Specifying The Layer 7 Sip Inspection Policy Map Actions - Cisco 4700M Configuration Manual

Configuring a Layer 7 SIP Inspection Policy

Specifying the Layer 7 SIP Inspection Policy Map Actions

Cisco 4700 Series Application Control Engine Appliance Security Configuration Guide
3-90
By default, the ACE allows all SIP packets to pass. To explicitly deny specific SIP
commands, use one of the following commands as the action if the specified SIP
traffic matches the classification. You apply the specified action against the single
inline match command in policy map SIP inspection match configuration mode
or against the specified class map in policy map SIP inspection class
configuration mode.
{{drop | permit | reset} [log]} | log
The keywords and options are as follows:
drop—Drops the SIP packet that matches the class map or the single inline
•
match command.
permit—(Default) Allows SIP traffic that matches the class map or the single
•
inline match command to pass through the ACE.
reset—Denies SIP traffic that matches the class map or the single inline
•
match command and resets the connection using the TCP RESET message.
log—Generates a log message for traffic that matches the class map or the
•
single inline match command.
For example, to specify an action in the Layer 7 SIP inspection policy map for
traffic that matches the associated Layer 7 SIP inspection class map, enter:
host1/Admin(config)# policy-map type inspect sip first-match
SIP_INSPECT_L7POLICY
host1/Admin(config-pmap-ins-sip)# class SIP_INSPECT_L7CLASS
host1/Admin(config-pmap-ins-sip-c)# drop
To specify an action in a Layer 7 SIP inspection policy map for traffic that
matches a single inline match command, enter:
host1/Admin(config)# policy-map type inspect sip first-match
SIP_INSPECT_L7POLICY
host1/Admin(config-pmap-ins-sip)# match SIP_MATCH calling-party
123abc.*
host1/Admin(config-pmap-ins-sip-m)# drop
To disable an action in the Layer 7 SIP inspection policy map, enter:
host1/Admin(config-pmap-ins-sip-m)# no drop
Chapter 3 Configuring Application Protocol Inspection
OL-16202-01