Cisco 500 Series, Руководство по настройке

Страница: 405 / 1140

21-17
Cisco Security Appliance Command Line Configuration Guide
OL-12172-03
Chapter 21 Using Modular Policy Framework
Defining Actions Using a Layer 3/4 Policy Map
Step 1
Add the policy map by entering the following command:
hostname(config)# policy-map policy_map_name
The policy_map_name argument is the name of the policy map up to 40 characters in length. All types
of policy maps use the same name space, so you cannot reuse a name already used by another type of
policy map. The CLI enters policy-map configuration mode.
Step 2
(Optional) Specify a description for the policy map:
hostname(config-pmap)# description text
Step 3 Specify a previously configured Layer 3/4 class map using the following command:
hostname(config-pmap)# class class_map_name
where the class_map_name is the name of the class map you created earlier. See the “Identifying Traffic
Using a Layer 3/4 Class Map” section on page 21-2 to add a class map.
Step 4 Specify one or more actions for this class map.
•
IPS. See the “Diverting Traffic to the AIP SSM” section on page 22-8 .
• CSC. See the “Diverting Traffic to the CSC SSM” section on page 22-16 .
•
TCP normalization. See the “Configuring TCP Normalization” section on page 23-11 .
• TCP and UDP connection limits and timeouts, and TCP sequence number randomization. See the
“Configuring Connection Limits and Timeouts” section on page 23-14 .
•
QoS policing and QoS priority. See Chapter 24, “Applying QoS Policies.”
• Application inspection. See Chapter 25, “Configuring Application Layer Protocol Inspection.”
Note
If there is no match default_inspection_traffic command in a class map, then at most one
inspect command is allowed to be configured under the class.
Step 5 Repeat Step 3 and Step 4 for each class map you want to include in this policy map.
The following is an example of a policy-map command for connection policy. It limits the number of
connections allowed to the web server 10.1.1.1:
hostname(config)# access-list http-server permit tcp any host 10.1.1.1
hostname(config)# class-map http-server
hostname(config-cmap)# match access-list http-server
hostname(config)# policy-map global-policy
hostname(config-pmap)# description This policy map defines a policy concerning connection
to http server.
hostname(config-pmap)# class http-server
hostname(config-pmap-c)# set connection conn-max 256
The following example shows how multi-match works in a policy map:
hostname(config)# class-map inspection_default
hostname(config-cmap)#
match default-inspection-traffic
hostname(config)# class-map http_traffic
hostname(config-cmap)# match port tcp eq 80
hostname(config)# policy-map outside_policy
hostname(config-pmap)# class inspection_default