Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 305)

100

101

18-13

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 18 Using Modular Policy Framework

Direction Policies When Applying a Service Policy

Figure 18-2 Match Access List/Interface Policy Topology

See the following commands for this example:

hostname(config)# access-list http_server permit tcp any host SERVER_B eq 80

hostname(config)# access-list http_client permit tcp host CLIENT_D any eq 80

hostname(config)# class-map http_server

hostname(config-cmap)# match access-list http_server

hostname(config)# class-map http_client

hostname(config-cmap)# match access-list http_client

hostname(config)# policy-map http_server

hostname(config-pmap)# class http_server

hostname(config-pmap-c)# inspect http http_map_server

hostname(config-pmap-c)# set connection conn-max 100

hostname(config)# policy-map http_client

hostname(config-pmap)# class http_client

hostname(config-pmap-c)# inspect http http_map_client

hostname(config-pmap-c)# police output 250000

hostname(config)# service-policy http_server interface inside

hostname(config)# service-policy http_client interface outside

Match Port/Global Policy Example

In the match port/global policy example:

• Any HTTP connection (TCP traffic on port 80) which enters the security appliance through any

interface is classified for HTTP inspection (input policy when service policy is global).

• Any HTTP connection (TCP traffic on port 80) which exits the security appliance through any

interface is classified for policing (output policy).

• Using the topology in Figure 18-3, Host A is located on outside and Host B is located on inside, all

HTTP connections initiated from Host A and destined to Host B will be classified for HTTP

inspection and policing. And all HTTP connections initiated from Host B and destined to Host A

will also be classified for HTTP inspection and policing.

126992

A B/80 inspection (output rule of bidirectional policy)

set connection limit (output rule of bidirectional policy)

B A/80 not classified (does not match the specified access list http_server)

D C/80 inspection (output rule of bidirectional policy)

police (output policy)

C D/80 not classified (does not match the specified access list http_server)

policy http_client

outside inside

policy http_server

SERVER_B

CLIENT_D

Host A

Host C

Security

appliance

1 2 ... 300 301 302 303 304 305 306 307 308 309 310 ... 603 604

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 305

Kommentare zu diesen Handbüchern