Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 295)

100

101

18-3

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 18 Using Modular Policy Framework

Identifying Traffic Using a Class Map

To define a class map, perform the following steps:

Step 1 To use an access list to define the traffic class, define the access list in global configuration mode, as in

the following example:

hostname(config)# access-list http_acl permit tcp any any eq 80

The http_acl access list in this example includes TCP traffic on port 80. To enable traffic on more than

one non-contiguous port, enter the access-list command to create an access control entry for each port.

For the complete syntax of the access-list command refer to the access-list command pages in the

Cisco Security Appliance Command Reference.

Step 2 Name the traffic class by entering the following command in global configuration mode:

hostname(config)# class-map

class_map_name

Replace class_map_name with the name of the traffic class.

hostname(config)# class-map http_port

When you enter the class-map command, the CLI enters the class map configuration mode, and the

prompt changes, as in the following example:

hostname(config-cmap)#

Step 3 In the class map configuration mode, define the traffic to include in the class by entering the following

command:

hostname(config-cmap)# match any | access-list

acl_ID

| {port tcp | udp {eq

port_num

range

port_num

}}

Use the any option to include all traffic in the traffic class. Use the access-list option to match the

criteria defined in a specific access list. Use the port option to identify a specific destination port

number or a range of destination port numbers.

Note For applications that use multiple ports that are not within a continuous range, use the access-list

option and define an access control entry to match each port.

The following example uses the port option to assign the default port to the current traffic class:

hostname(config-cmap)# match port tcp eq 80

match tunnel-group Specifies to match security related tunnel groups. Note that

matching on tunnel groups is used with QoS configurations

only.

match flow Specifies to match every flow based on unique IP destination

address.

match default-inspection-traffic Specifies to match default traffic for the inspect commands.

Table 18-1 Class-map Configuration Mode Commands (continued)

Command Description

1 2 ... 290 291 292 293 294 295 296 297 298 299 300 ... 603 604

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 295

Kommentare zu diesen Handbüchern