tailieunhanh - cisco press router security strategies phần 5

các giao diện bộ định tuyến không cung cấp dịch vụ cổng mặc định thông qua một mạng LAN chia sẻ. Vô hiệu hóa chuyển hướng ICMP trên chia sẻ giao diện mặc định bộ định tuyến cổng mạng LAN cũng là một lựa chọn và thường được coi là một thực hành tốt nhất để ngăn chặn các thế hệ của ICMP chuyển hướng từ tác động đến quá trình IOS. | Control Plane Policing 247 classification ACL are not classified within the associated MQC class-map. This also applies to the implicit deny at the end of the ACL policy as well. The policy actions that are applied to the traffic classes are specified within the CoPP policy configuration as described in Step 4 a bit later. Step 3 Define Packet Classification MQC Class Maps Now you must create class maps to complete the traffic-classification process using the previously defined ACLs from Step 2 to categorize IP packets into discrete classes. MQC class maps permit multiple match criteria as well as nested class maps. The MQC match-any keyword requires that packets meet only one match criteria to be considered in the class whereas the MQC match-all keyword requires that packets meet all of the match criteria to be considered in the class. If neither match-any nor match-all is specified the default behavior is consistent with the match-all keyword. MQC match-not provides criterion that prevents a packet from being included in the class. In general a match-all classification scheme with a simple single-match criteria will satisfy initial deployments for CoPP. This is illustrated in Example 5-12 and leaves open the option for fine-tuning through multiple match criteria in the longer term. Example 5-12 Sample IOS MQC Class Map Format Router config class-map match-all class-map-name Router config-cmap match access-group acl-number In general traffic destined to the undesirable class should follow a match-any classification scheme. Further creating class maps with descriptive names also simplifies deployment and operational complexity. Using the ACLs defined in Step 2 Example 5-13 constructs class maps for the specific traffic classes defined. Example 5-13 Sample IOS CoPP Traffic Classes Defined Using ACLs I Define a class for each type of traffic and associate the appropriate ACL I Define a class-map to collect routing traffic. class-map match-all CoPP-routing match .