Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 207)

100

101

13-5

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 13 Identifying Traffic with Access Lists

Access List Overview

To use access lists with NAT, perform the following tasks:

1. Add the access list using the “Adding an Extended Access List” section on page 13-9. This access

list can contain only permit elements. Specify ports using the eq operator.

2. Use the access list in the nat and static commands described in the following sections:

–

“Using Dynamic NAT and PAT” section on page 14-16

–

“Using Static NAT” section on page 14-25

–

“Using Static PAT” section on page 14-26

–

“Configuring Static Identity NAT” section on page 14-30

–

“Configuring NAT Exemption” section on page 14-31

VPN Access (Extended)

You can use an extended access list in VPN commands. See the following tasks for each method.

• To identify hosts for an IPSec site-to-site tunnel, perform the following tasks:

a. Add the access list using the “Adding an Extended Access List” section on page 13-9.

Specify the security appliance address as the source address. Specify the remote address(es) for

the destination address.

b. Use the access list in the crypto map match address command according to the “Creating a

Crypto Map and Applying It To an Interface” section on page 28-6.

• To identify the traffic that should be tunneled from a VPN client, perform the following tasks:

a. Add the access list using the “Adding an Extended Access List” section on page 13-9.

Specify the security appliance address as the source address, and the VPN pool addresses as the

destination addresses.

b. Then use the access list in the split-tunnel-network-list command according to the

“Configuring Group Policies” section on page 25-12.

Identify Traffic in a Class Map for Modular Policy Framework

Access lists can be used to identify traffic in a class map, which is used for features that support Modular

Policy Framework. Features that support Modular Policy Framework include TCP and general

connection settings, inspection, IPS, and QoS. You can use one or more access lists to identify specific

types of traffic.

To identify traffic in a class map for a feature that supports Modular Policy Framework, perform the

following tasks:

1. Add the access list using the “Adding an Extended Access List” section on page 13-9.

The permit statement in an access control entry causes the traffic to be included, while a deny

statement causes the traffic to be excluded from the class map.

2. Apply the access list using a class-map configuration mode match command. For more information,

see Chapter 18, “Using Modular Policy Framework.”

1 2 ... 202 203 204 205 206 207 208 209 210 211 212 ... 603 604

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 207

Kommentare zu diesen Handbüchern