Cisco ASA 5512-X, Руководство по настройке

Страница: 250 / 422

10-14
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 10 Inspection for Management Application Protocols
RADIUS Accounting Inspection
match port udp eq radius-acct
policy-map global_policy
class radius-class
inspect radius-accounting radius-acct-pmap
Configure the RADIUS Accounting Inspection Service Policy
RADIUS accounting inspection is not enabled in the default inspection policy, so you must enable it if
you need this inspection. Because RADIUS accounting inspection is for traffic directed to the ASA, you
must configure it as a management inspection rule rather than a standard rule.
Procedure
Step 1 Create an L3/L4 management class map to identify the traffic for which you want to apply the inspection,
and identify the matching traffic.
class-map type management name
match {port | access-list} parameter
Example:
hostname(config)# class-map type management radius-class-map
hostname(config-cmap)# match port udp eq radius-acct
In this example, the match is for the radius-acct UDP port, which is 1646. You can specify a different
port, a range of ports (
match port udp range number1 number2 ) or use match access-list acl_name
and use an ACL.
Step 2
Add or edit a policy map that sets the actions to take with the class map traffic.
policy-map name
Example:
hostname(config)# policy-map global_policy
In the default configuration, the global_policy policy map is assigned globally to all interfaces. If you
want to edit the global_policy, enter global_policy as the policy name.
Step 3 Identify the L3/L4 management class map you are using for RADIUS accounting inspection.
class name
Example:
hostname(config-pmap)# class radius-class-map
Step 4 Configure RADIUS accounting inspection.
inspect radius-accounting radius_accounting_policy_map
Where radius_accounting_policy_map is the RADIUS accounting inspection policy map you created in
Configure a RADIUS Accounting Inspection Policy Map, page 10-12 .
Example:
hostname(config-class)# no inspect radius-accounting
hostname(config-class)# inspect radius-accounting radius-class-map