Ok so in a prior blog entry, I gave you my yahoo messenger ID and said you could communicate with me in real-time. I thought it only appropriate to also so you how you could deny IM traffic on the ASA without using a CSC module, IronPort Appliance or any other filtering software/tool. This functionality in natively built into the ASA since 7.2 code and it uses what is termed “deep packet inspection.” This deep packet inspection is configured on the ASA using the Modular Policy Framework (MPF). Now before we dive into the configuration aspects of this deep packet inspection, I think it’s appropriate for us to get some background information on the MPF because there has been some recent (& drastic) changes to the traditional configuration model of MPF.

The ASA’s MPF is based on the IOS MQC (Module QoS CLI) feature, which is the IOS command set to configure QoS. It provides you with the ability to define a unique policy to classify or police traffic on the ASA and these policies can be applied as needed to perform security actions on the ASA. You can configure the following features using MPF.

• TCP normalization, connection limits and timeouts
• QoS policing
• QoS priority queue
• Application inspection
• IPS inspection policy
• CSC inspection policy

1. Create a class-map – This identifies the traffic to which you want to apply actions.
2. Create a policy-map - Apply actions to the traffic.
3. Create a service-policy - Activate the actions on an interface or at a global level.

Traditionally this allowed you to configure a layer 3 or 4 policy on the appliance where your class map could match upon things like an ACL, Port, DSCP, Flow ect; however with ASA 7.2 code a new structure of the MPF was released. This structure allows you to now configure a Layer 7 policy on the ASA and it uses the new “class-map type” command:

ciscoasa(config)# class-map type ?
configure mode commands/options:
inspect Configure a class-map of type inspect
management Configure a class-map of type Management
regex Configure a class-map of type REGEX
ciscoasa(config)# class-map type

This new structure gives you tremendous control of the traffic policy that traverses your firewall because you able to specify match criteria for example that:

• Permits or denies traffic to a certain website
• Permits or denies files extensions from traversing the firewall
• Ensure HTTP protocol conformance

Also introduced was a new policy-map whereby you embedded the layer 7 class map into the layer 7 policy map:

ciscoasa(config)# policy-map type ?
configure mode commands/options:
inspect Configure a policy-map of type inspect
ciscoasa(config)# policy-map type

With that in mind (there is a lot more to it but that is all we need to configure our IM policy) we are ready to start the configuration of the ASA to deny our IM traffic. First this thing we do is to open the ASDM and connect to the ASA in which you would like to implement this policy on, In my example I will be using ASDM version 6.0. We need to click on Configuration at the top of the screen then select Firewall -> Objects -> Class Maps -> Instant Messaging as shown below:

Next you will need to select “Add” from the upper right corner of the screen in order to setup the Layer 7 class map.

A new window will open. At the top of the window you need to define a name for your class map. In my case I named mine “Yahoo-Class” because I will be setting a policy that denies Yahoo Messenger traffic. I then define the description for the class map and define whether I want to “match-all” or “match-any.” In my case I define a match-all policy. After that I click on the “add” button located to the right of the screen to add the class map match criteria. Upon clicking add I am presented with a new screen as shown below:

As you can see I select my criteria as protocol and then click the “Yahoo Messenger” protocol. The ASA provides you a plethora of other choices however to define your match criteria by. These other choices are shown below:

So if you in fact want to match upon a certain service, like denying chat or file transfer, you can select “service” from the drop down menu and you are given the choice of selecting the services you want to permit or deny as shown below:

In my case I simply select protocol and yahoo messenger, after defining this criteria, I select “OK” and I am taken back to the class map screen: