Cisco PIX 525 Dokumentacja Pobierz pdf (Strona 367)

100

101

21-41

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 21 Applying Application Layer Protocol Inspection

Managing RTSP Inspection

Restrictions and Limitations

The following restrictions apply to the inspect rtsp command. The security appliance does not support

multicast RTSP or RTSP messages over UDP.

• PAT is not supported with the inspect rtsp command.

• The security appliance does not have the ability to recognize HTTP cloaking where RTSP messages

are hidden in the HTTP messages.

• The security appliance cannot perform NAT on RTSP messages because the embedded IP addresses

are contained in the SDP files as part of HTTP or RTSP messages. Packets could be fragmented and

security appliance cannot perform NAT on fragmented packets.

• With Cisco IP/TV, the number of NATs the security appliance performs on the SDP part of the

message is proportional to the number of program listings in the Content Manager (each program

listing can have at least six embedded IP addresses).

• You can configure NAT for Apple QuickTime 4 or RealPlayer. Cisco IP/TV only works with NAT

if the Viewer and Content Manager are on the outside network and the server is on the inside

network.

Enabling and Configuring RTSP Inspection

To enable or configure RTSP application inspection, perform the following steps:

Step 1 Define access control lists to identify the two ports required for receiving RTSP traffic. For example, the

following commands identify the default ports for RTSP inspection:

hostname(config)# access-list rtsp_acl permit tcp any any eq 554

hostname(config)# access-list rtsp_acl permit tcp any any eq 8554

Step 2 Name the traffic class by entering the following command in global configuration mode:

hostname(config)# class-map

class_map_name

Replace class_map_name with the name of the traffic class, for example:

hostname(config)# class-map rtsp_port

When you enter the class-map command, the CLI enters the class map configuration mode, and the

prompt changes, as in the following example:

hostname(config-cmap)#

Step 3 In the class map configuration mode, define the match command, as in the following example:

hostname(config-cmap)# match access-list rtsp_acl

hostname(config-cmap)# exit

hostname(config)#

Step 4 Name the policy map by entering the following command:

hostname(config)# policy-map

policy_map_name

Replace policy_map_name with the name of the policy map, as in the following example:

hostname(config)# policy-map inbound_policy

1 2 ... 362 363 364 365 366 367 368 369 370 371 372 ... 603 604

Komentarze do niniejszej Instrukcji

Brak uwag

Cisco PIX 525 Dokumentacja Strona 367

Komentarze do niniejszej Instrukcji