Dns Inspection - Cisco PIX 500 Series Configuration Manual

Chapter 25 Configuring Application Layer Protocol Inspection
To configure parameters that affect the inspection engine, perform the following steps:
Step 3
a.
b.
c.
The following example shows how to define a DCERPC inspection policy map with the timeout
configured for DCERPC pinholes.
hostname(config)# policy-map type inspect dcerpc dcerpc_map
hostname(config-pmap)# timeout pinhole 0:10:00
hostname(config)# class-map dcerpc
hostname(config-cmap)# match port tcp eq 135
hostname(config)# policy-map global-policy
hostname(config-pmap)# class dcerpc
hostname(config-pmap-c)# inspect msrpc dcerpc-map
hostname(config)# service-policy global-policy global

DNS Inspection

This section describes DNS application inspection. This section includes the following topics:
•
•
•
•
OL-12172-03
To enter parameters configuration mode, enter the following command:
hostname(config-pmap)# parameters
hostname(config-pmap-p)#
To configure the timeout for DCERPC pinholes and override the global system pinhole timeout of
two minutes, enter the following command:
hostname(config-pmap-p)# timeout pinhole hh:mm:ss
Where the hh:mm:ss argument is the timeout for pinhole connections. Value is between 0:0:1 and
1193:0:0.
To configure options for the endpoint mapper traffic, enter the following command:
hostname(config-pmap-p)# endpoint-mapper [epm-service-only] [lookup-operation
[timeout hh:mm:ss ]]
Where the hh:mm:ss argument is the timeout for pinholes generated from the lookup operation. If
no timeout is configured for the lookup operation, the timeout pinhole command or the default is
used. The epm-service-only keyword enforces endpoint mapper service during binding so that only
its service traffic is processed. The lookup-operation keyword enables the lookup operation of the
endpoint mapper service.
How DNS Application Inspection Works, page 25-14
How DNS Rewrite Works, page 25-14
Configuring DNS Rewrite, page 25-15
Verifying and Monitoring DNS Inspection, page 25-20
Cisco Security Appliance Command Line Configuration Guide
DNS Inspection
25-13