Cisco PIX 525 Specifikace stáhnout pdf (Strana 299)

100

101

18-7

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 18 Using Modular Policy Framework

Defining Actions Using a Policy Map

Restrictions

If there is no match default_inspection_traffic or match tunnel-group command in a class map, then

at most one inspect command is allowed to be configured under the class. For example, the following

class map can be associated with no more than one inspection action.

hostname(config)# class-map ftp-s

hostname(config-cmap)# match port tcp eq 21

hostname(config)# policy-map test

hostname(config-pmap)# class ftp-s

hostname(config-pmap-c)# inspect ftp

Classification Policy within a Policy Map

This section describes how to use a classification policy to classify traffic across all class maps when

there are multiple class maps and actions present in a policy map.

This section includes the following topics:

• Multi-match Classification Policy across Multiple Feature Domains, page 18-7

• First-match Policy within a Feature Domain, page 18-8

• Action Order, page 18-9

• Advanced Options, page 18-10

Multi-match Classification Policy across Multiple Feature Domains

When a policy map is configured, Modular Policy Framework features/actions and associated class maps

are divided into separate domains based on the type of actions. Because packet classification is

performed across all domains that are present in a policy map, the act of classification may produce

multiple match results because a packet may match the classification criteria in multiple domains.

Table 18-3 shows Modular Policy Framework feature domains and commands.

The following example shows how multi-match works in a policy map:

hostname(config)# class-map inspection_default

hostname(config-cmap)# match default-inspection-traffic

hostname(config)# class-map http_traffic

hostname(config-cmap)# match port tcp eq 80

Table 18-3 Modular Policy Framework Feature Domains and Commands

Feature Domain Domain Action Command

inspection_type-domain inspect inspection_type

where inspection_type is a specific inspection type such as

HTTP, FTP, and so on.

set-connection-domain All set connection commands.

police-domain All police commands.

priority-queuing-domain All priority commands.

IPS-domain All ips commands.

1 2 ... 294 295 296 297 298 299 300 301 302 303 304 ... 603 604

Komentáře k této Příručce

Žádné komentáře

Cisco PIX 525 Specifikace Strana 299

Komentáře k této Příručce