It's r choice, unless the task is specific. With regards Kings
On Thu, May 3, 2012 at 1:33 AM, Eugene Pefti <[email protected]>wrote: > Just an observation and comment on Cisco documentation with regard to > FPM configuration. Would it be acceptable NOT to match on ETHER type under > the stack type class-map if we filter only IP and TCP traffic ?**** > > I saw the majority of examples in Cisco documentation starting with “match > field ip protocol eq 0x6 next tcp”.**** > > ** ** > > Eugene**** > > ** ** > > *From:* [email protected] [mailto: > [email protected]] *On Behalf Of *Kingsley Charles > *Sent:* 02 May 2012 08:47 > *To:* [email protected] > *Subject:* [OSL | CCIE_Security] FPM to restrict vty access**** > > ** ** > > Hi all > > > The task asks to allow ssh only from 4.8.6.0/24 and the restriction is > that we should not use access-lists. So FPM is the only answer. > > In the following config, class-map get's matched and 4.8.6.0/24 is > allowed in. The issue is that I need a wildcard class-map to block other > ssh connections. But that doesn't > work in the following solution. > > > class-map type access-control match-all telblk > match field TCP dest-port eq 22 > > class-map type access-control match-all vlan6 > match field TCP dest-port eq 22 > match field IP source-addr eq 4.8.6.0 mask 0.0.0.255 > > class-map type stack match-all tcp > stack-start l2-start > match field ETHER type eq 0x800 next IP > match field IP protocol eq 6 next TCP > > > policy-map type access-control ssh > class vlan6 > class telblk > drop > > policy-map type access-control tcp > class tcp > service-policy ssh > > control-plane > service-policy type access-control input tcp > > > The following two alternative class-maps also doesn't work > > class-map type access-control match-all telblk > match field ip source-addr range 0.0.0.0 255.255.255.255 > > class-map type access-control match-all telblk > match field ip source-addr 0.0.0.0 mask 255.255.255.255 > > > > > > With regards > Kings**** > >
_______________________________________________ For more information regarding industry leading CCIE Lab training, please visit www.ipexpert.com Are you a CCNP or CCIE and looking for a job? Check out www.PlatinumPlacement.com
