Cisco PIX 525 Dokumentacja Pobierz pdf (Strona 306)

100

101

18-14

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 18 Using Modular Policy Framework

Direction Policies When Applying a Service Policy

Figure 18-3 Match Port/Global Policy Topology

See the following commands for this example:

hostname(config)# class-map http

hostname(config-cmap)# match port tcp eq 80

hostname(config)# policy-map http

hostname(config-pmap)# class http

hostname(config-pmap-c)# inspect http

hostname(config-pmap-c)# police 1000000

hostname(config)# service-policy http global

Service Policy and NAT

When a policy map is applied as either an interface policy or a global policy, and the policy map refers

to class maps that use an access list with IP addresses, then the access list is installed as classification

rules on the interface or all interfaces (if global policy). Furthermore, if the IP addresses in the access

list involve NAT, then the following simple rule applies: the IP addresses inside the packets (or traffic)

on an interface are used for classification by the access list rules installed on the interface.

In the following example, Host CLIENT_D, located on the inside network, has two addresses: one is the

real IP address CLIENT_D_REAL, and the other one is the NAT (or also known as global) IP address

CLIENT_D_GLOBAL. When configuring an access list to classify traffic from CLIENT_D to any

outside hosts, and if the policy is to be applied on the inside interface, then CLIENT_D_REAL must be

used in the access list. This is the case because all CLIENT_D related traffic that passes through

interface inside will have CLIENT_D_REAL IP address. If, however, the policy is to be applied on the

outside interface, then CLIENT_D_GLOBAL should be used in the access list.

126993

outside inside

global

A B/80 inspection (input policy on 'outside' when service policy is global)

police (output policy on 'inside' interface)

B A/80 inspection (input policy on 'inside' when service policy is global)

police (output policy on 'outside' interface)

Host A

Host B

Security

appliance

1 2 ... 301 302 303 304 305 306 307 308 309 310 311 ... 603 604

Komentarze do niniejszej Instrukcji

Brak uwag

Cisco PIX 525 Dokumentacja Strona 306

Komentarze do niniejszej Instrukcji