firewall policies and vpn configurations 2006 phần 4

hạn chế bởi lệnh kiểm tra cũng cho phép bạn thay đổi giao cổng của giao thức. Sử dụng các ví dụ SMTP trên, chúng tôi sẽ sử dụng cổng 8080 cùng với mặc định kiểm tra SMTP (port 25). Trong mã trước , chúng tôi sử dụng lệnh fixup, tuy nhiên, | 130 Chapter 4 Deciding on a Firewall restricted by the inspection command also allows you to change the port assignment of the protocol. Using the above SMTP example we would use port 8080 along with the default inspect SMTP port 25 . In code we used the fixup command however now we need to use two class-map command is used to name the mapping . SMTP-INSPECTION-8080 and the match command is used to specify the port protocol and port number PIX1 config class-map SMTP-INSPECTION-8080 PIX1 config-cmap match port tcp eq 8080 PIX1 config-cmap exit PIX1 config The final result in the configuration looks like this class-map SMTP-INSPECTION match port tcp eq smtp 8080 class-map inspection_default match default-inspection-traffic Cisco PIX is now listening for SMTP traffic on port 8080 and port can also inspect a range of ports class-map RANGEOPORTS match port tcp range 1024 1055 The class-map of RANGEOPORTS now matches from 1024 to 1055. Providing support for complex protocols is a distinguishing characteristic of the PIX. The default class-map includes File Transfer Protocol FTP Hypertext Transfer Protocol HTTP Remote Shell RSH Real Time Streaming Protocol RTSP Simple Mail Transfer Protocol SMTP Extended Simple Mail Transfer Protocol ESMTP Serial Interface Protocol SIP skinny SNMP Media Gateway Control Protocol MGCP ICMP Network Basic Input Output System NetBIOS Domain Name Server DNS and Structured Query Language Network SQLNET . Application support of this type is the real power of the PIX firewall. The PIX is more than just a gatekeeper passing or blocking packets it understands the underlying protocol and actively rewrites the communications . enforcing RFCs eliminating dangerous commands and preventing the leakage of information to provide the highest level of security available consistent with application functionality. The following example uses the FTP inspection engine that is enabled by Deciding on a Firewall .