Cisco PIX 525 Spécifications télécharger pdf (Page 181)

5-5

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 5 Configuring Application Inspection (Fixup)

Using the fixup Command

You can view the explicit (configurable) fixup protocol settings with the show fixup command. The

default settings for configurable protocols are as follows.

pixHA(config)# sh fix

fixup protocol dns maximum-length 512

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol tftp 69

pixHA(config)#

The show fixup protocol protocol command displays the configuration for an individual protocol.

The following are other related commands that let you manage fixup configuration:

• show conn state—Displays the connections with the state of the designated protocol

• show timeout—Displays the timeout value of the designated protocol

The clear fixup command removes fixup commands from the configuration that you added. It does not

remove the default fixup protocol commands.

You can disable the fixup of a protocol by removing all fixups of the protocol from the configuration

using the no fixup command.

After you remove all fixups for a protocol, the no fixup form of the

command or the default port is stored in the configuration.

For some applications, you can define multiple port assignments. This is useful when multiple instances

of the same service are running on different ports.

The following example shows how to define multiple ports for FTP by entering separate commands:

fixup protocol ftp 2100

fixup protocol ftp 4254

fixup protocol ftp 9090

These commands do not change the standard FTP port assignment (21). After entering these commands,

the PIX

Firewall listens for FTP traffic on port 21, 2100, 4254, and 9090.

Some protocols let you assign a range of ports. This is indicated in the command syntax as port[-port].

For example, the first command example assigns the port range from 1500 to 2000 to SQL*Net. The

second command example shows a smaller port range 161 to 162 for SNMP.

fixup protocol sqlnet 1500-2000

fixup protocol snmp 161-162

Note If you enter a new port assignment for protocols that do not allow multiple port assignments, the value

overrides the default value.

1 2 ... 176 177 178 179 180 181 182 183 184 185 186 ... 465 466

Commentaires sur ces manuels

Pas de commentaire

Cisco PIX 525 Spécifications Page 181

Commentaires sur ces manuels

Produits connexes et manuels pour Systèmes de contrôle d'accès de sécurité Cisco PIX 525