Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 352)

100

101

21-26

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 21 Applying Application Layer Protocol Inspection

Managing H.323 Inspection

• It has been observed that when a NetMeeting client registers with an H.323 gatekeeper and tries to

call an H.323 gateway that is also registered with the H.323 gatekeeper, the connection is established

but no voice is heard in either direction. This problem is unrelated to the security appliance.

• If you configure a network static address where the network static address is the same as a

third-party netmask and address, then any outbound H.323 connection fails.

Enabling and Configuring H.323 Inspection

To enable H.323 inspection or change the default port used for receiving H.323 traffic, perform the

following steps:

Step 1 Define access control lists to identify the two ports required for receiving H.323 traffic. For example, the

following commands identify the default ports for H.323 inspection.

hostname(config)# access-list h323_acl permit udp any any eq 1720

hostname(config)# access-list h323_acl permit udp any any eq 1721

Step 2 Name the traffic class by entering the following command in global configuration mode:

hostname(config)# class-map

class_map_name

Replace class_map_name with the name of the traffic class, for example:

hostname(config)# class-map h323_port

When you enter the class-map command, the CLI enters the class map configuration mode, and the

prompt changes, as in the following example:

hostname(config-cmap)#

In the class map configuration mode, define the match command, as in the following example:

hostname(config-cmap)# match access-list h323_acl

hostname(config-cmap)# exit

hostname(config)#

To assign a range of continuous ports, enter the range keyword, as in the following example:

hostname(config-cmap)# match port tcp range 1718-1720

To assign more than one non-contiguous port for H323 inspection, enter the access-list command and

define an access control entry to match each port. Then enter the match command to associate the access

lists with the H323 traffic class.

Step 3 Name the policy map by entering the following command:

hostname(config)# policy-map

policy_map_name

Replace policy_map_name with the name of the policy map, as in the following example:

hostname(config)# policy-map inbound_policy

The CLI enters the policy map configuration mode and the prompt changes accordingly, as follows:

hostname(config-pmap)#

Step 4 Specify the traffic class defined in Step 2 to be included in the policy map by entering the following

command:

hostname(config-pmap)# class

class_map_name

1 2 ... 347 348 349 350 351 352 353 354 355 356 357 ... 603 604

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 352

Kommentare zu diesen Handbüchern