inspect esmtp esmtp_map

ciscoasa(config-pmap)# match ehlo-reply-parameter auth

 

 
Related Commands

Command
Description

class-map

Creates a Layer 3/4 class map.

clear configure class-map

Removes all class maps.

match any

Includes all traffic in the class map.

match port

Identifies a specific port number in a class map.

show running-config class-map

Displays the information about the class map configuration.

match filename

To configure a match condition for a filename for FTP transfer, use the match filename command in class-map or policy-map configuration mode. To remove the match condition, use the no form of this command.

match [not] filename regex [regex_name | class regex_class_name]

no match [not] filename regex [regex_name | class regex_class_name]

 
Syntax Description

regex_name

Specifies a regular expression.

class regex_class_name

Specifies a regular expression class map.

 
Defaults

No default behavior or values.

 
Command Modes

The following table shows the modes in which you can enter the command:

 

Command Mode
Firewall Mode
Security Context
Routed
Transparent
Single
Multiple
Context
System

Class-map or policy map configuration

  •  
  •  
  •  
  •  

 
Command History

Release
Modification

7.2(1)

This command was introduced.

 
Usage Guidelines

This command can be configured in an FTP class map or policy map. Only one entry can be entered in a FTP class map.

Examples

The following example shows how to configure a match condition for an FTP transfer filename in an FTP inspection class map:

ciscoasa(config)# class-map type inspect ftp match-all ftp_class1
ciscoasa(config-cmap)# description Restrict FTP users ftp1, ftp2, and ftp3 from accessing /root
ciscoasa(config-cmap)# match username regex class ftp_regex_user
ciscoasa(config-cmap)# match filename regex ftp-file
 

 
Related Commands

Command
Description

class-map

Creates a Layer 3/4 class map.

clear configure class-map

Removes all class maps.

match any

Includes all traffic in the class map.

match port

Identifies a specific port number in a class map.

show running-config class-map

Displays the information about the class map configuration.

match filetype

To configure a match condition for a filetype for FTP transfer, use the match filetype command in class-map or policy-map configuration mode. To remove the match condtion, use the no form of this command.

match [not] filetype regex [regex_name | class regex_class_name]

no match [not] filetype regex [regex_name | class regex_class_name]

 
Syntax Description

regex_name

Specifies a regular expression.

class regex_class_name

Specifies a regular expression class map.

 
Defaults

No default behavior or values.

 
Command Modes

The following table shows the modes in which you can enter the command:

 

Command Mode
Firewall Mode
Security Context
Routed
Transparent
Single
Multiple
Context
System

Class-map or policy map configuration

  •  
  •  
  •  
  •  

 
Command History

Release
Modification

7.2(1)

This command was introduced.

 
Usage Guidelines

This command can be configured in an FTP class map or policy map. Only one entry can be entered in a FTP class map.

Examples

The following example shows how to configure a match condition for an FTP transfer filetype in an FTP inspection policy map:

ciscoasa(config-pmap)# match filetype class regex ftp-regex-filetype
 

 
Related Commands

Command
Description

class-map

Creates a Layer 3/4 class map.

clear configure class-map

Removes all class maps.

match any

Includes all traffic in the class map.

match port

Identifies a specific port number in a class map.

show running-config class-map

Displays the information about the class map configuration.

match flow ip destination-address

To specify the flow IP destination address in a class map, use the match flow ip destination-address command in class-map configuration mode. To remove this specification, use the no form of this command.

match flow ip destination-address

no match flow ip destination-address

 
Syntax Description

This command has no arguments or keywords.

 
Defaults

No default behavior or values.

 
Command Modes

The following table shows the modes in which you can enter the command:

 

Command Mode
Firewall Mode
Security Context
Routed
Transparent
Single
Multiple
Context
System

Class-map configuration

  •  
  •  
  •  
  •  

 
Command History

Release
Modification

7.0(1)

This command was introduced.

 
Usage Guidelines

The match commands are used to identify the traffic included in the traffic class for a class map. They include different criteria to define the traffic included in a class-map. Define a traffic class using the class-map global configuration command as part of configuring a security feature using Modular Policy Framework. From class-map configuration mode, you can define the traffic to include in the class using the match command.

After a traffic class is applied to an interface, packets received on that interface are compared to the criteria defined by the match statements in the class map. If the packet matches the specified criteria, it is included in the traffic class and is subjected to any actions associated with that traffic class. Packets that do not match any of the criteria in any traffic class are assigned to the default traffic class.

To enable flow-based policy actions on a tunnel group, use the match flow ip destination-address and match tunnel-group commands with the class-map , policy-map , and service-policy commands. The criteria to define flow is the destination IP address. All traffic going to a unique IP destination address is considered a flow. Policy action is applied to each flow instead of the entire class of traffic. QoS action police is applied using the match flow ip destination-address command. Use match tunnel-group to police every tunnel within a tunnel group to a specified rate.

Examples

The following example shows how to enable flow-based policing within a tunnel group and limit each tunnel to a specified rate:

ciscoasa(config)# class-map cmap
ciscoasa(config-cmap)# match tunnel-group
ciscoasa(config-cmap)# match flow ip destination-address
ciscoasa(config-cmap)# exit
ciscoasa(config)# policy-map pmap
ciscoasa(config-pmap)# class cmap
ciscoasa(config-pmap)# police 56000
ciscoasa(config-pmap)# exit
ciscoasa(config)# service-policy pmap global
ciscoasa(config)#
 

 
Related Commands

Command
Description

class-map

Applies a traffic class to an interface.

clear configure class-map

Removes all of the traffic map definitions.

match access-list

Identifies access list traffic within a class map.

show running-config class-map

Displays the information about the class map configuration.

tunnel-group

Creates and manages the database of connection-specific records for VPN.

match header (policy-map type inspect esmtp)

To configure a match condition on the ESMTP header, use the match header command in policy-map type inspect esmtp configuration mode. To disable this feature, use the no form of this command.

match [not] header [[length | line length] gt bytes | to-fields count gt to_fields_number]

no match [not] header [[length | line length] gt bytes | to-fields count gt to_fields_number]

 
Syntax Description

length gt bytes

Specifies to match on the length of the ESMTP header message.

line length gt bytes

Specifies to match on the length of a line of an ESMTP header message.

to-fields count gt to_fields_number

Specifies to match on the number of To: fields.

 
Defaults

No default behavior or values.

 
Command Modes

The following table shows the modes in which you can enter the command:

 

Command Mode
Firewall Mode
Security Context
Routed
Transparent
Single
Multiple
Context
System

Policy-map type inspect esmtp configuration

  •  
  •  
  •  
  •  

 
Command History

Release
Modification

7.2(1)

This command was introduced.

Examples

The following example shows how to configure a match condition for a header in an ESMTP inspection policy map:

ciscoasa(config)# policy-map type inspect esmtp esmtp_map

ciscoasa(config-pmap)# match header length gt 512

 

 
Related Commands

Command
Description

class-map

Creates a Layer 3/4 class map.

clear configure class-map

Removes all class maps.

match any

Includes all traffic in the class map.

match port

Identifies a specific port number in a class map.

show running-config class-map

Displays the information about the class map configuration.

match header (policy-map type inspect ipv6)

To configure a match condition on the IPv6 header, use the match header command in policy-map type inspect ipv6 configuration mode. To disable this feature, use the no form of this command.

match [ not ] header { ah | count gt number | destination-option | esp | fragment | hop-by-hop | routing-address count gt number | routing-type { eq | range } number }

no match [ not ] header { ah | count gt number | destination-option | esp | fragment | hop-by-hop | routing-address count gt number | routing-type { eq | range } number }

 
Syntax Description

ah

Matches the IPv6 Authentication extension header

count gt number

Specifies the maximum number of IPv6 extension headers, from 0 to 255.

destination-option

Matches the IPv6 destination-option extension header.

esp

Matches the IPv6 Encapsulation Security Payload (ESP) extension header.

fragment

Matches the IPv6 fragment extension header.

hop-by-hop

Matches the IPv6 hop-by-hop extension header.

not

(Optional) Does not match the specified parameter.

routing-address count gt number

Sets the maximum number of IPv6 routing header type 0 addresses, greater than a number between 0 and 255.

routing-type { eq | range } number

Matches the IPv6 routing header type, from 0 to 255. For a range, separate values by a space, for example, 30 40 .

 
Defaults

No default behavior or values.

 
Command Modes

The following table shows the modes in which you can enter the command:

 

Command Mode
Firewall Mode
Security Context
Routed
Transparent
Single
Multiple
Context
System

Policy-map type inspect ipv6 configuration

  •  
  •  
  •  
  •  

 
Command History

Release
Modification

8.2(1)

This command was introduced.

 
Usage Guidelines

Specifies the headers you want to match. By default, the packet is logged ( log ); if you want to drop (and optionally also log) the packet, enter the drop and optional log commands in match configuration mode.

Re-enter the match command and optional drop action for each extension you want to match:

Examples

The following example creates an inspection policy map that will drop and log all IPv6 packets with the hop-by-hop, destination-option, routing-address, and routing type 0 headers:

policy-map type inspect ipv6 ipv6-pm
parameters
match header hop-by-hop
drop log
match header destination-option
drop log
match header routing-address count gt 0
drop log
match header routing-type eq 0
drop log
 

 
Related Commands

Command
Description

class-map

Creates a Layer 3/4 class map.

clear configure class-map

Removes all class maps.

match any

Includes all traffic in the class map.

match port

Identifies a specific port number in a class map.

show running-config class-map

Displays the information about the class map configuration.

match header-flag

To configure a match condition for a DNS header flag, use the match header-flag command in class-map or policy-map configuration mode. To remove a configured header flag, use the no form of this command.

match [not] header-flag [eq] {f_well_known | f_value}

no match [not] header-flag [eq] {f_well_known | f_value}

 
Syntax Description

eq

Specifies an exact match. If not configured, specifies a match-all bit mask match.

f_well_known

Specifies DNS header flag bits by well-known name. Multiple flag bits may be entered and logically OR’d.

QR (Query, note: QR=1, indicating a DNS response)

AA (Authoritative Answer)

TC (TrunCation)

RD (Recursion Desired)

RA (Recursion Available)

f_value

Specifies an arbitrary 16-bit value in hexidecimal form.

 
Defaults

This command is disabled by default.

 
Command Modes

The following table shows the modes in which you can enter the command:

 

Command Mode
Firewall Mode
Security Context
Routed
Transparent
Single
Multiple
Context
System

Class-map or policy map configuration

  •  
  •  
  •  
  •  

 
Command History

Release
Modification

7.2(1)

This command was introduced.

 
Usage Guidelines

This command can be configured in a DNS class map or policy map. Only one entry can be entered in a DNS class map.

Examples

The following example shows how to configure a match condition for a DNS header flag in a DNS inspection policy map:

ciscoasa(config)# policy-map type inspect dns preset_dns_map
ciscoasa(config-pmap)# match header-flag AA
 

 
Related Commands

Command
Description

class-map

Creates a Layer 3/4 class map.

clear configure class-map

Removes all class maps.

match any

Includes all traffic in the class map.

match port

Identifies a specific port number in a class map.

show running-config class-map

Displays the information about the class map configuration.

match im-subscriber

To configure a match condition for a SIP IM subscriber, use the match im-subscriber command in class-map or policy-map configuration mode. To remove the match condtion, use the no form of this command.

match [not] im-subscriber regex [regex_name | class regex_class_name]

no match [not] im-subscriber regex [regex_name | class regex_class_name]

 
Syntax Description

regex_name

Specifies a regular expression.

class regex_class_name

Specifies a regular expression class map.

 
Defaults

No default behavior or values.

 
Command Modes

The following table shows the modes in which you can enter the command:

 

Command Mode
Firewall Mode
Security Context
Routed
Transparent
Single
Multiple
Context
System

Class-map or policy map configuration

  •  
  •  
  •  
  •  

 
Command History

Release
Modification

7.2(1)

This command was introduced.

 
Usage Guidelines

This command can be configured in a SIP class map or policy map. Only one entry can be entered in a SIP class map.

Examples

The following example shows how to configure a match condition for a SIP IM subscriber in a SIP inspection class map:

ciscoasa(config-cmap)# match im-subscriber regex class im_sender
 

 
Related Commands

Command
Description

class-map

Creates a Layer 3/4 class map.

clear configure class-map

Removes all class maps.

match any

Includes all traffic in the class map.

match port

Identifies a specific port number in a class map.

show running-config class-map

Displays the information about the class map configuration.

match interface

To distribute any routes that have their next hop out one of the interfaces specified, use the match interface command in route-map configuration mode. To remove the match interface entry, use the no form of this command.

match interface interface-name

no match interface interface-name

 
Syntax Description

interface-name

Name of the interface (not the physical interface). Multiple interface names can be specified.

 
Defaults

No match interfaces are defined.

 
Command Modes

The following table shows the modes in which you can enter the command:

 

Command Mode
Firewall Mode
Security Context
Routed
Transparent
Single
Multiple
Context
System

Route-map configuration

  •  

  •  

 
Command History

Release
Modification

7.0(1)

This command was introduced.

9.0(1)

Multiple context mode is supported.

 
Usage Guidelines

An ellipsis (...) in the command syntax indicates that your command input can include multiple values for the interface-type interface-number arguments.

The route-map global configuration command and the match and set configuration commands allow you to define the conditions for redistributing routes from one routing protocol into another. Each route-map command has match and set commands that are associated with it. The match commands specify the match criteria—the conditions under which redistribution is allowed for the current route-map command. The set commands specify the set actions—the particular redistribution actions to perform if the criteria that is enforced by the match commands are met. The no route-map command deletes the route map.

The match route-map configuration command has multiple formats. You can give the match commands in any order. All match commands must “pass” to cause the route to be redistributed according to the set actions that are given with the set commands. The no forms of the match commands remove the specified match criteria. If there is more than one interface specified in the match command. then the no match interface interface-name can be used to remove a single interface.

A route map can have several parts. Any route that does not match at least one match clause relating to a route-map command is ignored. If you want to modify only some data, you must configure a second route map section and specify an explicit match.

Examples

The following example shows that the routes with their next hop outside is distributed:

ciscoasa(config)# route-map name
ciscoasa(config-route-map)# match interface outside
 

 
Related Commands

Command
Description

match ip next-hop

Distributes any routes that have a next-hop router address that is passed by one of the access lists specified.

match ip route-source

Redistributes routes that have been advertised by routers and access servers at the address that is specified by the access lists.

match metric

Redistributes routes with the metric specified.

route-map

Defines the conditions for redistributing routes from one routing protocol into another.

set metric

Specifies the metric value in the destination routing protocol for a route map.

match invalid-recipients

To configure a match condition on the ESMTP invalid recipient address, use the match invalid-recipients command in policy-map configuration mode. To disable this feature, use the no form of this command.

match [not] invalid-recipients count gt number

no match [not] invalid-recipients count gt number

 
Syntax Description

count gt number

Specifies to match on the invalid recipient number.

 
Defaults

No default behavior or values.

 
Command Modes

The following table shows the modes in which you can enter the command:

 

Command Mode
Firewall Mode
Security Context
Routed
Transparent
Single
Multiple
Context
System

Policy map configuration

  •  
  •  
  •  
  •  

 
Command History

Release
Modification

7.2(1)

This command was introduced.

Examples

The following example shows how to configure a match condition for invalid recipients count in an ESMTP inspection policy map:

ciscoasa(config)# policy-map type inspect esmtp esmtp_map

ciscoasa(config-pmap)# match invalid-recipients count gt 1000

 

 
Related Commands

Command
Description

class-map

Creates a Layer 3/4 class map.

clear configure class-map

Removes all class maps.

match any

Includes all traffic in the class map.

match port

Identifies a specific port number in a class map.

show running-config class-map

Displays the information about the class map configuration.

match ip address

To redistribute any routes that have a route address or match packet that is passed by one of the access lists specified, use the match ip address command in route-map configuration mode. To restore the default settings, use the no form of this command.

match ip address { acl... } prefix-list

no match ip address { acl... } prefix-list

 
Syntax Description

acl

Specifies the name of an access list. Multiple access lists can be specified.

prefix-list

Specifies the name of a match prefix list.

 
Defaults

No default behavior or values.

 
Command Modes

The following table shows the modes in which you can enter the command:

 

Command Mode
Firewall Mode
Security Context
Routed
Transparent
Single
Multiple
Context
System

Route-map configuration

  •  

  •  

 
Command History

Release
Modification

7.0(1)

This command was introduced.

9.0(1)

Multiple context mode is supported.

 
Usage Guidelines

The route-map global configuration command and the match and set configuration commands allow you to define the conditions for redistributing routes from one routing protocol into another. Each route-map command has match and set commands that are associated with it. The match commands specify the match criteria—the conditions under which redistribution is allowed for the current route-map command. The set commands specify the set actions—the particular redistribution actions to perform if the criteria that is enforced by the match commands are met. The no route-map command deletes the route map.

Examples

The following example shows how to redistribute internal routes:

ciscoasa(config)# route-map name
ciscoasa(config-route-map)# match ip address acl_dmz1 acl_dmz2
 

 
Related Commands

Command
Description

match interface

Distributes any routes that have their next hop out one of the interfaces specified,

match ip next-hop

Distributes any routes that have a next-hop router address that is passed by one of the access lists specified.

match ipv6 address

Distributes any routes that have an IPv6 route address or match packet that is passed by one of the access lists specified.

match metric

Redistributes routes with the metric specified.

route-map

Defines the conditions for redistributing routes from one routing protocol into another.

set metric

Specifies the metric value in the destination routing protocol for a route map.

match ipv6 address

To redistribute any routes that have an IPv6 route address or match packet that is passed by one of the access lists specified, use the match ipv6 address command in route-map configuration mode. To restore the default settings, use the no form of this command.

match ipv6 address { acl... } prefix-list

no match ipv6 address { acl... } prefix-list

 
Syntax Description

acl

Specifies the name of an access list. Multiple access lists can be specified.

prefix-list

Specifies the name of a match prefix list.

 
Defaults

No default behavior or values.

 
Command Modes

The following table shows the modes in which you can enter the command:

 

Command Mode
Firewall Mode
Security Context
Routed
Transparent
Single
Multiple
Context
System

Route-map configuration

  •  

  •  

 
Command History

Release
Modification

9.1(2)

This command was introduced.

 
Usage Guidelines

The route-map global configuration command and the match and set configuration commands allow you to define the conditions for redistributing routes from one routing protocol into another. Each route-map command has match and set commands that are associated with it. The match commands specify the match criteria—the conditions under which redistribution is allowed for the current route-map command. The set commands specify the set actions—the particular redistribution actions to perform if the criteria that is enforced by the match commands are met. The no route-map command deletes the route map.

Examples

The following example shows how to redistribute internal routes: access-list acl_dmz1 extended permit ipv6 any <net> <mask>

hostname(config)# access-list acl_dmz1 extended permit ipv6 any <net> <mask>
ciscoasa(config)# route-map name
ciscoasa(config-route-map)# match ipv6 address acl_dmz1 acl_dmz2
 

 
Related Commands

Command
Description

match interface

Distributes any routes that have their next hop out one of the interfaces specified,

match ip address

Distributes any routes that have a route address or match packet that is passed by one of the access lists specified.

match ip next-hop

Distributes any routes that have a next-hop router address that is passed by one of the access lists specified.

match metric

Redistributes routes with the metric specified.

route-map

Defines the conditions for redistributing routes from one routing protocol into another.

set metric

Specifies the metric value in the destination routing protocol for a route map.

match ip next-hop

To redistribute any routes that have a next-hop router address that is passed by one of the access lists specified, use the match ip next-hop command in route-map configuration mode. To remove the next-hop entry, use the no form of this command.

match ip next-hop { acl... } | prefix-list prefix_list

no match ip next-hop { acl... } | prefix-list prefix_list

 
Syntax Description

acl

Name of an ACL. Multiple ACLs can be specified.

prefix-list prefix_list

Name of prefix list.

 
Defaults

Routes are distributed freely, without being required to match a next-hop address.

 
Command Modes

The following table shows the modes in which you can enter the command:

 

Command Mode
Firewall Mode
Security Context
Routed
Transparent
Single
Multiple
Context
System

Route-map configuration

  •  

  •  

 
Command History

Release
Modification

7.0(1)

This command was introduced.

9.0(1)

Multiple context mode is supported.

 
Usage Guidelines

An ellipsis (...) in the command syntax indicates that your command input can include multiple values for the acl argument.

The route-map global configuration command and the match and set configuration commands allow you to define the conditions for redistributing routes from one routing protocol into another. Each route-map command has match and set commands that are associated with it. The match commands specify the match criteria—the conditions under which redistribution is allowed for the current route-map command. The set commands specify the set actions—the particular redistribution actions to perform if the criteria that is enforced by the match commands are met. The no route-map command deletes the route map.

The match route-map configuration command has multiple formats. You can enter the match commands in any order. All match commands must “pass” to cause the route to be redistributed according to the set actions given with the set commands. The no forms of the match commands remove the specified match criteria.

When you are passing routes through a route map, a route map can have several parts. Any route that does not match at least one match clause relating to a route-map command is ignored. To modify only some data, you must configure a second route map section and specify an explicit match.

Examples

The following example shows how to distribute routes that have a next-hop router address passed by access list acl_dmz1 or acl_dmz2:

ciscoasa(config)# route-map name
ciscoasa(config-route-map)# match ip next-hop acl_dmz1 acl_dmz2
 

 
Related Commands

Command
Description

match interface

Distributes distribute any routes that have their next hop out one of the interfaces specified.

match ip next-hop

Distributes any routes that have a next-hop router address that is passed by one of the access lists specified.

match metric

Redistributes routes with the metric specified.

route-map

Defines the conditions for redistributing routes from one routing protocol into another.

set metric

Specifies the metric value in the destination routing protocol for a route map.

match ip route-source

To redistribute routes that have been advertised by routers and access servers at the address that is specified by the ACLs, use the match ip route-source command in the route-map configuration mode. To remove the next-hop entry, use the no form of this command.

match ip route-source { acl... } | prefix-list prefix_list

no match ip route-source { acl... }

 
Syntax Description

acl

Name of an ACL. Multiple ACLs can be specified.

prefix_list

Name of prefix list.

 
Defaults

No filtering on a route source.

 
Command Modes

The following table shows the modes in which you can enter the command:

 

Command Mode
Firewall Mode
Security Context
Routed
Transparent
Single
Multiple
Context
System

Route-map configuration

  •  

  •  

 
Command History

Release
Modification

7.0(1)

This command was introduced.

9.0(1)

Multiple context mode is supported.

 
Usage Guidelines

An ellipsis (...) in the command syntax indicates that your command input can include multiple values for the access-list-name argument.

The route-map global configuration command and the match and set configuration commands allow you to define the conditions for redistributing routes from one routing protocol into another. Each route-map command has match and set commands that are associated with it. The match commands specify the match criteria—the conditions under which redistribution is allowed for the current route-map command. The set commands specify the set actions—the particular redistribution actions to perform if the criteria that is enforced by the match commands are met. The no route-map command deletes the route map.

The match route-map configuration command has multiple formats. You can enter the match commands in any order. All match commands must “pass” to cause the route to be redistributed according to the set actions given with the set commands. The no forms of the match commands remove the specified match criteria.

A route map can have several parts. Any route that does not match at least one match clause relating to a route-map command is ignored. To modify only some data, you must configure a second route map section and specify an explicit match. The next-hop and source-router address of the route are not the same in some situations.

Examples

The following example shows how to distribute routes that have been advertised by routers and access servers at the addresses specified by ACLs acl_dmz1 and acl_dmz2:

ciscoasa(config)# route-map name
ciscoasa(config-route-map)# match ip route-source acl_dmz1 acl_dmz2
 

 
Related Commands

Command
Description

match interface

Distributes distribute any routes that have their next hop out one of the interfaces specified.

match ip next-hop

Distributes any routes that have a next-hop router address that is passed by one of the ACLs specified.

match metric

Redistributes routes with the metric specified.

route-map

Defines the conditions for redistributing routes from one routing protocol into another.

set metric

Specifies the metric value in the destination routing protocol for a route map.

match login-name

To configure a match condition for a client login name for instant messaging, use the match login-name command in class-map or policy-map configuration mode. To remove the match condition, use the no form of this command.

match [not] login-name regex [regex_name | class regex_class_name]

no match [not] login-name regex [regex_name | class regex_class_name]

 
Syntax Description

regex_name

Specifies a regular expression.

class regex_class_name

Specifies a regular expression class map.

 
Defaults

No default behavior or values.

 
Command Modes

The following table shows the modes in which you can enter the command:

 

Command Mode
Firewall Mode
Security Context
Routed
Transparent
Single
Multiple
Context
System

Class-map or policy map configuration

  •  
  •  
  •  
  •  

 
Command History

Release
Modification

7.2(1)

This command was introduced.

 
Usage Guidelines

This command can be configured in an IM class map or policy map. Only one entry can be entered in a IM class map.

Examples

The following example shows how to configure a match condition for a client login name in an instant messaging class map:

ciscoasa(config)# class-map type inspect im im_class
ciscoasa(config-cmap)# match login-name regex login
 

 
Related Commands

Command
Description

class-map

Creates a Layer 3/4 class map.

clear configure class-map

Removes all class maps.

match any

Includes all traffic in the class map.

show running-config class-map

Displays the information about the class map configuration.

match media-type

To configure a match condition on the H.323 media type, use the match media-type command in policy-map configuration mode. To disable this feature, use the no form of this command.

match [not] media-type [audio | data | video]

no match [not] media-type [audio | data | video]

 
Syntax Description

audio

Specifies to match audio media type.

data

Specifies to match data media type.

video

Specifies to match video media type.

 
Defaults

No default behavior or values.

 
Command Modes

The following table shows the modes in which you can enter the command:

 

Command Mode
Firewall Mode
Security Context
Routed
Transparent
Single
Multiple
Context
System

Policy map configuration

  •  
  •  
  •  
  •  

 
Command History

Release
Modification

7.2(1)

This command was introduced.

Examples

The following example shows how to configure a match condition for audio media type in an H.323 inspection class map:

ciscoasa(config-cmap)# match media-type audio
 

 
Related Commands

Command
Description

class-map

Creates a Layer 3/4 class map.

clear configure class-map

Removes all class maps.

match any

Includes all traffic in the class map.

match port

Identifies a specific port number in a class map.

show running-config class-map

Displays the information about the class map configuration.

match message id

To configure a match condition for a GTP message ID, use the match message id command in class-map or policy-map configuration mode. To remove the match condition, use the no form of this command.

match [not] message id [message_id | range lower_range upper_range]

no match [not] message id [message_id | range lower_range upper_range]

 
Syntax Description

message_id

Specifies an alphanumeric identifier between 1 and 255.

range lower_range upper_range

Specifies a lower and upper range of IDs.

 
Defaults

No default behavior or values.

 
Command Modes

The following table shows the modes in which you can enter the command:

 

Command Mode
Firewall Mode
Security Context
Routed
Transparent
Single
Multiple
Context
System

Class-map or policy map configuration

  •  
  •  
  •  
  •  

 
Command History

Release
Modification

7.2(1)

This command was introduced.

 
Usage Guidelines

This command can be configured in a GTP class map or policy map. Only one entry can be entered in a GTP class map.

Examples

The following example shows how to configure a match condition for a message ID in a GTP inspection class map:

ciscoasa(config-cmap)# match message id 33
 

 
Related Commands

Command
Description

class-map

Creates a Layer 3/4 class map.

clear configure class-map

Removes all class maps.

match any

Includes all traffic in the class map.

match port

Identifies a specific port number in a class map.

show running-config class-map

Displays the information about the class map configuration.

match message length

To configure a match condition for a GTP message ID, use the match message length command in class-map or policy-map configuration mode. To remove the match condition, use the no form of this command.

match [not] message length min min_length max max_length

no match [not] message length min min_length max max_length

 
Syntax Description

min min_length

Specifies a minimum message ID length. Value is between 1 and 65536.

max max_length

Specifies a maximum message ID length. Value is between 1 and 65536.

 
Defaults

No default behavior or values.

 
Command Modes

The following table shows the modes in which you can enter the command:

 

Command Mode
Firewall Mode
Security Context
Routed
Transparent
Single
Multiple
Context
System

Class-map or policy map configuration

  •  
  •  
  •  
  •  

 
Command History

Release
Modification

7.2(1)

This command was introduced.

 
Usage Guidelines

This command can be configured in a GTP class map or policy map. Only one entry can be entered in a GTP class map.

Examples

The following example shows how to configure a match condition for a message length in a GTP inspection class map:

ciscoasa(config-cmap)# match message length min 8 max 200
 

 
Related Commands

Command
Description

class-map

Creates a Layer 3/4 class map.

clear configure class-map

Removes all class maps.

match any

Includes all traffic in the class map.

match port

Identifies a specific port number in a class map.

show running-config class-map

Displays the information about the class map configuration.

match message-path

To configure a match condition for the path taken by a SIP message as specified in the Via header field, use the match message-path command in class-map or policy-map configuration mode. To remove the match condtion, use the no form of this command.

match [not] message-path regex [regex_name | class regex_class_name]

no match [not] message-path regex [regex_name | class regex_class_name]

 
Syntax Description

regex_name

Specifies a regular expression.

class regex_class_name

Specifies a regular expression class map.

 
Defaults

No default behavior or values.

 
Command Modes

The following table shows the modes in which you can enter the command:

 

Command Mode
Firewall Mode
Security Context
Routed
Transparent
Single
Multiple
Context
System

Class-map or policy map configuration

  •  
  •  
  •  
  •  

 
Command History

Release
Modification

7.2(1)

This command was introduced.

 
Usage Guidelines

This command can be configured in a SIP class map or policy map. Only one entry can be entered in a SIP class map.

Examples

The following example shows how to configure a match condition for the path taken by a SIP message in a SIP inspection class map:

ciscoasa(config-cmap)# match message-path regex class sip_message
 

 
Related Commands

Command
Description

class-map

Creates a Layer 3/4 class map.

clear configure class-map

Removes all class maps.

match any

Includes all traffic in the class map.

match port

Identifies a specific port number in a class map.

show running-config class-map

Displays the information about the class map configuration.

match metric

To redistribute routes with the metric specified, use the match metric command in route-map configuration mode. To remove the entry, use the no form of this command.

match metric number

no match metric number

 
Syntax Description

number

Route metric, which can be an IGRP five-part metric; valid values are from 0 to 4294967295.

 
Defaults

No filtering on a metric value.

 
Command Modes

The following table shows the modes in which you can enter the command:

 

Command Mode
Firewall Mode
Security Context
Routed
Transparent
Single
Multiple
Context
System

Route-map configuration

  •  

  •  

 
Command History

Release
Modification

7.0(1)

This command was introduced.

9.0(1)

Multiple context mode is supported.

 
Usage Guidelines

The route-map global configuration command and the match and set configuration commands allow you to define the conditions for redistributing routes from one routing protocol into another. Each route-map command has match and set commands that are associated with it. The match commands specify the match criteria—the conditions under which redistribution is allowed for the current route-map command. The set commands specify the set actions—the particular redistribution actions to perform if the criteria that is enforced by the match commands are met. The no route-map command deletes the route map.

The match route-map configuration command has multiple formats. The match commands can be given in any order, and all match commands must “pass” to cause the route to be redistributed according to the set actions given with the set commands. The no forms of the match commands remove the specified match criteria.

A route map can have several parts. Any route that does not match at least one match clause relating to a route-map command is ignored. To modify only some data, you must configure a second route map section and specify an explicit match.

Examples

The following example shows how to redistribute routes with the metric 5:

ciscoasa(config)# route-map name
ciscoasa(config-route-map)# match metric 5
 

 
Related Commands

Command
Description

match interface

Distributes distribute any routes that have their next hop out one of the interfaces specified,

match ip next-hop

Distributes any routes that have a next-hop router address that is passed by one of the access lists specified.

route-map

Defines the conditions for redistributing routes from one routing protocol into another.

set metric

Specifies the metric value in the destination routing protocol for a route map.

match mime

To configure a match condition on the ESMTP mime encoding type, mime filename length, or mime file type, use the match mime command in policy-map configuration mode. To disable this feature, use the no form of this command.

match [not] mime [encoding type | filename length gt bytes | filetype regex]

no match [not] mime [encoding type | filename length gt bytes | filetype regex]

 
Syntax Description

encoding type

Specifies to match on the encoding type.

filename length gt bytes

Specifies to match on the filename length.

filetype regex

Specifies to match on the file type.

 
Defaults

No default behavior or values.

 
Command Modes

The following table shows the modes in which you can enter the command:

 

Command Mode
Firewall Mode
Security Context
Routed
Transparent
Single
Multiple
Context
System

Policy map configuration

  •  
  •  
  •  
  •  

 
Command History

Release
Modification

7.2(1)

This command was introduced.

Examples

The following example shows how to configure a match condition for a mime filename length in an ESMTP inspection policy map:

ciscoasa(config)# policy-map type inspect esmtp esmtp_map

ciscoasa(config-pmap)# match mime filename length gt 255

 

 
Related Commands

Command
Description

class-map

Creates a Layer 3/4 class map.

clear configure class-map

Removes all class maps.

match any

Includes all traffic in the class map.

match port

Identifies a specific port number in a class map.

show running-config class-map

Displays the information about the class map configuration.

match peer-ip-address

To configure a match condition for the peer IP address for instant messaging, use the match peer-ip-address command in class-map or policy-map configuration mode. To remove the match condition, use the no form of this command.

match [not] peer-ip-address ip_address ip_address_mask

no match [not] peer-ip-address ip_address ip_address_mask

 
Syntax Description

ip_address

Specifies a hostname or IP address of the client or server.

ip_address_mask

Specifies the netmask for the client or server IP address.

 
Defaults

No default behavior or values.

 
Command Modes

The following table shows the modes in which you can enter the command:

 

Command Mode
Firewall Mode
Security Context
Routed
Transparent
Single
Multiple
Context
System

Class-map or policy map configuration

  •  
  •  
  •  
  •  

 
Command History

Release
Modification

7.2(1)

This command was introduced.

 
Usage Guidelines

This command can be configured in an IM class map or policy map. Only one entry can be entered in a IM class map.

Examples

The following example shows how to configure a match condition for the peer IP address in an instant messaging class map:

ciscoasa(config)# class-map type inspect im im_class
ciscoasa(config-cmap)# match peer-ip-address 10.1.1.0 255.255.255.0
 

 
Related Commands

Command
Description

class-map

Creates a Layer 3/4 class map.

clear configure class-map

Removes all class maps.

match any

Includes all traffic in the class map.

show running-config class-map

Displays the information about the class map configuration.

match peer-login-name

To configure a match condition for the peer login name for instant messaging, use the match peer-login-name command in class-map or policy-map configuration mode. To remove the match condition, use the no form of this command.

match [not] peer-login-name regex [regex_name | class regex_class_name]

no match [not] peer-login-name regex [regex_name | class regex_class_name]

 
Syntax Description

regex_name

Specifies a regular expression.

class regex_class_name

Specifies a regular expression class map.

 
Defaults

No default behavior or values.

 
Command Modes

The following table shows the modes in which you can enter the command:

 

Command Mode
Firewall Mode
Security Context
Routed
Transparent
Single
Multiple
Context
System

Class-map or policy map configuration

  •  
  •  
  •  
  •  

 
Command History

Release
Modification

7.2(1)

This command was introduced.

 
Usage Guidelines

This command can be configured in an IM class map or policy map. Only one entry can be entered in a IM class map.

Examples

The following example shows how to configure a match condition for the peer login name in an instant messaging class map:

ciscoasa(config)# class-map type inspect im im_class
ciscoasa(config-cmap)# match peer-login-name regex peerlogin
 

 
Related Commands

Command
Description

class-map

Creates a Layer 3/4 class map.

clear configure class-map

Removes all class maps.

match any

Includes all traffic in the class map.

show running-config class-map

Displays the information about the class map configuration.

match port

When using the Modular Policy Framework, match the TCP or UDP ports to which you want to apply actions by using the match port command in class-map configuration mode. To remove the match port command, use the no form of this command.

match port { tcp | udp } { eq port | range beg_port end_port }

no match port { tcp | udp } { eq port | range beg_port end_port }

 
Syntax Description

eq port

Specifies a single port name or number.

range beg_port end_port

Specifies beginning and ending port range values between 1 and 65535.

tcp

Specifies a TCP port.

udp

Specifies a UDP port.

 
Defaults

No default behavior or values.

 
Command Modes

The following table shows the modes in which you can enter the command:

 

Command Mode
Firewall Mode
Security Context
Routed
Transparent
Single
Multiple
Context
System

Class-map configuration

  •  
  •  
  •  
  •  

 
Command History

Release
Modification

7.0(1)

This command was introduced.

 
Usage Guidelines

Configuring Modular Policy Framework consists of four tasks:

1. Identify the Layer 3 and 4 traffic to which you want to apply actions using the class-map or class-map type management command.

After you enter the class-map command, you can enter the matchport command to identify the traffic. Alternatively, you can enter a different type of match command, such as the match access-list command (the class-map type management command only allows the match port command). You can only include one match port command in the class map, and you cannot combine it with other types of match commands.

2. (Application inspection only) Define special actions for application inspection traffic using the policy-map type inspect command.

3. Apply actions to the Layer 3 and 4 traffic using the policy-map command.

4. Activate the actions on an interface using the service-policy command.

Examples

The following example shows how to define a traffic class using a class map and the match port command:

ciscoasa(config)# class-map cmap
ciscoasa(config-cmap)# match port tcp eq 8080
 

 
Related Commands

Command
Description

class-map

Creates a Layer 3/4 class map.

clear configure class-map

Removes all class maps.

match access-list

Matches traffic according to an access list.

match any

Includes all traffic in the class map.

show running-config class-map

Displays the information about the class map configuration.

match precedence

To specify a precedence value in a class map, use the match precedence command in class-map configuration mode. To remove this specification, use the no form of this command.

match precedence value

no match precedence value

 
Syntax Description

value

Specifies up to four precedence values separated by a space. Range is 0 to 7.

 
Defaults

No default behavior or values.

 
Command Modes

The following table shows the modes in which you can enter the command:

 

Command Mode
Firewall Mode
Security Context
Routed
Transparent
Single
Multiple
Context
System

Class-map configuration

  •  
  •  
  •  
  •  

 
Command History

Release
Modification

7.0(1)

This command was introduced.

 
Usage Guidelines

The match commands are used to identify the traffic included in the traffic class for a class map. They include different criteria to define the traffic included in a class-map. Define a traffic class using the class-map global configuration command as part of configuring a security feature using Modular Policy Framework. From class-map configuration mode, you can define the traffic to include in the class using the match command.

After a traffic class is applied to an interface, packets received on that interface are compared to the criteria defined by the match statements in the class map. If the packet matches the specified criteria, it is included in the traffic class and is subjected to any actions associated with that traffic class. Packets that do not match any of the criteria in any traffic class are assigned to the default traffic class.

Use the match precedence command to specify the value represented by the TOS byte in the IP header.

Examples

The following example shows how to define a traffic class using a class map and the match precedence command:

ciscoasa(config)# class-map cmap
ciscoasa(config-cmap)# match precedence 1
ciscoasa(config-cmap)#
 

 
Related Commands

Command
Description

class-map

Applies a traffic class to an interface.

clear configure class-map

Removes all of the traffic map definitions.

match access-list

Identifies access list traffic within a class map.

match any

Includes all traffic in the class map.

show running-config class-map

Displays the information about the class map configuration.

match protocol

To configure a match condition for a specific instant messaging protocol, such as MSN or Yahoo, use the match protocol command in class-map or policy-map configuration mode. To remove the match condition, use the no form of this command.

match [not] protocol {msn-im | yahoo-im}

no match [not] protocol {msn-im | yahoo-im}

 
Syntax Description

msn-im

Specifies to match the MSN instant messaging protocol.

yahoo-im

Specifies to match the Yahoo instant messaging protocol.

 
Defaults

No default behavior or values.

 
Command Modes

The following table shows the modes in which you can enter the command:

 

Command Mode
Firewall Mode
Security Context
Routed
Transparent
Single
Multiple
Context
System

Class-map or policy map configuration

  •  
  •  
  •  
  •  

 
Command History

Release
Modification

7.2(1)

This command was introduced.

 
Usage Guidelines

This command can be configured in an IM class map or policy map. Only one entry can be entered in a IM class map.

Examples

The following example shows how to configure a match condition for the Yahoo instant messaging protocol in an instant messaging class map:

ciscoasa(config)# class-map type inspect im im_class
ciscoasa(config-cmap)# match protocol yahoo-im
 

 
Related Commands

Command
Description

class-map

Creates a Layer 3/4 class map.

clear configure class-map

Removes all class maps.

match any

Includes all traffic in the class map.

show running-config class-map

Displays the information about the class map configuration.

match question

To configure a match condition for a DNS question or resource record, use the match question command in class-map or policy-map configuration mode. To remove a configured section, use the no form of this command.

match {question | {resource-record answer | authority | additional}}

no match {question | {resource-record answer | authority | additional}}

 
Syntax Description

question

Specifies the question portion of a DNS message.

resource-record

Specifies the resource record portion of a DNS message.

answer

Specifies the Answer RR section.

authority

Specifies the Authority RR section.

additional

Specifies the Additional RR section.

 
Defaults

This command is disabled by default.

 
Command Modes

The following table shows the modes in which you can enter the command:

 

Command Mode
Firewall Mode
Security Context
Routed
Transparent
Single
Multiple
Context
System

Class-map or policy map configuration

  •  
  •  
  •  
  •  

 
Command History

Release
Modification

7.2(1)

This command was introduced.

 
Usage Guidelines

By default, this command inspects the DNS header and matches the specified field. It can be used in conjunction with other DNS match commands to define inspection of a particular question or RR type..

This command can be configured within a DNS class map or policy map. Only one entry can be entered within a DNS class-map.

Examples

The following example shows how to configure a match condition for a DNS question in a DNS inspection policy map:

ciscoasa(config)# policy-map type inspect dns preset_dns_map
ciscoasa(config-pmap)# match question
 

 
Related Commands

Command
Description

class-map

Creates a Layer 3/4 class map.

clear configure class-map

Removes all class maps.

match any

Includes all traffic in the class map.

match port

Identifies a specific port number in a class map.

show running-config class-map

Displays the information about the class map configuration.