Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 218)

100

101

13-16

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 13 Identifying Traffic with Access Lists

Simplifying Access Lists with Object Grouping

To add a service group, follow these steps:

Step 1 To add a service group, enter the following command:

hostname(config)# object-group service

grp_id

{tcp | udp | tcp-udp}

The grp_id is a text string up to 64 characters in length.

Specify the protocol for the services (ports) you want to add, either tcp, udp, or tcp-udp keywords.

Enter tcp-udp keyword if your service uses both TCP and UDP with the same port number, for example,

DNS (port 53).

The prompt changes to service configuration mode.

Step 2 (Optional) To add a description, enter the following command:

hostname(config-service)# description

text

The description can be up to 200 characters.

Step 3 To define the ports in the group, enter the following command for each port or range of ports:

hostname(config-service)# port-object {eq

port

| range

begin_port

end_port

}

For a list of permitted keywords and well-known port assignments, see the “Protocols and Applications”

section on page D-11.

For example, to create service groups that include DNS (TCP/UDP), LDAP (TCP), and RADIUS (UDP),

enter the following commands:

hostname(config)# object-group service services1 tcp-udp

hostname(config-service)# description DNS Group

hostname(config-service)# port-object eq domain

hostname(config-service)# object-group service services2 udp

hostname(config-service)# description RADIUS Group

hostname(config-service)# port-object eq radius

hostname(config-service)# port-object eq radius-acct

hostname(config-service)# object-group service services3 tcp

hostname(config-service)# description LDAP Group

hostname(config-service)# port-object eq ldap

Adding an ICMP Type Object Group

To add or change an ICMP type object group, follow these steps. After you add the group, you can add

more objects as required by following this procedure again for the same group name and specifying

additional objects. You do not need to reenter existing objects; the commands you already set remain in

place unless you remove them with the no form of the command.

To add an ICMP type group, follow these steps:

Step 1 To add an ICMP type group, enter the following command:

hostname(config)# object-group icmp-type

grp_id

The grp_id is a text string up to 64 characters in length.

The prompt changes to ICMP type configuration mode.

1 2 ... 213 214 215 216 217 218 219 220 221 222 223 ... 603 604

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 218

Kommentare zu diesen Handbüchern