|
Step 1
|
enable
|
Enables privileged EXEC mode
|
|
Step 2
|
configure terminal
Device# configure terminal
|
Enters global configuration mode.
|
|
Step 3
|
class-map type inspect match-any
class-map-name
Device(config)# class-map type inspect match-any h.323-class
|
Creates an inspect type class map and enters QoS class-map configuration mode.
|
|
Step 4
|
match protocol
protocol-name
Device(config-cmap)# match protocol h323
|
Configures the match criteria for a class map on the basis of the named protocol.
|
|
Step 5
|
match protocol
protocol-name
Device(config-cmap)# match protocol h323ras
|
Configures the match criteria for a class map on the basis of the named protocol.
|
|
Step 6
|
exit
Device(config-cmap)# exit
|
Exits QoS class-map configuration mode and enters global configuration mode.
|
|
Step 7
|
policy-map type inspect
policy-map-name
Device(config)# policy-map type inspect h.323-policy
|
Creates an inspect type policy map and enters QoS policy-map configuration mode.
|
|
Step 8
|
class type inspect
class-map-name
Device(config-pmap)# class type inspect h.323-class
|
Specifies the class on which the action is performed and enters QoS policy-map class configuration mode.
|
|
Step 9
|
inspect
Device(config-pmap-c)# inspect
|
Enables stateful packet inspection.
|
|
Step 10
|
exit
Device(config-pmap-c)# exit
|
Exits QoS policy-map class configuration mode and enters policy-map configuration mode.
|
|
Step 11
|
class class-default
Device(config-pmap)# class class-default
|
Applies the policy map settings to the predefined default class.
|
|
Step 12
|
exit
|
Exits QoS policy-map configuration mode and enters global configuration mode.
|
|
Step 13
|
zone security
zone-name
Device(config)# zone security inside
|
Creates a security zone to which interfaces can be assigned and enters security zone configuration mode.
-
Your configuration must have two security zones to create a zone pair: a source and a destination zone.
-
In a zone pair, you can use the default zone as either the source or the destination zone.
|
|
Step 14
|
exit
Device(config-sec-zone)# exit
|
Exits security zone configuration mode and enters global configuration mode.
|
|
Step 15
|
zone-pair security
zone-pair-name
source
source-zone
destination
destination-zone
Device(config)# zone-pair security inside-outside source inside destination outside
|
Creates a pair of security zones and enters security-zone-pair configuration mode.
|
|
Step 16
|
service-policy type inspect
policy-map-name
Device(config-sec-zone-pair)# service-policy type inspect h.323-policy
|
Attaches a firewall policy map to the destination zone pair.
|
|
Step 17
|
exit
Device(config-sec-zone-pair)# exit
|
Exits security zone-pair configuration mode and enters global configuration mode.
|
|
Step 18
|
interface
type number
Device(config)# interface gigabitethernet 0/0/1
|
Configures an interface and enters interface configuration mode.
|
|
Step 19
|
zone member security
zone-name
Device(config-if)# zone member security inside
|
Assigns an interface to a specified security zone.
-
When you make an interface a member of a security zone, all traffic into and out of that interface (except traffic bound for
the router or initiated by the router) is dropped by default. To let traffic through the interface, you must make the zone
part of a zone pair to which you apply a policy. If the policy permits traffic, traffic can flow through that interface.
|
|
Step 20
|
end
|
Exits interface configuration mode and enters privileged EXEC mode.
|
Feedback