354
TCP packets using port 8080 sent to the network segment 10.110.0.0 are regarded as HTTP
packets. The address range of hosts can be specified by means of a basic ACL.
To configure port mapping:
To do...
Command...
Remarks
1.
Enter system view.
system-view
—
2.
Configure mapping between
the port and the application
protocol.
port-mapping
application-name
port
port-number
[
acl
acl-number
]
Required.
Not configured by default.
The application layer protocols
supported by this function include
FTP, GTP, H323, HTTP, RTSP,
SCCP, SIP, SMTP, and SQLNET.
Displaying and maintaining ASPF
To do...
Command...
Remarks
Display all ASPF policy and session
information
display
aspf
all
[ | {
begin
|
exclude
|
include
}
regular-expression
]
Available in any view
Display the ASPF policy configuration
applied the interface
display
aspf
interface
[ | {
begin
|
exclude
|
include
}
regular- expression
]
Available in any view
Display the configuration information
of a specific ASPF policy
display
aspf
policy
aspf-policy-number
[ | {
begin
|
exclude
|
include
}
regular-expression
]
Available in any view
Display the port mapping information
display
port-mapping
[
application-
name
|
port
port-number
] [ | {
begin
|
exclude
|
include
}
regular-
expression
]
Available in any view
ASPF configuration example
Network requirements
•
Configure an ASPF policy on Router A to detect the FTP and HTTP traffic flows passing through
Router A.
•
Only return packets for FTP and HTTP connections initiated by users on the internal network are
permitted to pass through Router A and get into the internal network. All other types of packets are
blocked. In addition, this ASPF policy should be able to block Java applets carried in HTTP packets
from the server 2.2.2.11.
This example is suitable for a scenario where local users have to gain access to remote servers.
