Cisco PIX 525 Especificações descarregar pdf (Página 332)

21-6

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 21 Applying Application Layer Protocol Inspection

Applying Application Inspection to Selected Traffic

Step 4 Create a security policy by associating the policy map with one or more interfaces by entering the

service-policy command.

A security policy associates a previously defined traffic class with a security-related action and applies

it to a specific interface.

You can associate more than one traffic class with a single action and more than one action with a

specific traffic class. You can associate all interfaces with a traffic class by entering the global option,

or multiple interfaces by entering the service-policy command on separate interfaces.

Identifying Traffic with a Traffic Class Map

A traffic class map contains a name and one match command. The match command identifies the traffic

included in the traffic class. The name can be any string of alphanumeric characters.

Match commands can include different criteria to define the traffic included in the class map. For

example, you can use one or more access lists to identify specific types of traffic. The permit command

in an access control entry causes the traffic to be included, while a deny command causes the traffic to

be excluded from the traffic class map. For more information about configuring access lists, see Chapter

9, “Identifying Traffic with Access Control Lists,” in the Cisco Security Appliance Command Line

Configuration Guide.

After a traffic class is applied to an interface, packets received on that interface are compared to the

criteria defined by the match commands in the class map.

If the packet matches the specified criteria, it is included in the traffic class and is subjected to any action,

such as application inspection, that is associated with that traffic class. Packets that do not match any of

the criteria in any traffic class are assigned to the default traffic class.

To define a traffic class map, perform the following steps:

Step 1 To use an access list to define the traffic class, define the access list in global configuration mode, as in

the following example:

hostname(config)# access-list http_acl permit tcp any any eq 80

The http_acl access list in this example includes traffic on port 80. To enable traffic on

more than one non-contiguous port, enter the access-list command to create an access

control entry for each port.

For the complete syntax of the access-list command see the access-list command page in the

Cisco Security Appliance Command Reference

Step 2 Name the traffic class by entering the following command in global configuration mode:

hostname(config)# class-map

class_map_name

Replace class_map_name with the name of the traffic class, as in the following example:

hostname(config)# class-map http_port

When you enter the class-map command, the CLI enters the class map configuration mode, and the

prompt changes, as in the following example:

hostname(config-cmap)#

1 2 ... 327 328 329 330 331 332 333 334 335 336 337 ... 603 604

Sem comentários

Cisco PIX 525 Especificações Página 332