Cisco 4700M Configuration Manual page 216

Configuring a Layer 3 and Layer 4 Application Protocol Inspection Traffic Policy
The following examples show some of the generic class-map match statements
and an ACL that are not allowed in inspection configurations:
•
•
•
•
•
•
•
For application protocol inspection, the class map must have a specific protocol
(related to the inspection type) configured and a specific port or range of port
numbers.
For HTTP, FTP, RTSP, Skinny, and ILS protocol inspection, the class map must
have TCP as the configured protocol and a specific port or range of ports. For
example, enter the following commands:
host1/Admin(config)# class-map match-all L4_CLASS
host1/Admin(config-cmap)# match port tcp eq www
For SIP protocol inspection, the class map must have TCP or UDP as the
configured protocol and a specific port or range of ports. For example, enter the
following commands:
host1/Admin(config)# class-map match-all L4_CLASS
host1/Admin(config-cmap)# match port tcp eq 124
or
host1/Admin(config-cmap)# match port udp eq 135
For DNS inspection, the class map must have UDP as the configured protocol and
a specific port or range of ports. For example, enter the following commands:
host1/Admin(config)# class-map match-all L4_CLASS
host1/Admin(config-cmap)# match port udp eq domain
For ICMP protocol inspection, the class map must have ICMP as the configured
protocol. For example, enter the following commands:
host1/Admin(config)# access-list ACL1 extended permit icmp
192.168.12.15 255.255.255.0 192.168.16.25 255.255.255.0 echo
Cisco 4700 Series Application Control Engine Appliance Security Configuration Guide
3-92
match port tcp any
match port udp any
match port tcp range 0 65535
match port udp range 0 65535
match virtual-address 192.168.12.15 255.255.255.0 any
match virtual-address 192.168.12.15 255.255.255.0 tcp any
access-list acl1 line 10 extended permit ip any any
Chapter 3 Configuring Application Protocol Inspection
OL-16202-01