Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 342)

100

101

21-16

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 21 Applying Application Layer Protocol Inspection

Managing FTP Inspection

To change the default configuration for FTP inspection, perform the following steps:

Step 1 Name the traffic class by entering the following command in global configuration mode:

hostname(config)# class-map

class_map_name

Replace class_map_name with the name of the traffic class, as in the following example:

hostname(config)# class-map ftp_port

When you enter the class-map command, the CLI enters the class map configuration mode, and the

prompt changes, as in the following example:

hostname(config-cmap)#

Step 2 In the class map configuration mode, define the match command, as in the following example:

hostname(config-cmap)# match port tcp eq 23

hostname(config-cmap)# exit

hostname(config)#

To assign a range of continuous ports, enter the range keyword, as in the following example:

hostname(config-cmap)# match port tcp range 1023-1025

To assign more than one non-contiguous port for FTP inspection, enter the access-list command and

define an access control entry to match each port. Then enter the match command to associate the access

lists with the FTP traffic class.

Step 3 Create an FTP map by entering the following command:

hostname(config)# ftp-map

ftp_map_name

Replace ftp_map_name with the name of the FTP map, for example:

hostname(config)# ftp-map inbound_ftp

The system enters FTP map configuration mode and the CLI prompt changes as in the following

example:

hostname(config-ftp-map)#

Step 4 Define the configuration of the FTP map by entering the following command:

hostname(config-ftp-map)# request-command deny

ftp_command

hostname(config-ftp-map)# exit

hostname(config)#

Replace ftp_command with one or more FTP commands that you want to restrict. See Table 21-3 for a

list of the FTP commands that you can restrict. For example, the following command prevents storing or

appending files:

hostname(config-inbound_ftp)# request-command deny put stou appe

Note When FTP inspection is enabled, the security appliance replaces the FTP server response to the

SYST command with a series of Xs. This prevents the server from revealing its system type to

FTP clients. To change this default behavior, use the no mask-syst-reply command in FTP map

configuration mode.

1 2 ... 337 338 339 340 341 342 343 344 345 346 347 ... 603 604

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 342

Kommentare zu diesen Handbüchern