Applying A Layer 3/4 Policy To An Interface Using A Service Policy - Cisco PIX 500 Series Configuration Manual

Applying a Layer 3/4 Policy to an Interface Using a Service Policy

hostname(config-pmap-c)# inspect http http_map
hostname(config-pmap-c)# inspect sip
hostname(config-pmap)# class http_traffic
hostname(config-pmap-c)# set connection timeout tcp 0:10:0
The following example shows how traffic matches the first available class map, and will not match any
subsequent class maps that specify actions in the same feature domain:
hostname(config)# class-map telnet_traffic
hostname(config-cmap)# match port tcp eq 23
hostname(config)# class-map ftp_traffic
hostname(config-cmap)# match port tcp eq 21
hostname(config)# class-map tcp_traffic
hostname(config-cmap)# match port tcp range 1 65535
hostname(config)# class-map udp_traffic
hostname(config-cmap)# match port udp range 0 65535
hostname(config)# policy-map global_policy
hostname(config-pmap)# class telnet_traffic
hostname(config-pmap-c)# set connection timeout tcp 0:0:0
hostname(config-pmap-c)# set connection conn-max 100
hostname(config-pmap)# class ftp_traffic
hostname(config-pmap-c)# set connection timeout tcp 0:5:0
hostname(config-pmap-c)# set connection conn-max 50
hostname(config-pmap)# class tcp_traffic
hostname(config-pmap-c)# set connection timeout tcp 2:0:0
hostname(config-pmap-c)# set connection conn-max 2000
When a Telnet connection is initiated, it matches class telnet_traffic. Similarly, if an FTP connection is
initiated, it matches class ftp_traffic. For any TCP connection other than Telnet and FTP, it will match
class tcp_traffic. Even though a Telnet or FTP connection can match class tcp_traffic, the security
appliance does not make this match because they previously matched other classes.
Applying a Layer 3/4 Policy to an Interface Using a Service
Policy
To activate the Layer 3/4 policy map, create a service policy that applies it to one or more interfaces or
that applies it globally to all interfaces. Interface service policies take precedence over the global service
policy.
•
•
For example, the following command enables the inbound_policy policy map on the outside interface:
Cisco Security Appliance Command Line Configuration Guide
21-18
To create a service policy by associating a policy map with an interface, enter the following
command:
hostname(config)# service-policy policy_map_name interface interface_name
To create a service policy that applies to all interfaces that do not have a specific policy, enter the
following command:
hostname(config)# service-policy policy_map_name global
By default, the configuration includes a global policy that matches all default application inspection
traffic and applies inspection to the traffic globally. You can only apply one global policy, so if you
want to alter the global policy, you need to either edit the default policy or disable it and apply a new
one.
The default service policy includes the following command:
service-policy global_policy global
Chapter 21 Using Modular Policy Framework
OL-12172-03