Cisco PIX 525 Specifiche Scaricare il pdf (Pagina 331)

21-5

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 21 Applying Application Layer Protocol Inspection

Applying Application Inspection to Selected Traffic

This section describes how to identify traffic to which you want to apply an inspection engine, how to

associate the inspection engine with a particular security policy, and how to apply the policy to one or

more interfaces on the security appliance. This section includes the following topics:

• Overview, page 21-5

• Identifying Traffic with a Traffic Class Map, page 21-6

• Using an Application Inspection Map, page 21-8

• Defining Actions with a Policy Map, page 21-9

• Applying a Security Policy to an Interface, page 21-10

Overview

Application inspection is enabled by default for many protocols, while it is disabled for other protocols.

In most cases, you can change the port on which the application inspection listens for traffic. To change

the default configuration for application inspection for any application inspection engine, use the

Modular Policy Framework CLI.

Modular Policy Framework provides a consistent and flexible way to configure security appliance

features in a manner to similar to Cisco IOS software Modular Quality of Server (QoS) CLI.

To use Modular Policy Framework to enable application inspection, perform the following steps:

Step 1 (Optional) Define a traffic class by entering the class-map command.

A traffic class is a set of traffic that is identifiable by its packet content. You only need to perform this

step if you want to change the default port assignments for application inspection or identify traffic to

be subjected to application inspection using other criteria, such as the IP address. For a list of default

port assignments used for application inspection, see Table 21-1.

Step 2 Create a policy map by associating the traffic class with one or more actions by entering the policy-map

command.

An action is a security feature, such as application inspection, that helps protect information or resources

on one or more protected network interfaces. Application inspection for a specific protocol is one type

of action that can be applied using Modular Policy Framework.

Step 3 (Optional) Use an application inspection map to change the parameters used for certain application

inspection engines.

The application inspection map command enables the configuration mode for a specific application

inspection engine, from where you can enter the commands required to change the configuration. The

supported application inspection map commands include the following:

• ftp-map—See Managing FTP Inspection, page 21-14.

• gtp-map—See Managing GTP Inspection, page 21-19.

• http-map—See Managing HTTP Inspection, page 21-30.

• mgcp-map—See Managing MGCP Inspection, page 21-33.

• snmp-map—See Managing SNMP Inspection, page 21-53.

For detailed information about the syntax for each of these commands, see the Cisco Security Appliance

Command Reference.

1 2 ... 326 327 328 329 330 331 332 333 334 335 336 ... 603 604

Nessun commento

Cisco PIX 525 Specifiche Pagina 331