这个配置适用于ASA的透明模式和路由模式，而且两种模式下的配置完全一样

普通ACL只可以针对源，扩展ACL可以针对源和目的

1.定义感兴趣的流量，注意这里的deny是允许访问MSN的IP，permit的是禁止访问MSN的IP

公司的策略是：允许spark（这里spark作为MSN的网关）访问MSN，也允许有特定需要的人访问MSN。

access-list BLOCK_MSN extended deny ip host 10.1.20.225 any //允许spark访问MSN

access-list BLOCK_MSN extended deny ip host 10.1.254.124 any //允许这个IP访问MSN
access-list BLOCK_MSN extended permit ip any any

2. class-map引入ACL匹配的地址，选流量
class-map MSN_INSPECTION
 match access-list BLOCK_MSN

3.选协议
class-map type inspect im match-all MSN-traffic
 match protocol msn-im

4. 针对协议选行为
policy-map type inspect im MSN-policy
 parameters  
 class MSN-traffic
  drop-connection log

5.将协议行为和流量关联
policy-map MSN-pol
 class

Do you know what you are?

You are a marvel. You are unique.

In all the years that have passed,

there has never been another girl like you.

Your eyes, your lip, your clever fingers, and the way of your sense of humor.

But this will become permanent memory, regardless of where you are.

As the approching of the new year, I should have a schedule to enjoy the holidays.Compared with this time of last year,I am much better now. Recalling then, I was imposed on triple setbacks:losing my CCIE lab seat, losing my job and being disappointed in love. I dare not memory how the gloomy days went by, because I was in a deadly depression then.

When the 2008 was coming, my fortune reversed with the course of the American president-elect Barack Obama's  winning. I got rid of unemployment successfully by job-hopping during the financial crisis in Octuber this year and meanwhile got a raise.In the new company, I have an English environment to improve my spoken english and listening. We also have english training every week. And I can study many new technologies from the job and my colleagues. With loose working environment I can play the BBC broadcast by