PIX - Advanced Protocol Handling
VendorCisco
PlatformPIX
Version8.x
Sunday, 18 May 2008 13:46

When using a "inspect policy map" you need to add it to a "standard policy-map" to allow you to add it to the service policy.

For each policy map there would be a class map, the inspect would match the FTP command, and then use the classmap “inspection-default” in the standard policy map.

Running Config

policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 512

policy-map type inspect ftp FTPPOL
 parameters
 class FTPCLASS
  reset log

policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect netbios
  inspect rsh
  inspect rtsp
  inspect skinny
  inspect esmtp
  inspect sqlnet
 inspect sunrpc
  inspect sip
  inspect xdmcp
policy-map FTPPOLICY2
 class inspection_default
  inspect ftp strict FTPPOL
!
service-policy global_policy global



 
We have 53 guests online