Click View Configuration in Device > Advanced Configuration.

Click FlexConfig > FlexConfig Objects in the Advanced Configuration table of contents.

Create the object to enable PPTP inspection.

1. Click the + button to create a new object.

2. Enter a name for the object. For example, Enable_PPTP_Global_Inspection.

3. In the Template editor, enter the following lines, including indentations.

   
   policy-map global_policy
    class inspection_default
     inspect pptp
   
   

4. In the Negate Template editor, enter the lines required to undo this configuration.

   Just as you need to include the parent commands to enter the correct sub-mode for a command to enable it, you also need to include those commands in the negate template.

   The negate template will be applied if you remove this object from the FlexConfig policy (after having deployed it successfully), and also during an unsuccessful deployment (to reset the configuration to its previous condition).

   Thus, for this example, the negate template would be the following:

   
   policy-map global_policy
    class inspection_default
     no inspect pptp
   
   

   The object should look like the following:

   
   

   

   
   

   Note	Because the inspection_default class has other inspection commands enabled, you do not want to negate the entire class. Similarly, the global_policy policy map includes these other inspections, and you do not want to negate the policy map either.

5. Click OK to save the object.

Create the object to disable SIP inspection.

1. Click the + button to create a new object.

2. Enter a name for the object. For example, Disable_SIP_Global_Inspection.

3. In the Template editor, enter the following lines, including indentations.

   
   policy-map global_policy
    class inspection_default
     no inspect sip
   
   

4. In the Negate Template editor, enter the lines required to undo this configuration.

   The “negate” command for a disabling “no” command is the command that enables the feature. Thus, the “negate” template is not just the commands to disable a feature, it is the commands to reverse whatever you do in the “positive” template. The point of the negate template is to undo your changes.

   Thus, for this example, the negate template would be the following:

   
   policy-map global_policy
    class inspection_default
     inspect sip
   
   

   The object should look like the following:

   
   

   

   
   

5. Click OK to save the object.

Add the objects to the FlexConfig policy.

1. Click FlexConfig Policy in the table of contents.

2. Click + in the Group List.

3. Select the Enable_PPTP_Global_Inspection and Disable_SIP_Global_Inspection objects and click OK.

   The group list should look like the following:

   
   

   

   
   

   The preview should update with the commands in the template. Verify you are seeing the expected commands.

   
   

   

   
   

4. Click Save.

   You can now deploy the policy.

Commit your changes.

1. Click the Deploy Changes icon in the upper right of the web page.

   

2. Click the Deploy Now button.

   You can wait until deployment completes, or click OK and check the task list or deployment history later.

In CLI Console or an SSH session, use the show running-config policy-map command and verify that the running configuration has the correct changes.

> show running-config policy-map 
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
  no tcp-inspection
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map 
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect rsh 
  inspect rtsp 
  inspect sqlnet 
  inspect skinny  
  inspect sunrpc 
  inspect xdmcp 
  inspect netbios 
  inspect tftp 
  inspect ip-options 
  inspect icmp 
  inspect icmp error 
  inspect pptp 
!

Click View Configuration in Device > Advanced Configuration.

Click FlexConfig > FlexConfig Policy in the Advanced Configuration table of contents.

Click the X on the right side of the Disable_SIP_Global_Inspection object’s entry in the FlexConfig policy to delete it from the policy.

The commands from the object are removed from the preview. The negate commands are not added to the preview, these will be executed behind the scenes.

Click Save.

Commit your changes.

1. Click the Deploy Changes icon in the upper right of the web page.

   

2. Click the Deploy Now button.

   You can wait until deployment completes, or click OK and check the task list or deployment history later.

In CLI Console or an SSH session, use the show running-config policy-map command and verify that the running configuration has the correct changes.

> show running-config policy-map 
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
  no tcp-inspection
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map 
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect rsh 
  inspect rtsp 
  inspect sqlnet 
  inspect skinny  
  inspect sunrpc 
  inspect xdmcp 
  inspect netbios 
  inspect tftp 
  inspect ip-options 
  inspect icmp 
  inspect icmp error 
  inspect pptp 
  inspect sip  
!

Click View Configuration in Device > Advanced Configuration.

Click FlexConfig > FlexConfig Objects in the Advanced Configuration table of contents.

Click the + button to create a new object.

Enter a name for the object. For example, Enable_PPTP_Inspection_on_Interface.

Add a variable for the inside interface.

1. Click + above the Variables list.

2. Enter a name for the variable, for example, pptp-if.

3. For Type, select Interface.

4. For Value, select the inside interface.

   The dialog box should look like the following:

   
   

   

   
   

5. Click Add.

In the Template editor, enter the following lines, including indentations.

access-list MATCH_ACL permit ip host 192.168.1.55 host 198.51.100.1 
class-map MATCH_CMAP
 match access-list MATCH_ACL
policy-map PPTP_POLICY
 class MATCH_CMAP
  inspect pptp
service-policy PPTP_POLICY interface {{pptp-if.name}}

In the Negate Template editor, enter the lines required to undo this configuration.

For this example, we will assume that the class map, policy map, and service policy exist for the sole purpose of applying PPTP inspection. Thus, in the negate template, we want to remove all of these.

If, however, you are actually adding PPTP inspection to an existing service policy on an interface, you would not negate the policy map or service policy. You would either negate the class from the policy map, or simply turn off inspection within the class within the policy map. You need to have a clear understanding of what you are implementing in other FlexConfig objects to ensure that your negate template does not have unintended consequences.

When deleting nested items, you need to do it in the reverse order in which you created them. Thus, you start by deleting the service policy, and end by deleting the access list. Otherwise, you would be trying to delete objects that are in use, and the system will return errors and not let you do that.

no service-policy PPTP_POLICY interface {{pptp-if.name}}
no policy-map PPTP_POLICY
no class-map MATCH_CMAP
no access-list MATCH_ACL permit ip host 192.168.1.55 host 198.51.100.1 

The object should look like the following:

Click OK to save the object.

Add the objects to the FlexConfig policy.

1. Click FlexConfig Policy in the table of contents.

2. Click + in the Group List.

3. Select the Enable_PPTP_Inspection_on_Interface object and click OK.

   The group list should look like the following:

   
   

   

   
   

   The preview should update with the commands in the template. Verify you are seeing the expected commands, as shown in the following graphic. Notice that the interface variable resolves to the name “inside” in the preview. Pay special attention to variables: if they do not resolve correctly in the preview, they will not deploy correctly. Edit the FlexConfig object until you get the correct variable translation in the preview.

   
   

   

   
   

4. Click Save.

   You can now deploy the policy.

Commit your changes.

1. Click the Deploy Changes icon in the upper right of the web page.

   

2. Click the Deploy Now button.

   You can wait until deployment completes, or click OK and check the task list or deployment history later.

In CLI Console or an SSH session, use variations of the show running-config command and verify that the running configuration has the correct changes.

> show running-config access-list MATCH_ACL 
access-list MATCH_ACL extended permit ip host 192.168.1.55 host 198.51.100.1 

> show running-config class 
!
class-map MATCH_CMAP
 match access-list MATCH_ACL
class-map inspection_default
 match default-inspection-traffic
!

> show running-config policy-map PPTP_POLICY 
!
policy-map PPTP_POLICY
 class MATCH_CMAP
  inspect pptp 
!
> show running-config service-policy 
service-policy global_policy global
service-policy PPTP_POLICY interface inside

Verify the current PTP configuration.

> show ptp clock
 No clock information is available in PTP forwarding mode.
> show ptp port
 No clock information is available in PTP forwarding mode.

Verify the configuration of the PTP clock-facing interfaces.

1. In the FDM, click View All Interfaces in Device > Interfaces.

2. Find the interfaces in the list, and check the Mode column. BridgeGroupMember means it is part of a bridge group, otherwise it should be Routed.

In the FDM, click View Configuration in Device > Advanced Configuration.

Click FlexConfig > FlexConfig Objects in the Advanced Configuration table of contents.

Create the object needed to enable PTP and to configure it on the appropriate interfaces.

1. Click the + button to create a new object.

2. Enter a name for the object. For example, Enable_PTP.

3. In the Template editor, enter the required commands, including indentations.

   The following example configures PTP on GigabitEthernet1/2 for PTP domain 10. You need to adjust these settings to the ones relevant for your network. Enable PTP on the interface through which the system can connect to the PTP clock in your network. If there are other interfaces through which a backup clock is available, add the lines to enable PTP and, for routed interfaces, join the IGMP group for that interface, to this set of commands.

   In this example, GigabitEthernet1/2 is a bridge group member, so do not include the igmp command. Note that the igmp command is not supported on bridge group members, so if you include the command, you will get a deployment error, where the system says it cannot recognize the command.

   
   multicast-routing
   ptp mode e2etransparent
   ptp domain 10
   interface GigabitEthernet1/2
    ptp enable
   

   If GigabitEthernet1/2 is a routed interface, you must include the igmp command to join the 224.0.1.129 IGMP group (that is the correct IP address for all networks). The complete object would look like the following:

   
   multicast-routing
   ptp mode e2etransparent
   ptp domain 10
   interface GigabitEthernet1/2
    ptp enable
    igmp join-group 224.0.1.129
   

4. In the Negate Template editor, enter the lines required to undo this configuration.

   Just as you need to include the parent commands to enter the correct sub-mode for a command to enable it, you also need to include those commands in the negate template.

   The negate template will be applied if you remove this object from the FlexConfig policy (after having deployed it successfully), and also during an unsuccessful deployment (to reset the configuration to its previous condition).

   Thus, for this example, the negate template would be the following:

   
   no multicast-routing
   no ptp mode e2etransparent
   no ptp domain 10
   interface GigabitEthernet1/2
    no ptp enable
   

   The negate template for a routed interface would look like the following:

   
   no multicast-routing
   no ptp mode e2etransparent
   no ptp domain 10
   interface GigabitEthernet1/2
    no ptp enable
    no igmp join-group 224.0.1.129
   

   The object should look like the following:

   
   

   

   
   

5. Click OK to save the object.

Add the objects to the FlexConfig policy.

1. Click FlexConfig Policy in the table of contents.

2. Click + in the Group List.

3. Select the Enable_PTP object and click OK.

   The group list should look like the following:

   
   

   

   
   

   The preview should update with the commands in the template. Verify you are seeing the expected commands.

   
   

   

   
   

4. Click Save.

   You can now deploy the policy.

Commit your changes.

1. Click the Deploy Changes icon in the upper right of the web page.

   

2. Click the Deploy Now button.

   You can wait until deployment completes, or click OK and check the task list or deployment history later.

Verify the PTP configuration.

> show ptp clock
 PTP CLOCK INFO
  PTP Device Type: End to End Transparent Clock
  Operation mode: One Step
  Clock Identity: 34:62:88:FF:FE:1:73:81
  Clock Domain: 10
  Number of PTP ports: 4
> show ptp port
 PTP PORT DATASET: GigabitEthernet1/1
  Port identity: Clock Identity: 34:62:88:FF:FE:1:73:81
  Port identity: Port Number: 1
  PTP version: 2
  Port state: Disabled

 PTP PORT DATASET: GigabitEthernet1/2
  Port identity: Clock Identity: 34:62:88:FF:FE:1:73:81
  Port identity: Port Number: 2
  PTP version: 2
  Port state: Enabled

 PTP PORT DATASET: GigabitEthernet1/3
  Port identity: Clock Identity: 34:62:88:FF:FE:1:73:81
  Port identity: Port Number: 3
  PTP version: 2
  Port state: Disabled

 PTP PORT DATASET: GigabitEthernet1/4
  Port identity: Clock Identity: 34:62:88:FF:FE:1:73:81
  Port identity: Port Number: 4
  PTP version: 2
  Port state: Disabled