23.4 Partial Retirement of Protocol Inspector
23.4 Partial Retirement of Protocol Inspector
Under certain circumstances, appliance of a protocol inspector to a particular communi- cation might be undesirable. To disable specific protocol inspection, define correspond- ing source and destination IP addresses and a traffic rule for this service that will define explicitly that no protocol inspector will be used.
Example: A banking application (client) communicates with the bank’s server through its proper protocol which uses TCP protocol at the port 2000. Supposing the banking application is run on a host with IP address 192.168.1.15 and it connects to the server server.bank.com.
This port is used by the Cisco SCCP protocol. The protocol inspector of the SCCP would be applied to the traffic of the banking client under normal circumstances. However, this might affect functionality of the application or endanger its security.
A special traffic rule, as follows, will be defined for all traffic of the banking application:
1.In the Configuration → Definitions → Services section, define a service called Inter- net Banking: this service will use TCP protocol at the port 2000 and no protocol inspector is used by this communication.
