Cisco 7604 Configuration Guide - Page 517

Chapter 22 Applying Application Layer Protocol Inspection Sun RPC Inspection where port_number is the port to which the port mapper process listens. If you need to assign a range of contiguous ports, use the range keyword, as in the following example: hostname(config-cmap)# match port tcp range begin_port_number end_port_number Tip To identify two or more non-contiguous ports, enter the access-list extended command and define an ACE to match each port. Then, rather than the match port command, use the match access-list command to associate the access list with the Sun RPC traffic class. Step 4 Step 5 Step 6 Step 7 Create a policy map or modify an existing policy map that you want to use to apply the Sun RPC inspection engine to the Sun RPC traffic. To do so, use the policy-map command, as follows: hostname(config-cmap)# policy-map policy_map_name hostname(config-pmap)# where policy_map_name is the name of the policy map. The CLI enters the policy map configuration mode and the prompt changes accordingly. Specify the class map, created in Step 2, that identifies the Sun RPC traffic. Use the class command to do so, as follows: hostname(config-pmap)# class class_map_name hostname(config-pmap-c)# where class_map_name is the name of the class map you created in Step 2. The CLI enters the policy map class configuration mode and the prompt changes accordingly. Enable Sun RPC application inspection. To do so, enter the following command: hostname(config-pmap-c)# inspect sunrpc hostname(config-pmap-c)# Use the service-policy command to apply the policy map globally or to a specific interface, as follows: hostname(config-pmap-c)# service-policy policy_map_name [global | interface interface_ID] hostname(config)# where policy_map_name is the policy map you configured in Step 4. If you want to apply the policy map to traffic on all the interfaces, use the global option. If you want to apply the policy map to traffic on a specific interface, use the interface interface_ID option, where interface_ID is the name assigned to the interface with the nameif command. The FWSM begins inspecting Sun RPC traffic, as specified. Example 22-15 Enabling and Configuring TCP-based Sun RPC Inspection The following example enables Sun RPC application inspection on traffic sent to TCP port 111 from the outside interface: hostname(config)# class-map sunrpc_port hostname(config-cmap)# match port tcp eq 111 hostname(config-cmap)# policy-map sample_policy hostname(config-pmap)# class sunrpc_port hostname(config-pmap-c)# inspect sunrpc hostname(config-pmap-c)# service-policy sample_policy interface outside hostname(config)# OL-20748-01 Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM 22-101