Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 294)

18-2

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 18 Using Modular Policy Framework

Identifying Traffic Using a Class Map

3. Finally, create a security policy by associating the policy map with one or more interfaces using the

service-policy global configuration command.

Associating a policy map with an interface activates the policy.

Identifying Traffic Using a Class Map

A traffic class is a set of traffic that is identified by the packet content. To classify a set of traffic with

which security actions may be associated, use the class-map command. A class map contains a name

and one match command (with the exception of the match tunnel-group and match

default-inspection-traffic commands). The class map name can be any string of alphanumeric

characters. The match command identifies the traffic included in the traffic class.

Match commands can include different criteria to define the traffic included in the class map. For

example, you can use one or more access lists to identify specific types of traffic. The permit statement

in an access control entry causes the traffic to be included, while a deny statement causes the traffic to

be excluded from the class map. For more information about configuring access lists, see Chapter 13,

“Identifying Traffic with Access Lists.”

The following class-map command example uses an access list to classify all TCP traffic:

hostname(config)# access-list tcp_traffic permit tcp any any

hostname(config)# class-map tcp_traffic

hostname(config-cmap)# match access-list tcp_traffic

After a traffic class is applied to an interface, packets received on that interface are compared to the

criteria defined by the match statements in the class map. If the packet matches the specified criteria, it

is included in the traffic class and is subjected to any action, such as application inspection, that is

associated with that traffic class. Packets that do not match any of the criteria in any traffic class are

assigned to the default traffic class.

The following commands are available in class-map configuration mode:

Table 18-1 Class-map Configuration Mode Commands

Command Description

description Specifies a description for the class-map command.

match any Specifies that all traffic is to be matched. It is used in the

default class-map class-default command.

match access-list Specifies the name of an access list to be used as match

criteria. When a packet does not match an entry in the access

list, the match result is a no-match. When a packet matches an

entry in an access list, and if it is a permit entry, the match

result is a match. Otherwise, if it matches a deny access list

entry, the match result is no-match.

match port Specifies to match traffic using a TCP/UDP destination port.

match precedence Specifies to match the precedence value represented by the

TOS byte in the IP header.

match dscp Specifies to match the IETF-defined DSCP value in the IP

header.

match rtp Specifies to match an RTP port.

1 2 ... 289 290 291 292 293 294 295 296 297 298 299 ... 603 604

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 294

Kommentare zu diesen Handbüchern