Cisco 4700M Manuel utilisateur

Americas Headquarters

Cisco Systems, Inc.

170 West Tasman Drive

San Jose, CA 95134-1706

USA

http://www.cisco.com

Tel: 408 526-4000

800 553-NETS (6387)

Fax: 408 527-0883

Cisco 4700 Series Application

Control Engine Appliance Security

Configuration Guide

Text Part Number: OL-16202-01

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT

NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT

ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR

THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION

PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO

LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE

PROVIDED “AS IS” WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED

OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND

NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL

DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR

INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH

DAMAGES.

CCDE, CCENT, CCSI, Cisco Eos, Cisco HealthPresence, Cisco IronPort, the Cisco logo, Cisco Lumin, Cisco Nexus, Cisco Nurse Connect,

Cisco Pulse, Cisco StackPower, Cisco StadiumVision, Cisco TelePresence, Cisco Unified Computing System, Cisco WebEx, DCE, Flip Channels,

Flip for Good, Flip Mino, Flipshare (Design), Flip Ultra, Flip Video, Flip Video (Design), Instant Broadband, and Welcome to the Human Network

are trademarks; Changing the Way We Work, Live, Play, and Learn, Cisco Capital, Cisco Capital (Design), Cisco:Financed (Stylized), Cisco Store,

and Flip Gift Card are service marks; and Access Registrar, Aironet, AllTouch, AsyncOS, Bringing the Meeting To You, Catalyst, CCDA, CCDP,

CCIE, CCIP, CCNA, CCNP, CCSP, CCVP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems,

Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Collaboration Without Limitation, Continuum, EtherFast, EtherSwitch, Event Center,

Explorer, Fast Step, Follow Me Browsing, FormShare, GainMaker, GigaDrive, HomeLink, iLYNX, Internet Quotient, IOS, iPhone, iQuick Study,

IronPort, the IronPort logo, Laser Link, LightStream, Linksys, MediaTone, MeetingPlace, MeetingPlace Chime Sound, MGX, Networkers,

Networking Academy, Network Registrar, PCNow, PIX, PowerKEY, PowerPanels, PowerTV, PowerTV (Design), PowerVu, Prisma, ProConnect,

ROSA, ScriptShare, SenderBase, SMARTnet, Spectrum Expert, StackWise, The Fastest Way to Increase Your Internet Quotient, TransPath, WebEx,

and the WebEx logo are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.

All other trademarks mentioned in this document or website are the property of their respective owners. The use of the word partner does not imply

a partnership relationship between Cisco and any other company. (0908R)

Cisco 4700 Series Application Control Engine Appliance Security Configuration Guide

iii

Cisco 4700 Series Application Control Engine Appliance Security Configuration Guide

OL-16202-01

CONTENTS

Preface xvii

Audience xviii

How to Use This Guide xviii

Related Documentation xix

Symbols and Conventions xxii

Obtaining Documentation, Obtaining Support, and Security Guidelines xxiv

CHAPTER

1Configuring Security Access Control Lists 1-1

ACL Overview 1-2

ACL Types and Uses 1-3

ACL Guidelines 1-3

ACL Entry Order 1-3

ACL Implicit Deny 1-4

Maximum Number of ACLs and ACL Entries 1-4

ACL Configuration Quick Start 1-4

Configuring ACLs 1-6

Configuring an Extended ACL 1-6

Configuring Comments in an Extended ACL 1-16

Configuring an EtherType ACL 1-17

Resequencing Entries 1-18

Simplifying Access Control Lists with Object Groups 1-20

Overview of Object Groups 1-20

Configuring Network Object Groups 1-21

Contents

Cisco 4700 Series Application Control Engine Appliance Security Configuration Guide

OL-16202-01

Creating a Network Object Group 1-22

Adding a Description to a Network Object Group 1-22

Configuring a Network IP Address for a Network Object Group 1-23

Configuring a Host IP Address 1-23

Configuring Service Object Groups 1-24

Creating a Service Object Group 1-24

Adding a Description to a Service Object Group 1-25

Defining Protocol Parameters for a Service Object Group 1-26

Using Object Groups in an ACL 1-28

Example of Configuring an Extended ACL Without Object Groups 1-28

Example of Configuring the Equivalent Extended ACL Using Object

Groups 1-29

Example of How an Object Group Expands into Multiple ACL

Entries 1-30

Applying an ACL to an Interface 1-31

Applying an ACL Globally to All Interfaces in a Context 1-32

Filtering Traffic with an ACL 1-33

ACL Configuration Examples 1-33

Examples of Extended ACLs 1-33

Inbound and Outbound ACLs 1-35

IP Addresses for ACLs with NAT 1-38

Examples of EtherType ACLs 1-42

Displaying ACL Configuration Information and Statistics 1-43

Displaying ACL Configuration Information 1-43

Displaying ACL Statistics 1-43

Displaying the ACL Merge Tree Node Usage 1-45

Clearing ACL Statistics 1-45

CHAPTER

2Configuring Authentication and Accounting Services 2-1

AAA Overview 2-2

Cisco 4700 Series Application Control Engine Appliance Security Configuration Guide

OL-16202-01

Contents

Local Database and Remote Server Support 2-4

Local Database 2-5

TACACS+ Server 2-5

RADIUS Server 2-6

LDAP Directory Server 2-6

Authentication Overview 2-7

Accounting Overview 2-8

Authentication and Accounting Configuration Quick Start 2-8

Configuring the AAA Server 2-11

Configuring a TACACS+ Server 2-11

Configuring Authentication Settings on the TACACS+ Server 2-11

Configuring Accounting Settings on the TACACS+ Server 2-12

Defining Private Attributes for Virtualization Support in a TACACS+

Server 2-13

Configuring a RADIUS Server 2-15

Configuring Authentication Settings on the RADIUS Server 2-15

Configuring Accounting Settings on the RADIUS Server 2-16

Defining Private Attributes for Virtualization Support in a RADIUS

Server 2-17

Configuring an LDAP Server 2-19

Defining Private Attributes for Virtualization Support in an LDAP

Server 2-20

Creating User Accounts 2-23

Configuring the ACE as a Client of a RADIUS, TACACS+, or LDAP Server 2-24

Configuring RADIUS on the ACE 2-25

Setting the RADIUS Server Parameters 2-25

Configuring the RADIUS NAS-IP-Address Attribute 2-28

Setting the Global RADIUS Server Preshared Key 2-28

Configuring the Global RADIUS Server Dead-Time Interval 2-29

Setting the Global RADIUS Server Number of Retransmissions 2-30

Contents

Cisco 4700 Series Application Control Engine Appliance Security Configuration Guide

OL-16202-01

Setting the Global RADIUS Server Timeout Value 2-31

Configuring TACACS+ on the ACE 2-31

Setting the TACACS+ Server Parameters 2-32

Setting the Global Preshared Key 2-33

Setting the Global TACACS+ Server Dead-Time Interval 2-34

Setting the Global TACACS+ Server Timeout Value 2-35

Configuring LDAP on the ACE 2-35

Setting the LDAP Server Parameters 2-36

Setting the Global LDAP Server Port Setting 2-37

Setting the Global LDAP Server Timeout Value 2-38

Configuring AAA Server Groups 2-38

Creating a TACACS+, RADIUS, or LDAP Server Group 2-39

Setting the Dead-Time Interval for a TACACS+ Server Group 2-41

Setting the Dead-Time Interval for a RADIUS Server Group 2-42

Configuring the User Profile Attribute Type for an LDAP Server

Group 2-43

Configuring the Base DN for an LDAP Server Group 2-44

Configuring the Search Filter for an LDAP Server Group 2-45

Defining the Login Authentication Method 2-46

Defining the Default Accounting Method 2-48

Viewing AAA Status and Statistics 2-49

Displaying AAA Groups 2-49

Displaying RADIUS Server Configuration Information 2-49

Displaying TACACS+ Server Configuration Information 2-51

Displaying LDAP Server Configuration Information 2-52

Displaying Accounting Configuration Information 2-52

Displaying Accounting Log Information 2-53

Displaying Authentication Configuration Information 2-54

vii

Cisco 4700 Series Application Control Engine Appliance Security Configuration Guide

OL-16202-01

Contents

CHAPTER

3Configuring Application Protocol Inspection 3-1

Application Protocol Inspection Overview 3-2

Performing Application Protocol Inspection 3-2

Application Inspection Protocol Overview 3-9

DNS Inspection 3-9

FTP Inspection 3-10

HTTP Deep Packet Inspection 3-12

ICMP Inspection 3-12

ILS Inspection 3-14

RTSP Inspection 3-15

SCCP Inspection 3-16

SIP Inspection 3-18

Application Protocol Inspection Configuration Quick Start Procedures 3-21

Configuring a Layer 7 FTP Command Inspection Policy 3-30

Configuring an FTP Inspection Class Map 3-31

Creating an FTP Inspection Class Map 3-31

Adding a Layer 7 FTP Inspection Class Map Description 3-32

Defining FTP Match Request Methods 3-32

Configuring a Layer 7 FTP Command Inspection Policy Map 3-33

Creating a Layer 7 FTP Command Inspection Policy Map 3-34

Adding a Layer 7 FTP Inspection Policy Map Description 3-34

Including Inline Match Statements in a Layer 7 FTP Command Inspection

Policy Map 3-35

Associating a Layer 7 FTP Command Inspection Traffic Class with the

Traffic Policy 3-36

Specifying the Layer 7 FTP Command Inspection Policy Actions 3-37

Configuring a Layer 7 HTTP Deep Inspection Policy 3-38

Configuring a Layer 7 HTTP Deep Inspection Class Map 3-39

Creating an HTTP Deep Inspection Class Map 3-39

Contents

viii

Cisco 4700 Series Application Control Engine Appliance Security Configuration Guide

OL-16202-01

Adding a Layer 7 HTTP Deep Packet Inspection Class Map

Description 3-41

Defining HTTP Content Match Criteria 3-42

Defining the Length of the HTTP Content for Inspection 3-43

Defining a Secondary Cookie for HTTP Inspection 3-44

Defining an HTTP Header for Inspection 3-48

Defining the HTTP Maximum Header Length for Inspection 3-52

Defining a Header MIME-Type Messages for Inspection 3-53

Defining an HTTP Traffic Restricted Category 3-56

Defining HTTP Request Methods and Extension Methods 3-58

Defining an HTTP Transfer Encoding Type 3-59

Defining an HTTP URL for Inspection 3-60

Defining an HTTP Maximum URL Length for Inspection 3-62

Configuring a Layer 7 HTTP Deep Packet Inspection Policy Map 3-63

Creating a Layer 7 HTTP Deep Packet Inspection Policy Map 3-63

Adding a Layer 7 HTTP Deep Packet Inspection Policy Map

Description 3-64

Including Inline Match Statements in a Layer 7 HTTP Deep Packet

Inspection Policy Map 3-65

Associating a Layer 7 HTTP Inspection Traffic Class with the Traffic

Policy 3-67

Specifying the Layer 7 HTTP Deep Packet Policy Actions 3-68

Configuring a Layer 7 SCCP Inspection Policy 3-70

Creating a Layer 7 SCCP Inspection Policy Map 3-70

Adding a Description to the Layer 7 SCCP Inspection Policy Map 3-71

Including an Inline Match Statement in a Layer 7 SCCP Inspection Policy

Map 3-72

Specifying the Layer 7 SCCP Inspection Policy Map Action 3-73

Configuring a Layer 7 SIP Inspection Policy 3-74

Configuring a Layer 7 SIP Inspection Class Map 3-74

Creating a Layer 7 SIP Inspection Class Map 3-75

Cisco 4700 Series Application Control Engine Appliance Security Configuration Guide

OL-16202-01

Contents

Adding a Layer 7 Class Map Description for SIP Inspection 3-77

Defining the Called Party in the SIP To Header 3-77

Defining the Calling Party in the SIP From Header 3-78

Defining SIP Content Checks 3-79

Defining the SIP Instant Messaging Subscriber 3-81

Defining the Message Path Taken by SIP Messages 3-82

Defining the SIP Request Methods 3-83

Defining the SIP Party Registration Entities 3-84

Defining SIP URI Checks 3-85

Configuring a Layer 7 SIP Inspection Policy Map 3-86

Creating a Layer 7 SIP Policy Map 3-87

Adding a Layer 7 SIP Inspection Policy Map Description 3-87

Including Inline Match Statements in a Layer 7 SIP Inspection Policy

Map 3-88

Associating the Layer 7 SIP Inspection Class Map with the Policy

Map 3-89

Specifying the Layer 7 SIP Inspection Policy Map Actions 3-90

Configuring a Layer 3 and Layer 4 Application Protocol Inspection Traffic

Policy 3-91

Configuration Guidelines for Inspection Traffic Policies 3-91

Configuring a Layer 3 and Layer 4 Class Map 3-93

Adding a Layer 3 and Layer 4 Class Map Description 3-94

Defining Access-List Match Criteria 3-95

Defining TCP/UDP Port Number or Port Range Match Criteria 3-96

Configuring a Layer 3 and Layer 4 Policy Map 3-99

Creating a Layer 3 and Layer 4 Policy Map 3-99

Adding a Layer 3 and Layer 4 Policy Map Description 3-100

Specifying a Layer 3 and Layer 4 Traffic Class with the Traffic

Policy 3-100

Defining Layer 3 and Layer 4 Application Protocol Inspection Policy

Actions 3-102

Contents

Cisco 4700 Series Application Control Engine Appliance Security Configuration Guide

OL-16202-01

Configuring a DNS Parameter Map 3-106

Configuring a DNS Query Timeout 3-107

Associating a DNS Parameter Map with a Layer 3 and Layer 4 Policy

Map 3-108

Configuring an HTTP Parameter Map 3-109

Disabling Case-Sensitivity Matching 3-110

Setting the Maximum Number of Bytes to Parse in HTTP Headers 3-110

Setting the Maximum Number of Bytes to Parse in HTTP Content 3-111

Associating an HTTP Parameter Map with a Layer 3 and Layer 4 Policy

Map 3-111

Configuring an SCCP Parameter Map 3-112

SCCP Inspection Configuration Considerations 3-113

Creating an SCCP Parameter Map 3-113

Enabling Registration Enforcement 3-114

Setting the Maximum Message ID 3-114

Setting the Minimum and Maximum SCCP Prefix Length 3-115

Associating an SCCP Parameter Map with a Layer 3 and Layer 4 Policy

Map 3-115

Configuring a SIP Parameter Map 3-116

SIP Inspection Configuration Considerations 3-117

Creating a SIP Parameter Map 3-117

Configuring a Timeout for a SIP Media Secure Port 3-118

Enabling Instant Messaging 3-118

Enabling Maximum Forward Field Validation 3-119

Configuring User Agent Software Version Options 3-120

Enabling Strict Header Validation 3-120

Enabling Non-SIP URI Detection in SIP Messages 3-122

Associating a SIP Parameter Map with a Layer 3 and Layer 4 Policy

Map 3-122

Applying a Service Policy 3-123

Autres manuels pour 4700M

Ce manuel convient aux modèles suivants

Table des matières

Autres manuels Cisco Logiciel

Cisco

Cisco Unified Videoconferencing Manager Manuel utilisateur

Cisco

Cisco 15454-TCC - Network Processor Card Manuel utilisateur

Cisco

Cisco Network Assistant Manuel utilisateur

Cisco

Cisco CVPN3002-8E-K9 - Fast Ethernet VPN Gateway Manuel utilisateur

Cisco

Cisco TMS SERVER REDUNDANCY - CONFIGURATION GUIDE... Manuel utilisateur

Cisco

Cisco OL-11757-01 Mode d’emploi

Cisco

Cisco 3600 Series Manuel utilisateur

Cisco

Cisco ACTIVE NETWORK ABSTRACTION - BROCHURE WHATS NEW IN RELEASE... Manuel utilisateur

Cisco

Cisco PIX 520 - PIX Firewall 520 Guide de référence

Cisco

Cisco DVD-ROM Manuel d'installation et d'exploitation

Cisco

Cisco 1701 Mode d’emploi

Cisco

Cisco MeetingPlace Video Integration Manuel de service

Cisco

Cisco CISCO1811 Manuel utilisateur

Cisco

Cisco Digital Media Player Manuel utilisateur

Cisco

Cisco III - Supervisor Engine III Manuel utilisateur

Cisco

Cisco 2600 Series Comment utiliser

Cisco

Cisco CRS-1 - Carrier Routing System Router Mode d’emploi

Cisco

Cisco Network Assistant Manuel utilisateur

Cisco

Cisco IP Communicator Mode d’emploi

Cisco

Cisco AP775A - Nexus Converged Network Switch 5010 Manuel utilisateur

Cisco

Cisco 6503-E - Catalyst Chassis With Supervisor Engine 32... Mode d’emploi

Cisco

Cisco WS-SUP32-GE-3B - Supervisor Engine 32 Manuel utilisateur

Cisco

Cisco DCNM Guide rapide

Cisco

Cisco 15454-TCC - Network Processor Card Manuel utilisateur

Manuels Logiciel populaires d'autres marques

COMPRO

COMPRO COMPROFM Manuel utilisateur

Muratec

Muratec OFFICEBRIDGE ONLINE Manuel utilisateur

Oracle

Oracle Contact Center Anywhere 8.1 Manuel utilisateur

Adobe

Adobe 65007312 - Photoshop Lightroom Manuel

Avaya

Avaya NULL One-X for RIM Blackberry Manuel utilisateur

HP ProLiant BL420c Manuel utilisateur

PS Audio

PS Audio PowerPlay Manuel du propriétaire

Brady

Brady LOCKOUT PRO 3.0 Manuel de service

Avaya

Avaya Interaction Center Manuel utilisateur

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manuel

Novell

Novell GROUPWISE 8 - INTERNET AGENT Manuel utilisateur

Oracle

Oracle Application 9i Manuel utilisateur

Acer

Acer RDM Manuel utilisateur

Canon

Canon Vixia HF21 Manuel utilisateur

Canon

Canon ZR950 Manuel utilisateur

Samsung

Samsung Auto Backup Manuel utilisateur

Polycom

Polycom Vortex EF2201 Instructions d'installation et d'utilisation

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manuel utilisateur