Cisco PIX 525 Especificações descarregar pdf (Página 380)

100

101

21-54

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 21 Applying Application Layer Protocol Inspection

Managing SNMP Inspection

SNMP Inspection Overview

Use the inspect snmp command to enable SNMP inspection, using the settings configured with an

SNMP map, which you create by entering the snmp-map command. Enter the deny version command

in SNMP map configuration mode to restrict SNMP traffic to a specific version of SNMP.

Earlier versions of SNMP are less secure so denying SNMP Version 1 traffic may be required by your

security policy. To deny a specific version of SNMP, enter the deny version command within an SNMP

map, which you create by entering the snmp-map command. After configuring the SNMP map, you

enable the map by entering the inspect snmp command and then apply it to one or more interfaces by

entering the service-policy command.

Enabling and Configuring SNMP Application Inspection

To change the default configuration for SNMP inspection, perform the following steps:

Step 1 Define access control lists to identify the two ports required for receiving SNMP traffic. For example,

the following commands identify the default ports for SNMP inspection:

hostname(config)# access-list snmp_acl permit tcp any any eq 161

hostname(config)# access-list snmp_acl permit tcp any any eq 162

Step 2 Name the traffic class by entering the following command in global configuration mode:

hostname(config)# class-map

class_map_name

Replace class_map_name with the name of the traffic class, for example:

hostname(config)# class-map snmp_port

When you enter the class-map command, the CLI enters the class map configuration mode, and the

prompt changes, as in the following example:

hostname(config-cmap)#

Step 3 In the class map configuration mode, define the match command, as in the following example:

hostname(config-cmap)# match access-list snmp_acl

hostname(config-cmap)# exit

hostname(config)#

To assign a range of continuous ports, you can also enter the range keyword, as in the following

example:

hostname(config-cmap)# match port tcp range 161-162

In this case, you do not need to create access lists for defining the ports on which to enable SNMP

application inspection.

Step 4 Create an SNMP map by entering the following command:

hostname(config)# snmp-map

policy_map_name

Replace snmp_map_name with the name of the SNMP map, for example:

hostname(config)# snmp-map inbound_snmp

The system enters SNMP map configuration mode and the CLI prompt changes as in the following

example:

hostname(config-snmp-map)#

1 2 ... 375 376 377 378 379 380 381 382 383 384 385 ... 603 604

Comentários a estes Manuais

Sem comentários

Cisco PIX 525 Especificações Página 380

Comentários a estes Manuais