Cisco Systems 2.5 Class Maps

Chapter37 Cisco Common Classification Policy Language
Class Maps
37-6
Cisco Router and Security Device Manager 2.5 User’s Guide
OL-4015-12
•Add or Edit a Point-to-Point Class Map
•Add or Edit an Instant Messaging Class Map
Configure Deep Packet Inspection
Layer 7 (application) inspection augments Layer 4 inspection with the capability
to recognize and apply service-specific actions, such as select ively blocking or
allowing file search, file transfer, and text chat capabilities. Service-specific
capabilities vary by service.
If you are creating a new policy map, enter a name in the Policy Map Name field.
You can also add a description. Click Add > New Class Map to create a new
Point-to-Point class map. Add or Edit a Point-to-Point Class Map provides
information on how to create this type of class map. Click Add > class default to
add the default class map.
When the class map appears in the table, specify the action that you want taken
when a match is found, and whether you want matches logg ed. You can specify
<None>, Reset, or Allow. In the following example, there are P2P class maps for
gnutella and eDonkey.
Class Maps
Class maps define the traffic that a Zone-Policy Based Firewall (ZPF) selects for
policy application. Layer 4 class maps sort the traffic based on the following
criteria:
•Access group—A standard, extended, or named Access Control List can filter
traffic based on source and destination IP address and on source and
destination port.
•Protocol—The Layer 4 protocols (TCP, UDP, and ICMP) and application
services such as HTTP, SMTP, DNS, etc. Any well-known or user-defined
service known to PAM may be specified.
Match Class Name Action Log
gnutellaCMap Allow
eDonkeyCMap Reset X