Step 1

(Optional) Create a DCERPC inspection class map.

1. Create the class map: class-map type inspect dcerpc [match-all | match-any] class_map_name

   Where class_map_name is the name of the class map. The match-all keyword is the default, and specifies that traffic must match all criteria to match the class map. The match-any keyword specifies that the traffic matches the class map if it matches at least one match statement. The CLI enters class-map configuration mode.

2. Specify the traffic on which you want to perform actions using the following match command. If you use a match not command, then any traffic that does not match the criterion in the match not command has the action applied.

   • match [not] uuid type —Matches the universally unique identifier (UUID) of the DCERPC message. The type can be one of the following:

     • ms-rpc-epm —Matches Microsoft RPC EPM messages.

     • ms-rpc-isystemactivator —Matches ISystemMapper messages.

     • ms-rpc-oxidresolver —Matches OxidResolver messages.

3. Enter exit to leave class map configuration mode.

Step 2

Create a DCERPC inspection policy map: policy-map type inspect dcerpc policy_map_name

Step 3

(Optional) Add a description to the policy map: description string

Step 4

To apply actions to matching traffic, perform the following steps.

1. Specify the traffic on which you want to perform actions using one of the following methods:

   • If you created a DCERPC class map, specify it by entering the following command: class class_map_name

   • Specify traffic directly in the policy map using one of the match commands described for DCERPC class maps. If you use a match not command, then any traffic that does not match the criterion in the match not command has the action applied.

2. Specify the action you want to perform on the matching traffic by entering one of the following commands:

   • reset [log] —Drop the packet, close the connection, and send a TCP reset to the server or client.

   • log —Send a system log message. You can use this option alone or with one of the other actions.

   You can specify multiple class or match commands in the policy map.

   Example:

   
   hostname(config)# policy-map type inspect dcerpc dcerpc-map
   hostname(config-pmap)# match uuid ms-rpc-epm
   hostname(config-pmap-c)# log
   
   

Step 5

To configure parameters that affect the inspection engine, perform the following steps:

1. Enter parameters configuration mode:

   
   hostname(config-pmap)# parameters
   hostname(config-pmap-p)#
   
   

2. Set one or more parameters. You can set the following options; use the no form of the command to disable the option:

   • timeout pinhole hh:mm:ss—Configures the timeout for DCERPC pinholes and override the global system pinhole timeout of two minutes. The timeout can be from 00:00:01 to 119:00:00.

   • endpoint-mapper [epm-service-only] [lookup-operation [timeout hh:mm:ss]]—Configures options for the endpoint mapper traffic. The epm-service-only keyword enforces endpoint mapper service during binding so that only its service traffic is processed. The lookup-operation keyword enables the lookup operation of the endpoint mapper service. You can configure the timeout for pinholes generated from the lookup operation. If no timeout is configured for the lookup operation, the timeout pinhole command or the default is used.

Step 1

(Optional) Create a DNS inspection class map by performing the following steps.

1. Create the class map: class-map type inspect dns [match-all | match-any] class_map_name

   Where class_map_name is the name of the class map. The match-all keyword is the default, and specifies that traffic must match all criteria to match the class map. The match-any keyword specifies that the traffic matches the class map if it matches at least one match statement. The CLI enters class-map configuration mode, where you can enter one or more match commands.

2. (Optional) Add a description to the class map: description string

   Where string is the description of the class map (up to 200 characters).

3. Specify the traffic on which you want to perform actions using one of the following match commands. If you use a match not command, then any traffic that does not match the criterion in the match not command has the action applied.

   • match [not] header-flag [eq] {f_name [f_name...] | f_value}—Matches the DNS flag. The f_name argument is the DNS flag name, one of the following: AA (Authoritative Answer), QR (Query), RA (Recursion Available), RD (Recursion Desired), TC (Truncation). The f_value argument is the 16-bit value in hex starting with 0x, from 0x0 to 0xffff. The eq keyword specifies an exact match (match all); without the eq keyword, the packet only needs to match one of the specified headers (match any). For example, match header-flag AA QR.

   • match [not] dns-type {eq {t_name | t_value} | range t_value1 t_value2}—Matches the DNS type. The t_name argument is the DNS type name, one of the following: A (IPv4 address), AXFR (full zone transfer), CNAME (canonical name), IXFR (incremental zone transfer), NS (authoritative name server), SOA (start of a zone of authority) or TSIG (transaction signature). The t_value arguments are arbitrary values in the DNS type field (0-65535). The range keyword specifies a range, and the eq keyword specifies an exact match. For example: match dns-type eq A.

   • match [not] dns-class {eq {in | c_value} | range c_value1 c_value2}—Matches the DNS class. The class is either in (for Internet) or c_value, an arbitrary value from 0 to 65535 in the DNS class field. The range keyword specifies a range, and the eq keyword specifies an exact match. For example: match dns-class eq in.

   • match [not] {question | resource-record {answer | authority | additional}}—Matches a DNS question or resource record. The question keyword specifies the question portion of a DNS message. The resource-record keyword specifies one of these sections of the resource record: answer, authority, or additional. For example: match resource-record answer.

   • match [not] domain-name regex {regex_name | class class_name}—Matches the DNS message domain name list against the specified regular expression or regular expression class.

4. Enter exit to leave class map configuration mode.

Step 2

Create a DNS inspection policy map: policy-map type inspect dns policy_map_name

Step 3

(Optional) Add a description to the policy map: description string

Step 4

To apply actions to matching traffic, perform the following steps.

1. Specify the traffic on which you want to perform actions using one of the following methods:

   • If you created a DNS class map, specify it by entering the following command: class class_map_name

   • Specify traffic directly in the policy map using one of the match commands described for DNS class maps. If you use a match not command, then any traffic that does not match the criterion in the match not command has the action applied.

2. Specify the action you want to perform on the matching traffic by entering one of the following commands:

   • drop [log] —Drop all packets that match.

   • drop-connection [log] —Drop the packet and close the connection.

   • mask [log] —Mask out the matching portion of the packet. This action is available for header flag matches only.

   • log —Send a system log message. You can use this option alone or with one of the other actions.

   • enforce-tsig [drop] [log] —Enforce the presence of the TSIG resource record in a message. You can drop a packet without the TSIG resource record, log it, or drop and log it. You can use this option in conjunction with the mask action for header flag matches; otherwise, this action is exclusive with the other actions.

   You can specify multiple class or match commands in the policy map. For information about the order of class and match commands, see How Multiple Traffic Classes are Handled.

   Example:

   
   hostname(config)# policy-map type inspect dns dns-map
   hostname(config-pmap)# class dns-class-map
   hostname(config-pmap-c)# drop
   hostname(config-pmap-c)# match header-flag eq aa
   hostname(config-pmap-c)# drop log
   
   

Step 5

To configure parameters that affect the inspection engine, perform the following steps:

1. Enter parameters configuration mode.

   
   hostname(config-pmap)# parameters
   hostname(config-pmap-p)#
   
   

2. Set one or more parameters. You can set the following options; use the no form of the command to disable the option.

   • dnscrypt —Enables DNScrypt to encrypt connections between the device and Cisco Umbrella. Enabling DNScrypt starts the key-exchange thread with the Umbrella resolver. The key-exchange thread performs the handshake with the resolver every hour and updates the device with a new secret key. Because DNScrypt uses UDP/443, you must ensure that the class map used for DNS inspection includes that port. Note that the default inspection class already includes UDP/443 for DNS inspection.

   • dns-guard—Enables DNS Guard. The ASA tears down the DNS session associated with a DNS query as soon as the DNS reply is forwarded by the ASA. The ASA also monitors the message exchange to ensure that the ID of the DNS reply matches the ID of the DNS query.

   • id-mismatch count number duration seconds action log—Enables logging for excessive DNS ID mismatches, where the count number duration seconds arguments specify the maximum number of mismatch instances per second before a system message log is sent.

   • id-randomization—Randomizes the DNS identifier for a DNS query.

   • message-length maximum {length | client {length | auto} | server {length | auto}}—Sets the maximum DNS message length, from 512 to 65535 bytes. You can also set the maximum length for client or server messages. The auto keyword sets the maximum length to the value in the Resource Record.

   • nat-rewrite—Translates the DNS record based on the NAT configuration.

   • protocol-enforcement —Enables DNS message format check, including domain name length of no more than 255 characters, label length of 63 characters, compression, and looped pointer check.

   • tcp-inspection —Enables inspection of DNS over TCP traffic. Ensure that DNS/TCP port 53 traffic is part of the class to which you apply DNS inspection. The inspection default class includes TCP/53.

   • tsig enforced action {[drop] [log]}—Requires a TSIG resource record to be present. You can drop a non-conforming packet, log the packet, or both.

   • umbrella [ tag umbrella_policy] [ fail-open] —Enables Cisco Umbrella and optionally specifies the name of the Cisco Umbrella policy (tag ) to apply to the device. If you do not specify a policy, the default policy is applied. For more information, see Cisco Umbrella.

     Include the fail-open keyword if you want DNS resolution to work if the Umbrella DNS server is unavailable. When failing open, if the Cisco Umbrella DNS server is unavailable, Umbrella disables itself on this policy map and allows DNS requests to go to the other DNS servers configured on the system, if any. When the Umbrella DNS servers are available again, the policy map resumes using them. If you do not include this option, DNS requests continue to go to the unreachable Umbrella resolver, so they will not get a response.

   Example:

   
   hostname(config-pmap)# parameters
   hostname(config-pmap-p)# dns-guard
   hostname(config-pmap-p)# message-length maximum 1024
   hostname(config-pmap-p)# nat-rewrite
   hostname(config-pmap-p)# protocol-enforcement
   
   

Step 1

(Optional) Create an FTP inspection class map by performing the following steps.

1. Create the class map: class-map type inspect ftp [match-all | match-any] class_map_name

   Where class_map_name is the name of the class map. The match-all keyword is the default, and specifies that traffic must match all criteria to match the class map. The match-any keyword specifies that the traffic matches the class map if it matches at least one match statement. The CLI enters class-map configuration mode, where you can enter one or more match commands.

2. (Optional) Add a description to the class map: description string

   Where string is the description of the class map (up to 200 characters).

3. Specify the traffic on which you want to perform actions using one of the following match commands. If you use a match not command, then any traffic that does not match the criterion in the match not command has the action applied.

   • match [not] filename regex {regex_name | class class_name}—Matches the filename in the FTP transfer against the specified regular expression or regular expression class.

   • match [not] filetype regex {regex_name | class class_name}—Matches the file type in the FTP transfer against the specified regular expression or regular expression class.

   • match [not] request-command ftp_command [ ftp_command...]—Matches the FTP command, one or more of the following:

     • APPE—Append to a file.

     • CDUP—Changes to the parent directory of the current working directory.

     • DELE—Delete a file on the server.

     • GET—Gets a file from the server.

     • HELP—Provides help information.

     • MKD—Makes a directory on the server.

     • PUT—Sends a file to the server.

     • RMD—Deletes a directory on the server.

     • RNFR—Specifies the “rename-from” filename.

     • RNTO—Specifies the “rename-to” filename.

     • SITE—Used to specify a server-specific command. This is usually used for remote administration.

     • STOU—Stores a file using a unique file name.

   • match [not] server regex {regex_name | class class_name}—Matches the FTP server name against the specified regular expression or regular expression class.

   • match [not] username regex {regex_name | class class_name}—Matches the FTP username against the specified regular expression or regular expression class.

4. Enter exit to leave class map configuration mode.

Step 2

Create an FTP inspection policy map: policy-map type inspect ftp policy_map_name

Step 3

(Optional) Add a description to the policy map: description string

Step 4

To apply actions to matching traffic, perform the following steps.

1. Specify the traffic on which you want to perform actions using one of the following methods:

   • If you created an FTP class map, specify it by entering the following command: class class_map_name

   • Specify traffic directly in the policy map using one of the match commands described for FTP class maps. If you use a match not command, then any traffic that does not match the criterion in the match not command has the action applied.

2. Specify the action you want to perform on the matching traffic by entering the following command:

   • reset [log] —Drop the packet, close the connection, and send a TCP reset to the server or client. Add the log keyword to send a system log message.

   You can specify multiple class or match commands in the policy map. For information about the order of class and match commands, see How Multiple Traffic Classes are Handled.

Step 5

To configure parameters that affect the inspection engine, perform the following steps:

1. Enter parameters configuration mode.

   
   hostname(config-pmap)# parameters
   hostname(config-pmap-p)#
   
   

2. Set one or more parameters. You can set the following options; use the no form of the command to disable the option:

   • mask-banner—Masks the greeting banner from the FTP server.

   • mask-syst-reply—Masks the reply to syst command.

Step 1

(Optional) Create an HTTP inspection class map by performing the following steps.

1. Create the class map: class-map type inspect http [match-all | match-any] class_map_name

   Where class_map_name is the name of the class map. The match-all keyword is the default, and specifies that traffic must match all criteria to match the class map. The match-any keyword specifies that the traffic matches the class map if it matches at least one match statement. The CLI enters class-map configuration mode, where you can enter one or more match commands.

2. (Optional) Add a description to the class map: description string

   Where string is the description of the class map (up to 200 characters).

3. Specify the traffic on which you want to perform actions using one of the following match commands. If you use a match not command, then any traffic that does not match the criterion in the match not command has the action applied.

   • match [not] req-resp content-type mismatch—Matches traffic with a content-type field in the HTTP response that does not match the accept field in the corresponding HTTP request message.

   • match [not] request args regex {regex_name | class class_name}—Matches text found in the HTTP request message arguments against the specified regular expression or regular expression class.

   • match [not] request body {regex {regex_name | class class_name} | length gt bytes}—Matches text found in the HTTP request message body against the specified regular expression or regular expression class, or messages where the request body is greater than the specified length.

   • match [not] request header {field | regex regex_name} regex {regex_name | class class_name}—Matches the content of a field in the HTTP request message header against the specified regular expression or regular expression class. You can specify the field name explicitly or match the field name to a regular expression. Field names are: accept, accept-charset, accept-encoding, accept-language, allow, authorization, cache-control, connection, content-encoding, content-language, content-length, content-location, content-md5, content-range, content-type, cookie, date, expect, expires, from, host, if-match, if-modified-since, if-none-match, if-range, if-unmodified-since, last-modified, max-forwards, pragma, proxy-authorization, range, referer, te, trailer, transfer-encoding, upgrade, user-agent, via, warning.

   • match [not] request header {field | regex {regex_name | class class_name}} {length gt bytes | count gt number}—Matches the length of the specified fields in the HTTP request message header, or the overall number of fields (count) in the header. You can specify the field name explicitly or match the field name to a regular expression or regular expression class. Field names are listed in the previous bullet.

   • match [not] request header {length gt bytes | count gt number | non-ascii}—Matches the overall length of the HTTP request message header, or the overall number of fields (count) in the header, or headers that have non-ASCII characters.

   • match [not] request method {method | regex {regex_name | class class_name}}—Matches the HTTP request method. You can specify the method explicitly or match the method to a regular expression or regular expression class. Methods are: bcopy, bdelete, bmove, bpropfind, bproppatch, connect, copy, delete, edit, get, getattribute, getattributenames, getproperties, head, index, lock, mkcol, mkdir, move, notify, options, poll, post, propfind, proppatch, put, revadd, revlabel, revlog, revnum, save, search, setattribute, startrev, stoprev, subscribe, trace, unedit, unlock, unsubscribe.

   • match [not] request uri {regex {regex_name | class class_name} | length gt bytes}—Matches text found in the HTTP request message URI against the specified regular expression or regular expression class, or messages where the request URI is greater than the specified length.

   • match [not] response body {active-x | java-applet | regex {regex_name | class class_name}}—Matches text found in the HTTP response message body against the specified regular expression or regular expression class, or comments out Java applet and Active X object tags in order to filter them.

   • match [not] response body length gt bytes—Matches HTTP response messages where the body is greater than the specified length.

   • match [not] response header {field | regex regex_name} regex {regex_name | class class_name}—Matches the content of a field in the HTTP response message header against the specified regular expression or regular expression class. You can specify the field name explicitly or match the field name to a regular expression. Field names are: accept-ranges, age, allow, cache-control, connection, content-encoding, content-language, content-length, content-location, content-md5, content-range, content-type, date, etag, expires, last-modified, location, pragma, proxy-authenticate, retry-after, server, set-cookie, trailer, transfer-encoding, upgrade, vary, via, warning, www-authenticate.

   • match [not] response header {field | regex {regex_name | class class_name}} {length gt bytes | count gt number}—Matches the length of the specified fields in the HTTP response message header, or the overall number of fields (count) in the header. You can specify the field name explicitly or match the field name to a regular expression or regular expression class. Field names are listed in the previous bullet.

   • match [not] response header {length gt bytes | count gt number | non-ascii}—Matches the overall length of the HTTP response message header, or the overall number of fields (count) in the header, or headers that have non-ASCII characters.

   • match [not] response status-line regex {regex_name | class class_name}—Matches text found in the HTTP response message status line against the specified regular expression or regular expression class.

4. Enter exit to leave class map configuration mode.

Step 2

Create an HTTP inspection policy map: policy-map type inspect http policy_map_name

Step 3

(Optional) Add a description to the policy map: description string

Step 4

To apply actions to matching traffic, perform the following steps.

1. Specify the traffic on which you want to perform actions using one of the following methods:

   • If you created an HTTP class map, specify it by entering the following command: class class_map_name

   • Specify traffic directly in the policy map using one of the match commands described for HTTP class maps. If you use a match not command, then any traffic that does not match the criterion in the match not command has the action applied.

2. Specify the action you want to perform on the matching traffic by entering one of the following commands:

   • drop-connection [log] —Drop the packet and close the connection.

   • reset [log] —Drop the packet, close the connection, and send a TCP reset to the server or client.

   • log —Send a system log message. You can use this option alone or with one of the other actions.

   You can specify multiple class or match commands in the policy map. For information about the order of class and match commands, see How Multiple Traffic Classes are Handled.

Step 5

To configure parameters that affect the inspection engine, perform the following steps:

1. Enter parameters configuration mode:

   
   hostname(config-pmap)# parameters
   hostname(config-pmap-p)#
   
   

2. Set one or more parameters. You can set the following options; use the no form of the command to disable the option:

   • body-match-maximum number—Sets the maximum number of characters in the body of an HTTP message that should be searched in a body match. The default is 200 bytes. A large number will have a significant impact on performance.

   • protocol-violation action {drop-connection [log] | reset [log] | log}—Checks for HTTP protocol violations. You must also choose the action to take for violations (drop connection, reset, or log) and whether to enable or disable logging.

   • spoof-server string—Substitutes a string for the server header field. WebVPN streams are not subject to the spoof-server command.

Step 1

Create an IP options inspection policy map: policy-map type inspect ip-options policy_map_name

Step 2

(Optional) Add a description to the policy map: description string

Step 3

Enter parameters configuration mode:

hostname(config-pmap)# parameters
hostname(config-pmap-p)#

Step 4

Identify the options you want to allow.

Step 1

Create an IPsec Pass Through inspection policy map: policy-map type inspect ipsec-pass-thru policy_map_name

Step 2

(Optional) Add a description to the policy map: description string

Step 3

To configure parameters that affect the inspection engine, perform the following steps:

1. Enter parameters configuration mode:

   
   hostname(config-pmap)# parameters
   hostname(config-pmap-p)#
   
   

2. Set one or more parameters. You can set the following options; use the no form of the command to disable the option:

   • esp per-client-max number timeout time—Allows ESP tunnels and sets the maximum connections allowed per client and the idle timeout (in hh:mm:ss format). To allow an unlimited number of connections, specify 0 for the number.

   • ah per-client-max number timeout time—Allows AH tunnels. The parameters have the same meaning as for the esp command.

Step 1

Create an IPv6 inspection policy map: policy-map type inspect ipv6 policy_map_name

Step 2

(Optional) Add a description to the policy map: description string

Step 3

(Optional) Drop or log traffic based on the headers in IPv6 messages.

1. Identify the traffic based on the IPv6 header: match header type

   Where type is one of the following:

   • ah—Matches the IPv6 Authentication extension header.

   • count gt number—Specifies the maximum number of IPv6 extension headers, from 0 to 255.

   • destination-option—Matches the IPv6 destination-option extension header.

   • esp—Matches the IPv6 Encapsulation Security Payload (ESP) extension header.

   • fragment—Matches the IPv6 fragment extension header.

   • hop-by-hop—Matches the IPv6 hop-by-hop extension header.

   • routing-address count gt number—Sets the maximum number of IPv6 routing header type 0 addresses, greater than a number between 0 and 255.

   • routing-type {eq | range} number—Matches the IPv6 routing header type, from 0 to 255. For a range, separate values by a space, for example, 30 40.

2. Specify the action to perform on matching packets. You can drop the packet and optionally log it, or just log it. If you do not enter an action, the packet is logged.

   • drop [log] —Drop all packets that match.

   • log —Send a system log message. You can use this option alone or with one of the other actions.

3. Repeat the process until you identify all headers that you want to drop or log.

Step 4

Configure parameters that affect the inspection engine.

1. Enter parameters configuration mode.

   
   hostname(config-pmap)# parameters
   hostname(config-pmap-p)#
   
   

2. Set one or more parameters. You can set the following options; use the no form of the command to disable the option:

   • verify-header type—Allows only known IPv6 extension headers.

   • verify-header order—Enforces the order of IPv6 extension headers as defined in RFC 2460.

Step 1

Create an ESMTP inspection policy map: policy-map type inspect esmtp policy_map_name

Step 2

(Optional) Add a description to the policy map: description string

Step 3

To apply actions to matching traffic, perform the following steps.

1. Specify the traffic on which you want to perform actions using one of the following match commands. If you use a match not command, then any traffic that does not match the criterion in the match not command has the action applied.

   • match [not] body {length | line length} gt bytes—Matches messages where the length or length of a line in an ESMTP body message is greater than the specified number of bytes.

   • match [not] cmd verb verb1 [verb2...]—Matches the command verb in the message. You can specify one or more of the following commands: auth, data, ehlo, etrn, helo, help, mail, noop, quit, rcpt, rset, saml, soml, vrfy.

   • match [not] cmd line length gt bytes—Matches messages where the length of a line in the command verb is greater than the specified number of bytes.

   • match [not] cmd rcpt count gt count—Matches messages where the number of recipients is greater than the specified count.

   • match [not] ehlo-reply-parameter parameter [parameter2...]—Matches ESMTP EHLO reply parameters. You can specify one or more of the following parameters: 8bitmime, auth, binaryname, checkpoint, dsn, etrn, others, pipelining, size, vrfy.

   • match [not] header {length | line length} gt bytes—Matches messages where the length or length of a line in an ESMTP header is greater than the specified number of bytes.

   • match [not] header to-fields count gt count—Matches messages where the number of To fields in the header is greater than the specified number.

   • match [not] invalid-recipients count gt number—Matches messages where the number of invalid recipients is greater than the specified count.

   • match [not] mime filetype regex {regex_name | class class_name}—Matches the MIME or media file type against the specified regular expression or regular expression class.

   • match [not] mime filename length gt bytes—Matches messages where a file name is longer than the specified number of bytes.

   • match [not] mime encoding type [type2...]—Matches the MIME encoding type. You can specify one or more of the following types: 7bit, 8bit, base64, binary, others, quoted-printable.

   • match [not] sender-address regex {regex_name | class class_name}—Matches the sender email address against the specified regular expression or regular expression class.

   • match [not] sender-address length gt bytes—Matches messages where the sender address is greater than the specified number of bytes.

2. Specify the action you want to perform on the matching traffic by entering one of the following commands:

   • drop-connection [log] —Drop the packet and close the connection.

   • mask [log] —Mask out the matching portion of the packet. This action is available for ehlo-reply-parameter and cmd verb only.

   • reset [log] —Drop the packet, close the connection, and send a TCP reset to the server or client.

   • log —Send a system log message. You can use this option alone or with one of the other actions.

   • rate-limit message_rate —Limit the rate of messages in packets per second. This option is available with cmd verb only, where you can use it as the only action, or you can use it in conjunction with the mask action.

   You can specify multiple match commands in the policy map. For information about the order of match commands, see How Multiple Traffic Classes are Handled.

Step 4

To configure parameters that affect the inspection engine, perform the following steps:

1. Enter parameters configuration mode:

   
   hostname(config-pmap)# parameters
   hostname(config-pmap-p)#
   
   

2. Set one or more parameters. You can set the following options; use the no form of the command to disable the option:

   • mail-relay domain-name action {drop-connection [log] | log}—Identifies a domain name for mail relay. You can either drop the connection and optionally log it, or log it.

   • mask-banner—Masks the banner from the ESMTP server.

   • special-character action {drop-connection [log] | log}—Identifies the action to take for messages that include the special characters pipe (|), back quote, and NUL in the sender or receiver email addresses. You can either drop the connection and optionally log it, or log it.

   • allow-tls [action log]—Whether to allow ESMTP over TLS (encrypted connections) without inspection. You can optionally log encrypted connections. The default is to allow TLS sessions without inspection. If you specify no allow-tls, the system strips the STARTTLS indication from the session connection and forces a plain-text connection.

Step 1

Configure the Sun RPC service properties.

hostname(config)# sunrpc-server inside 192.168.100.2 255.255.255.255 
service 100003 protocol tcp 111 timeout 00:30:00

Step 2

(Optional.) Monitor the pinholes created for these services.

hostname# show sunrpc-server active
LOCAL FOREIGN SERVICE TIMEOUT
-----------------------------------------------
1 209.165.200.5/0 192.168.100.2/2049 100003 0:30:00
2 209.165.200.5/0 192.168.100.2/2049 100003 0:30:00
3 209.165.200.5/0 192.168.100.2/647 100005 0:30:00
4 209.165.200.5/0 192.168.100.2/650 100005 0:30:00