Cisco PIX 525 Especificaciones descargar pdf (Pagina 348)

100

101

21-22

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 21 Applying Application Layer Protocol Inspection

Managing GTP Inspection

Step 10 Return to global configuration mode by entering the following command:

hostname(config-pmap)# exit

hostname(config)#

Step 11 Apply the policy map globally or to a specific interface by entering the following command:

hostname(config)# service-policy

policy_map_name

[global | interface

interface_ID

Replace policy_map_name with the policy map you configured in Step 5, and identify all the interfaces

with the global option or a specific interface using the name assigned with the name-if command.

For example, the following command applies the inbound_policy to the outside interface:

hostname(config)# service-policy inbound_policy interface outside

The following command applies the inbound_policy to the all the security appliance interfaces:

hostname(config)# service-policy inbound_policy global

The following example shows how to use access lists to identify GTP traffic, define a GTP map, define

a policy, and apply the policy to the outside interface.

Example 21-3 Enabling and Configuring GTP Inspection

hostname(config)# access-list gtp_acl permit udp any any eq 3386

hostname(config)# access-list gtp_acl permit udp any any eq 2123

hostname(config)# class-map gtp-traffic

hostname(config-cmap)# match access-list gtp_acl

hostname(config-cmap)# exit

hostname(config)# gtp-map gtp-policy

hostname(config-gtp-map)# request-queue 300

hostname(config-gtp-map)# permit mcc 111 mnc 222

hostname(config-gtp-map)# message-length min 20 max 300

hostname(config-gtp-map)# drop message 20

hostname(config-gtp-map)# tunnel-limit 10000

hostname(config)# policy-map inspection_policy

hostname(config-pmap)# class gtp-traffic

hostname(config-pmap-c)# inspect gtp inbound_gtp

hostname(config)# service-policy inspection_policy outside

Table 21-4 summarizes the configuration commands available in GTP map configuration mode. Refer to

the command page in the Cisco Security Appliance Command Reference for the detailed syntax of each

command.

Table 21-4 GTP Map Configuration Commands

Command Description

description Specifies the GTP configuration map description.

drop Specifies the message ID, APN, or GTP version to drop.

help Displays help for GTP map configuration commands.

mcc Specifies the three-digit mobile country code (000 - 999) and the

two or three-digit mobile network code. One or two- digit entries

are prepended with 0s.

message-length Specifies the message length min and max values.

permit errors Permits packets with errors or different GTP versions.

1 2 ... 343 344 345 346 347 348 349 350 351 352 353 ... 603 604

Comentarios a estos manuales

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 348

Comentarios a estos manuales