Cisco 7609-S Configuration Guide - Page 406

Permitting or Denying Application Types with PISA Integration Chapter 21 Configuring Advanced Connection Features After the FWSM receives the packet and acts on the information, it strips the GRE encapsulation from the packet. When you configure the FWSM to deny traffic based on the PISA encapsulation, for the VLAN on which that traffic resides, the PISA encapsulates all traffic (including traffic that you did not specify for denial). The GRE encapsulation increases the packet size slightly, so you should increase the MTU between the PISA and the FWSM according to the "Changing the MTU on the Switch to Support Longer Packet Length" section on page 21-8. The GRE encapsulation causes a slight performance impact for PISA traffic sent to the FWSM. Failover Support Failover of the PISA is independent of failover of the FWSM. If you have Stateful Failover on the FWSM, then the session information is maintained across the failover. Configuring the FWSM to Deny PISA Traffic To identify traffic that you want to deny using PISA tagging, perform the following steps: Step 1 Step 2 Step 3 To identify the traffic that you want to deny based on the application type, add a class map using the class-map command. See the "Identifying Traffic (Layer 3/4 Class Map)" section on page 20-4 for more information. For example, you can match an access list: hostname(config)# access list BAD_APPS extended permit any 10.1.1.1 255.255.255.255 hostname(config)# class-map denied_apps hostname(config-cmap)# match access-list BAD_APPS To add or edit a policy map that sets the actions to take with the class map traffic, enter the following commands: hostname(config)# policy-map name hostname(config-pmap)# class class_map_name hostname(config-pmap-c)# where the class_map_name is the class map from Step 1. For example: hostname(config)# policy-map denied_apps_policy hostname(config-pmap)# class denied_apps hostname(config-pmap-c)# Determine which applications are permitted or denied by entering the following commands: hostname(config-pmap-c)# deny {all | protocol} hostname(config-pmap-c)# permit protocol Where the protocol argument is the protocol name or number. To see the supported protocol names, use the permit ? or deny ? command. You can combine permit and deny statements to narrow the traffic that you want denied. You must enter at least one deny statement. Unlike access lists, which have an implicit deny at the end, PISA actions have an implicit permit at the end. For example, to permit all traffic except for Skype, eDonkey, and Yahoo, enter the following commands: 21-6 Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM OL-20748-01