Cisco PIX 525 Especificaciones descargar pdf (Pagina 301)

100

101

18-9

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 18 Using Modular Policy Framework

Defining Actions Using a Policy Map

hostname(config)# policy-map global_policy

hostname(config-pmap)# class telnet_traffic

hostname(config-pmap-c)# set connection timeout tcp 0:0:0

hostname(config-pmap-c)# set connection conn-max 100

hostname(config-pmap)# class ftp_traffic

hostname(config-pmap-c)# set connection timeout tcp 0:5:0

hostname(config-pmap-c)# set connection conn-max 50

hostname(config-pmap)# class tcp_traffic

hostname(config-pmap-c)# set connection timeout tcp 2:0:0

hostname(config-pmap-c)# set connection conn-max 2000

hostname(config-pmap)# class udp_traffic

hostname(config-pmap-c)# set connection conn-max 1000

In this example, there is only one feature domain, but with multiple class maps and associated actions:

When a Telnet connection is initiated, it will match class telnet_traffic within the set-connection domain

and the associated actions will be applied. Once there is a match, it will not attempt to match the rest of

the class maps, even if the Telnet connection can match the tcp_traffic class map. Similarly, if an FTP

connection is initiated, it will not match the telnet_traffic class, but it will match the ftp_traffic class.

Once there is a match, there will be no more attempts to match the rest of the class maps. For any TCP

connection other than Telnet and FTP, it will match the tcp_traffic class map and, for any UDP traffic, it

will match the udp_traffic class map.

Action Order

The order in which different types of actions in a policy map are performed is independent of the order

in which the actions appear in the policy map. Actions are performed in the following order:

• Set connection policy—set connection

• Inspection policy—inspect

• QoS policy—police

• Priority queuing—priority

Table 18-5 Example Modular Policy Framework Feature Domains and Descriptions

Domain

Domain Class

Map Domain Action Command Description

set-connection telnet_traffic set connection timeout tcp 0:0:0

set connection conn-max 100

For all Telnet traffic, set the TCP

idle timeout to never time out

and set the total number of

Telnet connections to 100.

ftp_traffic set connection timeout tcp 0:5:0

set connection conn-max 2000

For all FTP traffic, set the TCP

idle timeout to five minutes and

set the total number of FTP

connections to 50.

tcp_traffic set connection timeout tcp 2:0:0

set connection conn-max 2000

For all other TCP traffic, set the

TCP idle timeout to two hours

and set the total number of other

TCP connections to 2000.

udp_traffic set connection conn-max 1000 Set the total number of UDP

connections to 1000.

1 2 ... 296 297 298 299 300 301 302 303 304 305 306 ... 603 604

Comentarios a estos manuales

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 301

Comentarios a estos manuales