Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

Block msn messenger on pic515e

5 REPLIES
Cisco Employee

Re: Block msn messenger on pic515e

Hi Josky,

Could you please tell me what code are you running on the PIX?

Also, could it be possible that I can take a look at the access-list and access-group commands you have configured.

If the answer is yes please do a show access-list and show access-group and send it or upload it.

Now if you are using code 7.x on the PIX you can use the Application-Aware Inspection Services with the new code

check the configuration example below:

Create a class-map for http inspection

pix(config)# class-map http-port

pix(config-cmap)# match port tcp eq 80

pix(config-cmap)# exit

Create an http-map to specify parameters for inspect http

pix(config)# http-map inbound_http

pix(config-http-map)# content-length min 100 max 2000 action reset log

pix(config-http-map)# content-type-verification match-req-rsp action reset log

pix(config-http-map)# max-header-length request 100 action reset log

pix(config-http-map)# max-uri-length 100 action reset log

pix(config-http-map)# port-misuse p2p action drop

pix(config-http-map)# port-misuse im action drop

pix(config-http-map)# port-misuse default action allow

pix(config-http-map)# exit

Create a policy-map for http inspection

* pix(config)# policy-map inbound_policy

pix(config-pmap)# class http-port

pix(config-pmap-c)# inspect http inbound_http

pix(config-pmap-c)# exit

pix(config-pmap)# exit

If necessary create a service-policy or use the default-inspection policy

pix(config)# service-policy inbound_policy interface outside

This ends up in the config as:

--------------------------------------------------------------------------

class-map http-port

match port tcp eq 80

class-map http-port8080

match port tcp eq 8080

http-map inbound_http

content-length min 100 max 2000 action reset log

content-type-verification match-req-rsp action reset log

max-header-length request 100 action reset log

max-uri-length 100 action reset log

port-misuse p2p action drop

port-misuse im action drop

port-misuse default action allow

policy-map inbound_policy

class http-port

inspect http inbound_http

class http-port8080

inspect http inbound_http

service-policy inbound_policy interface outside

Essentially this will cause the pix to block the IM/P2P applications while still allowing

normal traffic over port 80/8080.

also here is the link to PIX 7.0 and ASA CLI architecture. This should be a comprehensive

reference in configuring your 7.0 PIX at the CLI level.

http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_configuration_guide_book09186a0080485008.html

Franco Zamora

New Member

Re: Block msn messenger on pic515e

I tried the following and it didn't block MS Messenger... Am I missing something?

http-map inbound_http

content-length min 100 max 2000 action reset log

content-type-verification match-req-rsp action reset log

max-header-length request 100 action reset log

max-uri-length 100 action reset log

port-misuse p2p action drop

port-misuse im action drop

port-misuse default action allow

class-map http_port

match port tcp eq www

class-map http_port8080

match port tcp eq 8080

class-map inspection_default

match default-inspection-traffic

policy-map global_policy

class inspection_default

inspect dns maximum-length 512

inspect ftp

inspect h323 h225

inspect h323 ras

inspect netbios

inspect rsh

inspect rtsp

inspect skinny

inspect esmtp

inspect sqlnet

inspect sunrpc

inspect tftp

inspect sip

inspect xdmcp

inspect http

policy-map inbound_policy

class http_port

inspect http inbound_http

!

service-policy global_policy global

service-policy inbound_policy interface outside

Greg MacDonald

New Member

Re: Block msn messenger on pic515e

I was able to use the following to block MS Messenger

but I had to put a range 500-3000, It wouldn't work if I just inspected port 80.

Has anyone successfully blocked IM using the application inspection for port 80?

http-map block-im

strict-http action drop log

port-misuse p2p action drop log

port-misuse im action drop log

port-misuse default action allow

!

class-map http_port

match port tcp range 500 3000

class-map inspection_default

match default-inspection-traffic

!

!

policy-map global_policy

class inspection_default

inspect dns maximum-length 512

inspect ftp

inspect h323 h225

inspect h323 ras

inspect netbios

inspect rsh

inspect rtsp

inspect skinny

inspect esmtp

inspect sqlnet

inspect sunrpc

inspect tftp

inspect sip

inspect xdmcp

inspect http

class http_port

inspect http block-im

!

service-policy global_policy global

Greg

New Member

Re: Block msn messenger on pic515e

Hi guys, this configuration work to me

access-list inside_mpc_in_V1 extended deny tcp object-group Messenger_Permit any eq www

access-list inside_mpc_in_V1 extended permit tcp any any eq www

object-group network Messenger_Permit

description Grupo para usuarios permitidos a entrar en el Messenger

network-object Asist_Rector 255.255.255.255

network-object Astor 255.255.255.255

network-object 10.0.6.52 255.255.255.255

network-object Jesus 255.255.255.255

network-object host Joan

network-object Almirante 255.255.255.255

network-object Capitan 255.255.255.255

network-object Charles 255.255.255.255

network-object Cap_Michel 255.255.255.255

network-object Sec_ext 255.255.255.255

network-object Mata 255.255.255.255

http-map msn

strict-http action allow log

content-type-verification match-req-rsp action allow log

port-misuse default action drop log

class-map global-class

match default-inspection-traffic

class-map inside-class1

match access-list inside_mpc_in_V1

!

!

policy-map global-policy

class global-class

inspect sqlnet

inspect h323 ras

inspect xdmcp

inspect tftp

inspect icmp error

inspect rtsp

inspect sunrpc

inspect mgcp

inspect esmtp

inspect sip

inspect netbios

inspect pptp

inspect ctiqbe

inspect snmp

inspect icmp

inspect rsh

inspect ftp

inspect ils

inspect h323 h225

inspect dns

inspect skinny

policy-map inside-policy

class inside-class1

inspect http msn

!

service-policy global-policy global

service-policy inside-policy interface inside

I´ll hope that work for you.

regards

New Member

Re: Block msn messenger on pic515e

Hello Franco I can send you my configurations details... is all right?

114
Views
0
Helpful
5
Replies
CreatePlease to create content