Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 344)

100

101

21-18

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 21 Applying Application Layer Protocol Inspection

Managing FTP Inspection

The following complete example shows how to identify FTP traffic, define a FTP map, define a policy,

and apply the policy to the outside interface.

Example 21-2 Enabling and Configuring Strict FTP Inspection

hostname(config)# class-map ftp_port

hostname(config-cmap)# match port tcp eq 21

hostname(config-cmap)# exit

hostname(config)# ftp-map inbound_ftp

hostname(config-ftp-map)# request-command deny put stou appe

hostname(config-ftp-map)# exit

hostname(config)# policy-map inbound_policy

hostname(config-pmap)# class ftp_port

hostname(config-pmap-c)# inspect ftp strict inbound_ftp

hostname(config-pmap-c)# exit

hostname(config-pmap)# exit

hostname(config)# service-policy inbound_policy interface outside

To enable FTP inspection for all interfaces, enter the global parameter in place of interface outside.

Verifying and Monitoring FTP Inspection

FTP application inspection generates the following log messages:

• An Audit record 302002 is generated for each file that is retrieved or uploaded.

• The ftp command is checked to see if it is RETR or STOR and the retrieve and store commands are

logged.

• The username is obtained by looking up a table providing the IP address.

Table 21-3 FTP Map request-command deny Options

request-command deny Option Purpose

appe Disallows the command that appends to a file.

cdup Disallows the command that changes to the parent directory of the

current working directory.

dele Disallows the command that deletes a file on the server.

get Disallows the client command for retrieving a file from the server.

help Disallows the command that provides help information.

mkd Disallows the command that makes a directory on the server.

put Disallows the client command for sending a file to the server.

rmd Disallows the command that deletes a directory on the server.

rnfr Disallows the command that specifies rename-from filename.

rnto Disallows the command that specifies rename-to filename.

site Disallows the command that are specific to the server system.

Usually used for remote administration.

stou Disallows the command that stores a file using a unique file name.

1 2 ... 339 340 341 342 343 344 345 346 347 348 349 ... 603 604

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 344

Kommentare zu diesen Handbüchern