2-5
Cisco 4700 Series Application Control Engine Appliance Administration Guide
OL-11157-01
Chapter 2 Enabling Remote Access to the ACE
Configuring Remote Network Management Traffic Services
Telnet and SSH remote access sessions are established to the ACE on a per context
basis. For details on creating users and contexts, see the
Cisco 4700 Series
Application Control Engine Appliance Virtualization Configuration Guide.
This section includes the following topics:
•
Creating and Configuring a Remote Management Class Map
•
Creating a Layer 3 and Layer 4 Remote Access Policy Map
•
Applying a Service Policy
Creating and Configuring a Remote Management Class Map
To create a Layer 3 and Layer 4 class map to classify the remote network
management traffic received by the ACE, use the
class-map type management
configuration-mode command. This command permits network management
traffic to be received by the ACE by identifying the incoming IP protocols that the
ACE can receive as well as the client source IP address and subnet mask as the
matching criteria. The
type management
keywords define the allowed network
traffic to manage security for protocols such as SSH, Telnet, and ICMP.
A class map can have multiple
match
commands. You can configure class maps
to define multiple management protocol and source IP address match commands
in a group that you then associate with a traffic policy. The
match-all
and
match-any
keywords determine how the ACE evaluates multiple match
statements operations when multiple match criteria exist in a class map.
The syntax of this command is:
class-map
type management
[
match-all
|
match-any
]
map_name
The keywords, arguments, and options are:
•
match-all | match-any
—(Optional) Determines how the ACE evaluates
Layer 3 and Layer 4 network management traffic when multiple match
criteria exist in a class map. The class map is considered a match if the match
commands meet one of the following conditions.
–
match-all
—(Default) All of the match criteria listed in the class map are
satisfied to match the network traffic class in the class map, typically
match commands of the same type.
