Diverting Traffic to the Csc Ssm
You use MPF commands to configure the adaptive security appliance to divert traffic to the CSC SSM. Before configuring the adaptive security appliance to do so, read Chapter 21, "Using Modular Policy Framework," which introduces MPF concepts and common commands.
To identify traffic to divert from the adaptive security appliance to the CSC SSM, perform the following steps:
Step 1 Create an access list that matches the traffic you want scanned by the CSC SSM. To do so, use the access-list extended command. Create as many ACEs as needed to match all the traffic. For example, if you want to specify FTP, HTTP, POP3, and SMTP traffic, you would need four ACEs. For guidance on identifying the traffic you want to scan, see the "Determining What Traffic to Scan" section on page 22-9.
Step 2 Create a class map to identify the traffic that should be diverted to the CSC SSM. Use the class-map command to do so, as follows.
hostname(config)# class-map class_map_name hostname(config-cmap)#
where class_map_name is the name of the traffic class. When you enter the class-map command, the CLI enters class map configuration mode.
Step 3 With the access list you created in Step 1, use a match access-list command to identify the traffic to be scanned:
hostname(config-cmap)# match access-list acl-name
Step 4 Create a policy map or modify an existing policy map that you want to use to send traffic to the CSC SSM. To do so, use the policy-map command, as follows.
hostname(config-cmap)# policy-map policy_map_name hostname(config-pmap)#
where policy_map_name is the name of the policy map. The CLI enters the policy map configuration mode and the prompt changes accordingly.
Step 5 Specify the class map, created in Step 2, that identifies the traffic to be scanned. Use the class command to do so, as follows.
hostname(config-pmap)# class class_map_name hostname(config-pmap-c)#
where class_map_name is the name of the class map you created in Step 2. The CLI enters the policy map class configuration mode and the prompt changes accordingly.
Step 6 If you want to enforce a per-client limit for simultaneous connections that the adaptive security appliance diverts to the CSC SSM, use the set connection command, as follows:
hostname(config-pmap-c)# set connection per-client-max n where n is the maximum simultaneous connections the adaptive security appliance will allow per client. This prevents a single client from abusing the services of the CSC SSM or any server protected by the SSM, including prevention of attempts at DoS attacks on HTTP, FTP, POP3, or SMTP servers that the CSC SSM protects.
Step 7 Assign the traffic identified by the class map as traffic to be sent to the CSC SSM. Use the csc command to do so, as follows.
hostname(config-pmap-c)# csc {fail-close | fail-open}
The fail-close and fail-open keywords control how the adaptive security appliance treats traffic when the CSC SSM is unavailable. For more information about the operating modes and failure behavior, see the "About the CSC SSM" section on page 22-5.
Step 8 Use the service-policy command to apply the policy map globally or to a specific interface, as follows:
hostname(config-pmap-c)# service-policy policy_map_name [global | interface interface_ID] hostname(config)#
wherepolicy_map_name is the policy map you configured in Step 4. If you want to apply the policy map to traffic on all the interfaces, use the global keyword. If you want to apply the policy map to traffic on a specific interface, use the interface interface_ID option, where interface_ID is the name assigned to the interface with the nameif command.
Only one global policy is allowed. You can override the global policy on an interface by applying a service policy to that interface. You can only apply one policy map to each interface.
The adaptive security appliance begins diverting traffic to the CSC SSM as specified.
Example 22-1 is based on the network shown in Figure 22-3. It creates two service policies. The first policy, csc_out_policy, is applied to the inside interface and uses the csc_out access list to ensure that all outbound requests for FTP and POP3 are scanned. The csc_out access list also ensures that HTTP connections from inside to networks on the outside interface are scanned but it includes a deny ACE to exclude HTTP connections from inside to servers on the DMZ network.
The second policy, csc_in_policy, is applied to the outside interface and uses the csc_in access list to ensure that requests for SMTP and HTTP originating on the outside interface and destined for the DMZ network are scanned by the CSC SSM. Scanning HTTP requests protects the web server from HTTP file uploads.
Example 22-1 Service Policies for a Common CSC SSM Scanning Scenario hostname(config)# access-list csc_out permit tcp 192.168.10.0 255.255.255.0 any eq 21
hostname(config)# access-list csc_out deny tcp 192.168.10.0 255.255.255.0 192.168.20.0 255.255.255.0 eq 80 hostname(config)# access-list csc_out permit tcp 192.168.10.0 255.255.255.0 any eq 80 hostname(config)# access-list csc_out permit tcp 192.168.10.0 255.255.255.0 any eq 110
hostname(config)# class-map csc_outbound_class hostname(config-cmap)# match access-list csc_out hostname(config)# policy-map csc out policy hostname(config-pmap)# class csc_outbound_class hostname(config-pmap-c)# csc fail-close hostname(config)# service-policy csc out policy interface inside hostname(config)# access-list csc_in permit tcp any 192.168.20.0 255.255.255.0 eq 25 hostname(config)# access-list csc_in permit tcp any 192.168.20.0 255.255.255.0 eq 80
hostname(config)# class-map csc_inbound_class hostname(config-cmap)# match access-list csc_in hostname(config)# policy-map csc in policy hostname(config-pmap)# class csc_inbound_class hostname(config-pmap-c)# csc fail-close hostname(config)# service-policy csc in policy interface outside
Note FTP inspection must be enabled for CSC SSM to scan files transferred by FTP. FTP inspection is enabled by default.
Continue reading here: Enabling the TCP Normalizer
Was this article helpful?