Downloads |
 Feedback
|
Table Of Contents
Restrictions for Flexible Packet Matching
Information About Flexible Packet Matching
Flexible Packet Matching Functional Overview
Protocol Header Description File
Traffic Classification Definition Files for the Flexible Packet Matching XML Configuration
FPM on the Catalyst 6500 Equipped with PISA Overview
Full Packet FPM Search Window Increase
Session-based Flexible Packet Matching
How to Configure a Flexible Packet Matching Traffic Class and Traffic Policy
Creating a Traffic Class for Flexible Packet Matching
Creating a Traffic Policy for Flexible Packet Matching
Copying a Matched Packet To a Different Destination Interface
Redirecting a Matched Packet To a Different Destination Interface
Configuring Packaging Support for Flexible Packet Matching
Configuring eTCDF Through the Command-Line Interface
Configuration Examples for Flexible Packet Matching
Example: Configuring FPM for Slammer Packets
Example: Configuring FPM for Blaster Packets
Example: Configuring FPM for MyDoom Packets
Example: Configuring and Verifying FPM on ASR Platform
Example: Configuring Session-based FPM
Example: Configuring Session-based FPM with a Filter for Increased Performance and Accuracy
Example: Verifying FPM Package Support
Feature Information for Flexible Packet Matching
Flexible Packet Matching
First Published: October 31, 2006Last Updated: March 31, 2011Flexible Packet Matching (FPM) is an access control list (ACL) pattern matching tool, providing more thorough and customized packet filters. FPM enables users to match on arbitrary bits of a packet at an arbitrary depth in the packet header and payload. FPM removes constraints to specific fields that had limited packet inspection.
FPM enables users to create their own stateless packet classification criteria and to define policies with multiple actions (such as drop, log, or send Internet Control Message Protocol [ICMP] unreachable1 ) to immediately block new viruses, worms, and attacks.
Finding Feature Information
Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the "Feature Information for Flexible Packet Matching" section.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Contents
•
Restrictions for Flexible Packet Matching
•
•
•
•
Restrictions for Flexible Packet Matching
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Information About Flexible Packet Matching
•
•
•
•
•
Flexible Packet Matching Functional Overview
FPM allows customers to create their own filtering policies that can immediately detect and block new viruses and attacks.
A filtering policy is defined via the following tasks:
•
•
•
•
Protocol Header Description File
Protocol headers are defined in separate files called PHDFs; the field names that are defined within the PHDFs are used for defining the packet filters. A PHDF is a file that allows the user to leverage the flexibility of XML to describe almost any protocol header. The important components of the PHDF are the version, the XML file schema location, and the protocol field definitions. The protocol field definitions name the appropriate field in the protocol header, allow for a comment describing the field, provide the location of the protocol header field in the header (the offset is relative to the start of the protocol header), and provide the length of the field. Users can choose to specify the measurement in bytes or in bits.
Note
Note
Users can write their own custom PHDFs via XML for existing or proprietary protocols. However, the following standard PHDFs can also be loaded onto the router via the load protocol command: ether.phdf, ip.phdf, tcp.phdf, and udp.phdf.
Note
Standard PHDFs are available on Cisco.com at the following URL:
http://www.cisco.com/pcgi-bin/tablebuild.pl/fpmFilter Description
A filter description is a definition of a traffic class that can contain the header fields defined in a PHDF (using the match field command). If a PHDF is not loaded, the traffic class can be defined via the datagram header start (Layer 2) or the network header start (Layer 3) (using the match start command). If a PHDF has been loaded onto the router, the class specification begins with a list of the protocol headers in the packet.
A filter definition also includes the policy map; that is, after a class map has been defined, a policy map is needed to bind the match to an action. A policy map is an ordered set of classes and associated actions, such as drop, log, or send ICMP unreachable.
For information on how to configure a class map and a policy map for FPM, see "How to Configure a Flexible Packet Matching Traffic Class and Traffic Policy."
Traffic Classification Definition Files for the Flexible Packet Matching XML Configuration
FPM uses a traffic classification definition file (TCDF) to define policies that can block attacks on the network. Before Cisco IOS Release 12.4(6)T, FPM defined traffic classes (class maps), policies (policy maps), and service policies (attach policy maps to class maps) through the use of the command line interface (CLI). With TCDFs, FPM can use XML as an alternative to the CLI to define classes of traffic and specify actions to apply to the traffic classes. Traffic classification behavior is the same whether you create the behavior using a TCDF or configure it using CLI commands. Once a TCDF is created, it can be loaded on any FPM-enabled device in the network.
Note
For more information on configuring FPM using TCDFs, see Flexible Packet Matching XML Configuration.
FPM on the Catalyst 6500 Equipped with PISA Overview
The PISA functions as a network processor-based daughter card that is mounted on the Catalyst 6500 Supervisor. PISA provides a superset of the multilater switch feature card 2a (MSFC2a) capabilities. In addition to performing all of the same functions as the MSFC2a, PISA provides dedicated hardware to accelerate certain features such as FPM.
Network-Based Application Recognition (NBAR) occurs before FPM; thus, packets that are dropped by FPM are processed by NBAR.
Logging FPM Activity
In software-based FPM logging, every flow is logged and aggregated statistics are provided for each flow. Logging every flow for FPM on PISA would overwhelm the CPU; thus, only selective packets are logged. That is, when a packet matches a policy that is to be logged or the first time, the packet is logged, time-stamped, and stored. For every subsequent packet that matches any policy with a log action, the packet is checked for the difference between the current time (which is clocked by the global timer) and the last time stamp. If the current time is later than the last time stamp, the packet is logged and the "stamp time" is updated with the current time.
Memory Requirements
Note
•
•
•
Encrypted TCDF Support
TCDFs provide preconfigured FPM filters written in XML format that can be directly loaded onto a router. The XML format prohibits the Cisco Product Security Incident Response Team (PSIRT) from being able to provide public TCDF filters because it would expose the vulnerability to potential attackers. This information could then be used to exploit PSIRT vulnerabilities in some systems.
FPM encrypted TCDF (eTCDF) filter support will provide encrypted FPM filters. Applying the PSIRT provided eTCDF FPM filter will protect routers from PSIRT incidents, allowing time to certify new Cisco IOS releases that contains the PSIRT fixes.
To enter FPM match encryption filter configuration mode, use the match encrypted command in class-map configuration mode. This mode enables you to enter encrypted filter-related information like the cipher key cipher value, and filter hash.
Note
TCDF Packaging Support
TCDFs are FPM filters in XML format. Each TCDF file is designed to filter for a single individual worm or virus. TCDF packaging support provides packages containing at least one or more worm or virus filters and efficiently updates FPM filters as threat characteristics change. When FPM filters are updated, all systems in a network are automatically updated. This behavior reduces the amount of router configuration needed to deploy FRM filters.
To access TCDF packages, configure the router using the time-range command to periodically check for package updates. At the specified time, the router connects to the server containing the FPM packages to request the latest version. When the router gets feedback from the server, it compares the FPM package version number from the server with the local FPM package version. If there is an updated package on the server, then the router downloads the package content, replaces the old package with the new package, and updates the local configuration.
Full Packet FPM Search Window Increase
FPM supports searching for patterns up to 256 bytes long anywhere within the entire packet. Also, the number of filters that can be configured per class map is 32. The additional filters can help offset adverse CPU performance that may occur if the "window" for pattern searching is increased. This will also allow FPM users to take advantage of the regular expressions (regex) strings used by Intrusion Prevention Systems (IPS) in their signatures.
Session-based Flexible Packet Matching
FPM works at its best when the filter information exists in all packets of a packet flow. However, if matching contents only exist in a limited number of packets (regex strings and strings in the payload), then FPM can only apply actions to these packets, and miss the other packets in the same packet flow, which are a sequence of packets with the same attributes.
With the introduction of Cisco IOS Release 15.1(3)T, FPM can now match every packet against the filters specified in the class map and pass the match result to consecutive packets of the same network session. If a filter matches with malicious content in the packet's protocol header or payload, then the required action is taken to resolve the problem.
The match class session command configures match criteria that identify a session containing packets of interest, which is then applied to all packets transmitted during the session. The packet-range and byte-range keywords are used to create a filter mechanism that increases the performance and matching accuracy of regex-based FPM class maps by classifying traffic that resides in the narrow packet number or byte ranges of each packet flow. If packets go beyond the classification window, then the packet flow can be identified as unknown and packet classification is terminated early to increase performance. For example, a specific application can be blocked efficiently by filtering all packets that belong to this application on a session. These packets are dropped without matching every individual packet with the filters, which improves the performance of a session.
These filters also reduce the number of false positives introduced by general regex-based approaches. For example, internet company messenger traffic can be classified with a string like intco, intcomsg, and ic. These strings are searched for in a packet's payload. These small strings can appear in the packet payload of any other applications, such as e-mail, and can introduce false positives. False positives can be avoided by specifying which regex is searched within which packet of a particular packet flow. See "Creating a Traffic Class for Flexible Packet Matching" section for more information.
Once the match criteria are applied to packets belonging to the specific traffic class, these packets can be discarded by configuring the drop all command in a policy map. Packets match only on the packet flow entry of an FPM, and skip user-configured classification filters. See "Creating a Traffic Policy for Flexible Packet Matching" section for more information.
A match class does not have to be applied exclusively for a regex-based filter. Any FPM filter can be used in the nested match class filter. For example, if the match class c1 has the filter match field TCP source-port eq 80, then the match class c1 session command takes the same action for the packets that follow the first matching packet.
How to Configure a Flexible Packet Matching Traffic Class and Traffic Policy
•
•
•
•
Creating a Traffic Class for Flexible Packet Matching
Perform this task to create an FPM traffic class; that is, create stateless packet classification criteria that, when used in conjunction with an appropriately defined policy, can mitigate network attacks.
Note
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
{eq | neq | gt | lt | range range | regex string} value [value2]8.
9.
10.
11.
DETAILED STEPS
Troubleshooting Tips
To track all FPM events, issue the debug fpm event command.
The following is sample output from the debug fpm event command:
Router# debug fpm event*Jun 21 09:22:21.607: policy-classification-inline(): matches class: class-default *Jun 21 09:22:21.607: packet-access-control(): policy-map: fpm-policy, dir: input, match. retval: 0x0, ip-flags: 0x80000000What to Do Next
After you have defined at least one class map for your network, you must create a traffic policy and apply that policy to an interface as shown in the ""Creating a Traffic Policy for Flexible Packet Matching" section."
Creating a Traffic Policy for Flexible Packet Matching
Perform this task to create an FPM traffic policy and apply the policy to a given interface.
After you create a traffic policy for FPM, you can copy or redirect a matched packet to a different destination interface:
•
•
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
DETAILED STEPS
Copying a Matched Packet To a Different Destination Interface
Perform this task to configure a traffic class to copy packets belonging to a specific class to a different destination interface.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
DETAILED STEPS
Redirecting a Matched Packet To a Different Destination Interface
Perform this task to configure a traffic class to redirect packets belonging to a specific class to a different destination.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
DETAILED STEPS
Configuring Packaging Support for Flexible Packet Matching
Perform this task to configure FPM packaging support.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
DETAILED STEPS
Configuring eTCDF Through the Command-Line Interface
If you have access to an encrypted traffic classification definition file (eTCDF) or if you know valid values to configure encrypted FPM filters, you can configure the same eTCDF through the command-line interface instead of using the preferred method of loading the eTCDF on the router. You can copy the values from the eTCDF by opening the eTCDF in any text editor.
Perform this task to configure eTCDF through the command-line interface.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
DETAILED STEPS
Configuration Examples for Flexible Packet Matching
•
•
•
•
•
•
•
Example: Configuring FPM for Slammer Packets
The following example shows how to define FPM traffic classes for slammer packets (UDP port 1434). The match criteria defined within the class maps is for slammer packets with an IP length not to exceed 404 bytes, UDP port 1434, and pattern 0x4011010 at 224 bytes from start of IP header. This example also shows how to define the service policy "fpm-policy" and apply it to the Gigabit Ethernet interface. Show commands have been issued to verify the FPM configuration. (Note that PHDFs are not displayed in show output because they are in XML format.)
Router(config)# load protocol disk2:ip.phdfRouter(config)# load protocol disk2:udp.phdfRouter(config)# class-map type stack match-all ip-udpRouter(config-cmap)# description "match UDP over IP packets"Router(config-cmap)# match field ip protocol eq 0x11 next udpRouter(config)# class-map type access-control match-all slammerRouter(config-cmap)# description "match on slammer packets"Router(config-cmap)# match field udp dest-port eq 0x59ARouter(config-cmap)# match field ip length gt 0x194Router(config-cmap)# match start l3-start offset 224 size 4 eq 0x4011010Router(config)# policy-map type access-control fpm-udp-policyRouter(config-pmap)# description "policy for UDP based attacks"Router(config-pmap)# class slammerRouter(config-pmap-c)# dropRouter(config)# policy-map type access-control fpm-policyRouter(config-pmap)# description "drop worms and malicious attacks"Router(config-pmap)# class ip-udpRouter(config-pmap-c)# service-policy fpm-udp-policyRouter(config)# interface gigabitEthernet 0/1Router(config-if)# service-policy type access-control input fpm-policyRouter# show policy-map type access-control interface gigabit 0/1GigabitEthernet0/1Service-policy access-control input: fpm-policyClass-map: ip-udp (match-all)0 packets, 0 bytes3 minute offered rate 0 bpsMatch: field IP protocol eq 0x11 next UDPService-policy access-control : fpm-udp-policyClass-map: slammer (match-all)0 packets, 0 bytes3 minute offered rate 0 bps, drop rate 0 bpsMatch: field UDP dest-port eq 0x59AMatch: field IP length eq 0x194Match: start l3-start offset 224 size 4 eq 0x4011010dropClass-map: class-default (match-any)0 packets, 0 bytes3 minute offered rate 0 bps, drop rate 0 bpsMatch: anyClass-map: class-default (match-any)0 packets, 0 bytes3 minute offered rate 0 bps, drop rate 0 bpsMatch: anyRouter# show protocol phdf ipProtocol ID: 1Protocol name: IPDescription: Definition-for-the-IP-protocolOriginal file name: disk2:ip.phdfHeader length: 20Constraint(s):Total number of fields: 12Field id: 0, version, IP-versionFixed offset. offset 0Constant length. Length: 4Field id: 1, ihl, IP-Header-LengthFixed offset. offset 4Constant length. Length: 4Field id: 2, tos, IP-Type-of-ServiceFixed offset. offset 8Constant length. Length: 8Field id: 3, length, IP-Total-LengthFixed offset. offset 16Constant length. Length: 16Field id: 4, identification, IP-IdentificationFixed offset. offset 32Constant length. Length: 16Field id: 5, flags, IP-Fragmentation-FlagsFixed offset. offset 48Constant length. Length: 3Field id: 6, fragment-offset, IP-Fragmentation-OffsetFixed offset. offset 51Constant length. Length: l3Field id: 7, ttl, Definition-for-the-IP-TTLFixed offset. offset 64Constant length. Length: 8Field id: 8, protocol, IP-ProtocolFixed offset. offset 72Constant length. Length: 8Field id: 9, checksum, IP-Header-ChecksumFixed offset. offset 80Constant length. Length: 16Field id: 10, source-addr, IP-Source-AddressFixed offset. offset 96Constant length. Length: 32Field id: 11, dest-addr, IP-Destination-AddressFixed offset. offset 128Constant length. Length: 32Router# show protocol phdf udpProtocol ID: 3Protocol name: UDPDescription: UDP-ProtocolOriginal file name: disk2:udp.phdfHeader length: 8Constraint(s):Total number of fields: 4Field id: 0, source-port, UDP-Source-PortFixed offset. offset 0Constant length. Length: 16Field id: 1, dest-port, UDP-Destination-PortFixed offset. offset 16Constant length. Length: 16Field id: 2, length, UDP-LengthFixed offset. offset 32Constant length. Length: 16Field id: 3, checksum, UDP-ChecksumFixed offset. offset 48Constant length. Length: 16Example: Configuring FPM for Blaster Packets
The following example shows how to configure FPM for blaster packets. The class map contains the following match criteria: TCP port 135, 4444 or UDP port 69; and pattern 0x0030 at 3 bytes from the start of the IP header.
Router(config)# load protocol disk2:ip.phdfRouter(config)# load protocol disk2:tcp.phdfRouter(config)# load protocol disk2:udp.phdfRouter(config)# class-map type stack match-all ip-tcpRouter(config-cmap)# match field ip protocol eq 0x6 next tcpRouter(config)# class-map type stack match-all ip-udpRouter(config-cmap)# match field ip protocol eq 0x11 next udpRouter(config)# class-map type access-control match-all blaster1Router(config-cmap)# match field tcp dest-port eq 135Router(config-cmap)# match start l3-start offset 3 size 2 eq 0x0030Router(config)# class-map type access-control match-all blaster2Router(config-cmap)# match field tcp dest-port eq 4444Router(config-cmap)# match start l3-start offset 3 size 2 eq 0x0030Router(config)# class-map type access-control match-all blaster3Router(config-cmap)# match field udp dest-port eq 69Router(config-cmap)# match start l3-start offset 3 size 2 eq 0x0030Router(config)# policy-map type access-control fpm-tcp-policyRouter(config-pmap)# class blaster1Router(config-pmap-c)# dropRouter(config-pmap-c)# class blaster2Router(config-pmap-c)# dropRouter(config)# policy-map type access-control fpm-udp-policyRouter(config-pmap)# class blaster3Router(config-pmap-c)# dropRouter(config)# policy-map type access-control fpm-policyRouter(config-pmap)# class ip-tcpRouter(config-pmap-c)# service-policy fpm-tcp-policyRouter(config-pmap)# class ip-udpRouter(config-pmap-c)# service-policy fpm-udp-policyRouter(config)# interface gigabitEthernet 0/1Router(config-if)# service-policy type access-control input fpm-policyExample: Configuring FPM for MyDoom Packets
The following example shows how to configure FPM for MyDoom packets. The match criteria is as follows:
•
•
or
•
•
•
Router(config)# load protocol disk2:ip.phdfRouter(config)# load protocol disk2:tcp.phdfRouter(config)# class-map type stack match-all ip-tcpRouter(config-cmap)# match field ip protocol eq 0x6 next tcpRouter(config)# class-map type access-control match-all mydoom1Router(config-cmap)# match field ip length gt 44Router(config-cmap)# match field ip length lt 90Router(config-cmap)# match start l3-start offset 40 size 4 eq 0x47455420Router(config)# class-map type access-control match-all mydoom2Router(config-cmap)# match field ip length gt 44Router(config-cmap)# match start l3-start offset 40 size 4 eq 0x47455420Router(config-cmap)# match start l3-start offset 48 size 4 eq 0x6d3a3830Router(config)# policy-map type access-control fpm-tcp-policyRouter(config-pmap)# class mydoom1Router(config-pmap-c)# dropRouter(config-pmap-c)# class mydoom2Router(config-pmap-c)# dropRouter(config)# policy-map type access-control fpm-policyRouter(config-pmap)# class ip-tcpRouter(config-pmap-c)# service-policy fpm-tcp-policyRouter(config)# interface gigabitEthernet 0/1Router(config-if)# service-policy type access-control input fpm-policyExample: Configuring and Verifying FPM on ASR Platform
The following example shows how to configure FPM on the ASR platform.
load protocol bootflash:ip.phdfload protocol bootflash:tcp.phdfclass-map type stack match-all ip-tcpmatch field IP protocol eq 6 next TCPclass-map type access-control match-all test-classmatch field TCP dest-port gt 10match start l3-start offset 40 size 32 regex "ABCD"policy-map type access-control childclass test-classdroppolicy-map type access-control parentclass ip-tcpservice-policy childinterface GigabitEthernet0/3/0ip address 10.1.1.1 255.0.0.0service-policy type access-control input parentIn the following sample output, all TCP packets are seen under the class map named ip_tcp and all packets matching the specific pattern are seen under the class map named test_class. TCP packets without the specific pattern are seen under the child policy named class-default, while all non-TCP packets are seen under the parent policy named class-default. (The counter is 0 in this example.)
Router# show policy-map type access-control interface gig0/3/0GigabitEthernet0/3/0Service-policy access-control input: parentClass-map: ip_tcp (match-all)2024995578 packets, 170099628552 bytes5 minute offered rate 775915000 bpsMatch: field IP version eq 4Match: field IP ihl eq 5Match: field IP protocol eq 6 next TCPService-policy access-control : childClass-map: test_class (match-all)1598134279 packets, 134243279436 bytes5 minute offered rate 771012000 bps, drop rate 771012000 bpsMatch: field TCP dest-port gt 10Match: start l3-start offset 40 size 32 regex "ABCD"dropClass-map: class-default (match-any)426861294 packets, 35856348696 bytes5 minute offered rate 4846000 bps, drop rate 0 bpsMatch: anyClass-map: class-default (match-any)0 packets, 0 bytes5 minute offered rate 0 bps, drop rate 0 bpsMatch: anyRouter#Example: Configuring Session-based FPM
The following example shows how to configure a class map and policy map to specify the protocol stack class, the match criteria and action to take, and a combination of classes using session-based (flow-based) and nonsession-based actions. The drop all command is associated with the action to be taken on the policy.
Router(config)# class-map type access-control match-all my-HTTPRouter(config-cm)# match field tcp destport eq 8080Router(config-cm)# match start tcp payload-start offset 20 size 10 regex "GET"Router(config)# class-map type access-control match-all my-FTPRouter(config-cmap)# match field tcp destport eq 21Router(config)# class-map type access-control match all class1Router(config-cmap)# match class my-HTTP sessionRouter(config-cmap)# match start tcp payload-start offset 40 size 20 regex "abc.*def"Router(config)# policy-map type access-control my_http_policyRouter(config-pmap)# class class1Router(config-pmap-c)# drop allRouter(config)# interface gigabitEthernet 0/1Router(config-if)# service-policy type access-control input my_http_policyExample: Configuring Session-based FPM with a Filter for Increased Performance and Accuracy
The following example shows how to configure a class map and policy map to specify the protocol stack class, the match criteria and action to take, and a combination of classes using session-based (flow-based) and nonsession-based actions. However, this example uses the match class packet-range command, which acts as a filter mechanism to increases the performance and matching accuracy of the regex-based FPM class map.
Router(config)# load disk2:ip.phdfRouter(config)# load protocol disk2:tcp.phdfRouter(config)# class-map type stack match-all ip_tcpRouter(config-cmap)# description "match TCP over IP packets"Router(config-cmap)# match field ip protocol eq 6 next tcpRouter(config)# class-map type access-control match-all WMRouter(config-cmap) # match start tcp payload-start offset 20 size 20 regex".*(WEBCO|WMSG|WPNS).......[LWT].*\xc0\x80"Router(config)# class-map type access-control match-all wtubeRouter(config-cmap) # match start tcp payload-start offset 20 size 20 regex".*GET\x20.*HTTP\x2f(0\.9|1\.0|1\.1)\x0d\x0aHost:\x20webtube.com\x0d\x0a"Router(config)# class-map type access-control match-all doomRouter(config-cmap) # match start tcp payload-start offset 20 size 20 string virusRouter(config)# class-map type access-control match-all class_webcoRouter(config-cmap)# match class WM sessionRouter(config-cmap)# match field ip length eq 0x194Router(config-cmap)# match start network-start offset 224 size 4 eq 0x4011010Router(config)# class-map type access-control match-all class_webtubeRouter(config-cmap)# match class wtube packet-range 1 5 sessionRouter(config-cmap)# match class doom sessionRouter(config-cmap)# match field ip length eq 0x194Router(config-cmap)# match start network-start offset 224 size 4 eq 0x4011010Router(config)# policy-map type access-control my_policyRouter(config-pmap)# class class_webcoRouter(config-pmap-c)# logRouter(config)# policy-map type access-control my_policyRouter(config-pmap)# class class_webtubeRouter(config-pmap-c)# drop allRouter(config)# policy-map type access-control P1Router(config-pmap)# class ip_tcpRouter(config-pmap-c)# service-policy my_policyRouter(config)# interface gigabitEthernet 0/1Router(config-if)# service-policy type access-control input P1Example: Verifying FPM Package Support
The following example shows how to verify FPM Package support.
Router# show fpm package-infofpm package-infohost 10.0.0.1remote-path fpm-group/local-path archive/user ciscopasswordprotocoltime-range weeklyRouter# show fpm package-groupgroup name: fpm-weekly-updateauto-loadfpm package: fpm-package-45fpm package: fpm-group-securepackage action: logAdditional References
Related Documents
Cisco IOS commands
Security commands
Configuring FPM using traffic classification definition files.
Flexible Packet Matching XML Configuration module in the Cisco IOS Security Configuration Guide: Securing the Data Plane
Complete suite of quality of service (QoS) commands
Standards
MIBs
None
To locate and download MIBs for selected platforms, Cisco software releases, and feature sets, use Cisco MIB Locator found at the following URL:
RFCs
Technical Assistance
Feature Information for Flexible Packet Matching
Table 1 lists the release history for this feature.
Use Cisco Feature Navigator to find information about platform support and software image support. Cisco Feature Navigator enables you to determine which software images support a specific software release, feature set, or platform. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Note
Table 1 Feature Information for Flexible Packet Matching
Flexible Packet Matching
12.4(4)T
12.2(18)ZYFPM is a packet classification feature that allows users to define one or more classes of network traffic by pairing a set of standard matching operators with user-defined protocol header fields.
In Cisco IOS Release 12.2(18)ZY, FPM was implemented on the Catalyst 6500 series of switches equipped with the PISA.
The following sections provide information about this feature:
•
•
The following commands were introduced or modified:
class, class-map, copy interface, debug fpm event, description, load protocol, match field, match start, policy-map, service-policy, show class-map, show policy-map interface, redirect interface, show protocol phdf.
FPM Full Packet Filtering
12.4(15)T
In Cisco IOS Release 12.4(15)T, FPM supports searching for patterns up to 56 bytes long anywhere within the entire packet. Prior to 12.4(15)T, FPM only supported searching for patterns up to 32 bytes long within the first 256 bytes of the packet.
Enhance FPM Search Window Size to 128 Bytes
12.2(18)ZYA
FPM supports searching for patterns up to 128 bytes long anywhere within the entire packet. Also, the number of filters that can be configured per class map has increased from 8 to 32. The additional filters can help offset adverse CPU performance that may occur if the "window" for pattern searching is increased. (However, some optimizations for better performance are possible with match-any type of class maps that have filters starting at same the same offset and the same size.)
FPM Copy or Redirect Matched Packets
12.2(18)ZYA1
When a match of the policy is found, the packet can be redirected to a different destination or a copy of the packet can be sent to a different destination.
This is possible with the copy interface and redirect interface commands introduced in this release.
The actions supported in this release are copy, copy and log, drop, drop and log, log, redirect, redirect and log.
FPM—Packaging, eTCDF, and Full Packet Search Enhancements
15.0(1)M
FPM—Packaging, eTCDF and Full Packet Search Enhancements provide preconfigured FPM filters written in XML format which can be directly loaded onto a router.
The following sections provide information about this feature:
•
•
•
•
The following commands were introduced or modified: algorithm, cipherkey, ciphervalue, filter-hash, filter-id, filter-version, fpm package-group, fpm package-info, show fpm-package-group, match encrypted, show fpm package-info.
Session-based Flexible Packet Matching
15.1(3)T
With the introduction of Cisco IOS Release 15.1(3)T, FPM can now match every packet against the filters specified in the class map and passes the match result to consecutive packets of the same network session. If a filter matches with malicious content in the packet's protocol header or payload, then the required action is taken to resolve the problem.
The following sections provide information about this feature:
•
•
•
•
•
The following commands were introduced or modified: match class session, drop, log.
Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1005R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.
© 2006-2011 Cisco Systems, Inc. All rights reserved1 Send ICMP unreachable is currently not supported on the Supervisor Engine 32 PISA.
