Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 333)

100

101

21-7

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 21 Applying Application Layer Protocol Inspection

Applying Application Inspection to Selected Traffic

Step 3 In the class map configuration mode, define the traffic to include in the class by entering the following

command:

hostname(config-cmap)# match any | access-list

acl_ID

| {port tcp | udp {eq

port_num

range

port_num

}}

Use the any option to include all traffic in the traffic class. Use the access-list option

to match the criteria defined in a specific access list. Use the port option to identify a

specific port number or a range of port numbers.

Note For applications that use multiple ports that are not within a continuous range, enter the

access-list option and define an access control entry to match each port.

The following example uses the port option to assign the default port to the current traffic class:

hostname(config-cmap)# match port tcp eq 80

The following example uses the access-list option to assign traffic identified by the access control entries

in the http_acl access list:

hostname(config-cmap)# match access-list http_acl

You can also enter the match command to identify traffic based on IP precedence, DSCP (QoS) value,

RTP port, or tunnel group. For the complete syntax of the match command, see the Cisco Security

Appliance Command Reference.

Step 4 To apply application inspection to the default port assignments for every application and protocol, enter

the following command:

hostname(config-cmap)# match default-inspection-traffic

This command overrides any other port assignments made by entering another match command.

However, it can be used with another match command that specifies other criteria, such as destination or

source IP address. Table 21-2 lists the default port assignments for different protocols.

Table 21-2 Default Port Assignments

Protocol Name Protocol Port

ctiqbe tcp 2748

dns udp 53

ftp tcp 21

gtp udp 2123,3386

h323 h225 tcp 1720

h323 ras udp 1718-1719

http tcp 80

icmp icmp N/A

ils tcp 389

mgcp udp 2427,2727

netbios udp N/A

rpc/sunrpc udp 111

rsh tcp 514

1 2 ... 328 329 330 331 332 333 334 335 336 337 338 ... 603 604

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 333

Kommentare zu diesen Handbüchern