Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 300)

100

101

18-8

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 18 Using Modular Policy Framework

Defining Actions Using a Policy Map

hostname(config)# class-map high_priority_traffic

hostname(config-cmap)# match dscp AF1 AF2

hostname(config)# policy-map outside_policy

hostname(config-pmap)# class inspection_default

hostname(config-pmap-c)# inspect http http_map

hostname(config-pmap-c)# inspect sip

hostname(config-pmap)# class http_traffic

hostname(config-pmap-c)# set connection timeout tcp 0:10:0

hostname(config-pmap)# class high_priority_traffic

hostname(config-pmap-c)# priority

In this example, there are four separate feature domains:

When a packet is a TCP packet with destination port 80 and DSCP AF1, Modular Policy Framework will

attempt to classify the packet in all four domains that are present in the policy map outside_policy using

the class maps that are present in the domain.

The classification will yield three matches:

• Class map inspection_default in the HTTP-inspection domain

• Class map http_traffic in the set-connection domain

• Class map high_priority_traffic in the priority-queuing domain

Based on the classification results, the corresponding commands/actions are performed:

• inspect http http_map

• set connection timeout tcp 0:10:0

• priority

First-match Policy within a Feature Domain

Within a policy map, it is common to have multiple class map action groups that belong to the same

feature domain. In such a case, the class maps are logically matched in the same order as they appear in

the policy map. Once there is a match, there will be no more matches within the same domain.

The following example shows how first-match works within a domain.

hostname(config)# class-map telnet_traffic

hostname(config-cmap)# match port tcp eq 23

hostname(config)# class-map ftp_traffic

hostname(config-cmap)# match port tcp eq 21

hostname(config)# class-map tcp_traffic

hostname(config-cmap)# match port tcp range 1 65535

hostname(config)# class-map udp_traffic

hostname(config-cmap)# match port udp range 0 65535

Table 18-4 Example Modular Policy Framework Feature Domains

Domain Domain Class Map Domain Action Command

HTTP-inspection inspection_default inspect http http_map

SIP-inspection inspection_default inspect sip

set-connection http_traffic set connection timeout tcp 0:10:1

priority-queueing high_priority_traffic priority

1 2 ... 295 296 297 298 299 300 301 302 303 304 305 ... 603 604

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 300

Kommentare zu diesen Handbüchern