Cisco ASA 5508-X, Руководство по настройке

Страница: 297 / 428

13-23
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 13 Inspection of Basic Internet Protocols
Instant Messaging Inspection
•
match [ not ] service {chat | file-transfer | webcam | voice-chat | conference |
games} —Matches the specific IM service.
• match [ not ] login-name regex { regex_name | class class_name }—Matches the source client
login name of the IM message against the specified regular expression or regular expression
class.
•
match [ not ] peer-login-name regex { regex_name | class class_name }—Matches the
destination peer login name of the IM message against the specified regular expression or
regular expression class.
• match [ not ] ip-address ip_address mask }—Matches the source IP address and mask of the IM
message.
•
match [ not ] peer-ip-address ip_address mask }—Matches the destination IP address and mask
of the IM message.
• match [ not ] version regex { regex_name | class class_name }—Matches the version of the IM
message against the specified regular expression or regular expression class.
•
match [ not ] filename regex { regex_name | class class_name }—Matches the filename of the
IM message against the specified regular expression or regular expression class. This match is
not supported for the MSN IM protocol.
d. Enter exit to leave class map configuration mode.
Step 2
Create an IM inspection policy map:
hostname(config)#
policy-map type inspect im
policy_map_name
hostname(config-pmap)#
Where the policy_map_name is the name of the policy map. The CLI enters policy-map configuration
mode.
Step 3
(Optional) To add a description to the policy map, enter the following command:
hostname(config-pmap)# description string
Step 4 To apply actions to matching traffic, perform the following steps.
a.
Specify the traffic on which you want to perform actions using one of the following methods:
• If you created an IM class map, specify it by entering the following command:
hostname(config-pmap)# class class_map_name
hostname(config-pmap-c)#
•
Specify traffic directly in the policy map using one of the match commands described for IM
class maps. If you use a match not command, then any traffic that does not match the criterion
in the match not command has the action applied.
b. Specify the action you want to perform on the matching traffic by entering the following command:
hostname(config-pmap-c)# { drop-connection [ log ]| reset [ log ] | log }
The drop-connection keyword drops the packet and closes the connection.
The reset keyword drops the packet, closes the connection, and sends a TCP reset to the server or
client.
The log keyword, which you can use alone or with one of the other keywords, sends a system log
message.