Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 310)

100

101

19-2

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 19 Intercepting and Responding to Network Attacks

Configuring TCP Normalization

TCP normalization is a feature consisting of advanced TCP connection settings designed to drop packets

that do not appear normal. It is used with Modular Policy Framework to create a security policy applied

to the security appliance. Once a TCP map is created, it is applied using the policy-map command, and

activated using the service-policy command. For more information about Modular Policy Framework,

see Chapter 18, “Using Modular Policy Framework.”

For example, you can use TCP map to allow the URG pointer for certain applications, such as rsh, rlogin,

FTP, and Telnet, but clear for the others. The TCP normalizer commands are used with the existing

Modular Policy Framework commands to set advanced TCP connection settings.

To configure advanced TCP connection settings, perform the following steps:

Step 1 To create a TCP map that allows urgent flag and urgent offset packets, enter the following commands:

hostname(config)# tcp-map tmap

hostname(config-tmap)# urgent-flag allow

TCP normalization includes the following settings, which are configurable in tcp-map configuration

mode.

Step 2 To identify traffic, add a class map using the class-map command according to Chapter 18, “Using

Modular Policy Framework.” Enter the following commands:

hostname(config)# class-map urg-class

hostname(config-cmap)# match port tcp range ftp-data telnet

Step 3 To add a policy map that identifies the class map and the TCP map, enter the following commands:

hostname(config)# policy-map pmap

hostname(config-pmap)# class urg-class

hostname(config-pmap-c)# set connection advanced-options tmap

queue-limit Configures the maximum number of out-of-order packets that can be

queued for a TCP connection.

urgent-flag Allows or clears the URG pointer through the security appliance.

tcp-options Allows or clears the selective-ack, timestamps, or window-scale TCP

options.

window-variation Drops a connection that has changed its window size unexpectedly.

ttl-evasion-protection Enables or disables the TTL evasion protection offered by the security

appliance.

reserved-bits Sets the reserved flags policy in the security appliance.

check-retransmission Enables and disables the retransmit data checks.

exceed-mss Allows or drops packets that exceed MSS set by peer.

syn-data Allows or drops SYN packets with data.

checksum-verification Enables and disable checksum verification.

1 2 ... 305 306 307 308 309 310 311 312 313 314 315 ... 603 604

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 310

Kommentare zu diesen Handbüchern