Cisco PIX 525 Especificações descarregar pdf (Página 359)

100

101

21-33

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 21 Applying Application Layer Protocol Inspection

Managing MGCP Inspection

Example 21-5 Enabling and Configuring Enhanced HTTP Inspection

The following example shows how to use access lists to identify HTTP traffic, define an HTTP map,

define a policy, and apply the policy to the outside interface:

hostname(config)# class-map http_port

hostname(config-cmap)# match port tcp eq 80

hostname(config-cmap)# exit

hostname(config)# http-map inbound_http

hostname(config-http-map)# content-length min 100 max 2000 action reset log

hostname(config-http-map)# content-type-verification match-req-rsp reset log

hostname(config-http-map)# max-header-length request bytes 100 action log reset

hostname(config-http-map)# max-uri-length 100 action reset log

hostname(config-http-map)# exit

hostname(config)# policy-map inbound_policy

hostname(config-pmap)# class http_port

hostname(config-pmap-c)# inspect http inbound_http

hostname(config-pmap-c)# exit

hostname(config-pmap)# exit

hostname(config)# service-policy inbound_policy interface outside

Table 21-5 summarizes the configuration commands available in HTTP map configuration mode. Refer

to the command page in the Cisco Security Appliance Command Reference for the detailed syntax of

each command.

Note The actions that you can specify for messages that fail the criteria set using the different configuration

commands include allow, reset, or drop. In addition to these actions, you can specify to log the event or

not.

Managing MGCP Inspection

This section describes how to enable and configure MGCP application inspection and change the default

port configuration. This section includes the following topics:

• MGCP Inspection Overview, page 21-34

• Configuring MGCP Call Agents and Gateways, page 21-35

Table 21-5 HTTP Map Configuration Commands

Command Description

content-length Enables inspection based on the length of the HTTP content.

content-type-verification Enables inspection based on the type of HTTP content.

max-header-length Enables inspection based on the length of the HTTP header.

max-uri-length Enables inspection based on the length of the URI.

no Negates a command or sets a parameter to its default value.

port-misuse Enables application firewall inspection.

request-method Enables inspection based on the HTTP request method.

strict-http Enables strict HTTP inspection.

transfer-encoding Enables inspection based on the transfer encoding type.

1 2 ... 354 355 356 357 358 359 360 361 362 363 364 ... 603 604

Comentários a estes Manuais

Sem comentários

Cisco PIX 525 Especificações Página 359

Comentários a estes Manuais