Table Of Contents

Flexible Packet Matching

Finding Feature Information

Contents

Prerequisites for Flexible Packet Matching

Restrictions for Flexible Packet Matching

Information About Flexible Packet Matching

Flexible Packet Matching Functional Overview

Protocol Header Description File

Filter Description

Traffic Classification Definition Files (TCDFs) for the Flexible Packet Matching XML Configuration

FPM on The Catalyst 6500 Equipped with PISA Overview

Encrypted TCDF Support

TCDF Packaging Support

Full Packet FPM Search Window Increase

How to Configure a Flexible Packet Matching Traffic Class and Traffic Policy

Creating a Traffic Class for Flexible Packet Matching

Troubleshooting Tips

What to Do Next

Creating a Traffic Policy for Flexible Packet Matching

Copying a Matched Packet To a Different Destination Interface

Redirecting a Matched Packet To a Different Destination Interface

Configuring Packaging Support for Flexible Packet Matching

Configuration Examples for FPM Configuration

Configuring FPM for Slammer Packets: Example

Configuring FPM for Blaster Packets: Example

Configuring FPM for MyDoom Packets: Example

Configuring and Verifying FPM on ASR Platform: Example

Verifying FPM Package Support: Example

Additional References

Related Documents

Standards

MIBs

RFCs

Technical Assistance

Feature Information for Flexible Packet Matching

Flexible Packet Matching

---

First Published: October 31, 2006

Last Updated: October 2, 2009

Flexible Packet Matching (FPM) is the next generation access control list (ACL) pattern matching tool, providing more thorough and customized packet filters. FPM enables users to match on arbitrary bits of a packet at an arbitrary depth in the packet header and payload. FPM removes constraints to specific fields that had limited packet inspection.

FPM is useful because it enables users to create their own stateless packet classification criteria and to define policies with multiple actions (such as drop, log, or send Internet Control Message Protocol [ICMP] unreachable¹ ) to immediately block new viruses, worms, and attacks.

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the "Feature Information for Flexible Packet Matching" section.

Use Cisco Feature Navigator to find information about platform support and Cisco IOS and Catalyst OS software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.

Contents

•Prerequisites for Flexible Packet Matching

•Restrictions for Flexible Packet Matching

•Information About Flexible Packet Matching

•How to Configure a Flexible Packet Matching Traffic Class and Traffic Policy

•Configuration Examples for FPM Configuration

•Additional References

•Feature Information for Flexible Packet Matching

Prerequisites for Flexible Packet Matching

•In Cisco IOS Release 12.4(4)T, FPM is available only in advanced security images.

•In Cisco IOS Release 12.2(18)ZY, FPM is also available in ipbase and ipservices images for the Supervisor Engine 32 Programmable Intelligent Services Accelerator (PISA) platform.

•Although access to an XML editor is not required, XML will ease the creation of protocol header description files (PHDFs).

Restrictions for Flexible Packet Matching

•FPM cannot be used to mitigate an attack that requires stateful classification.

•Because FPM is stateless, it cannot keep track of port numbers being used by protocols that dynamically negotiate ports. Thus, when using FPM, port numbers must be explicitly specified.

•FPM cannot perform IP fragmentation or TCP flow reassembly.

•FPM inspects only IPv4 unicast packets.

•FPM cannot classify packets with IP options.

•FPM does not support multicast packet inspection.

•FPM is not supported on tunnel and MPLS interfaces.

•FPM cannot be configured on FlexWAN cards.

•Noninitial fragments will not be matched by the FPM engine.

•Offset can be only a constant in a match start construct.

•FPM cannot match across packets.

•Mapping of FPM policies to control-plane is not supported.

Restrictions For the ASR Platform in Cisco IOS XE Release 2.2

•FPM can search for patterns up to 32 bytes in length within the first 256 bytes of the packet.

•A maximum of 8 filters (such as match entries) per class map are supported.

•For IP option packets, FPM inspects only the fields in the Layer 2 header and the first 20 bytes of the IP header.

•For noninitial IP fragments, FPM inspects only the fields in the Layer 2 header and the first 20 bytes of the IP header.

Information About Flexible Packet Matching

Before configuring FPM, you should understand the following concept:

•Flexible Packet Matching Functional Overview

•Traffic Classification Definition Files (TCDFs) for the Flexible Packet Matching XML Configuration

•FPM on The Catalyst 6500 Equipped with PISA Overview

•Encrypted TCDF Support

•TCDF Packaging Support

•Full Packet FPM Search Window Increase

Flexible Packet Matching Functional Overview

FPM allows customers to create their own filtering policies that can immediately detect and block new viruses and attacks.

A filtering policy is defined via the following tasks:

•Load a PHDF (for protocol header field matching)

•Define a class map and define the protocol stack chain (traffic class)

•Define a service policy (traffic policy)

•Apply the service policy to an interface

Protocol Header Description File

Protocol headers are defined in separate files called PHDFs; the field names that are defined within the PHDFs are used for defining the packet filters. A PHDF is a file that allows the user to leverage the flexibility of XML to describe almost any protocol header. The important components of the PHDF are the version, the XML file schema location, and the protocol field definitions. The protocol field definitions name the appropriate field in the protocol header, allow for a comment describing the field, provide the location of the protocol header field in the header (the offset is relative to the start of the protocol header), and provide the length of the field. Users can choose to specify the measurement in bytes or in bits.

---

Note The total length of the header must be specified at the end of each PHDF.

---

---

Note When redundant sup PHDF files are used by FPM policy, the files should also be on standby sup's corresponding disk. If the files are not available FPM policy will not work after the switch over.

---

Users can write their own custom PHDFs via XML for existing or proprietary protocols. However, the following standard PHDFs can also be loaded onto the router via the load protocol command: ip.phdf, ether.phdf, tcp.phdf, and udp.phdf.

---

Note Because PHDFs are defined via XML, they are not shown in a running configuration. However, you can use the show protocol phdf command to verify the loaded PHDF.

---

Standard PHDFs are available on Cisco.com at the following URL:
http://www.cisco.com/cgi-bin/tablebuild.pl/fpm

Filter Description

A filter description is a definition of a traffic class that can contain the header fields defined in a PHDF (using the match field command). If a PHDF is not loaded, the traffic class can be defined via the datagram header start (Layer 2) or the network header start (Layer 3) (using the match start command). If a PHDF has been loaded onto the router, the class specification begins with a list of the protocol headers in the packet.

A filter definition also includes the policy map; that is, after a class map has been defined, a policy map is needed to bind the match to an action. A policy map is an ordered set of classes and associated actions, such as drop, log, or send ICMP unreachable.

For information on how to configure a class map and a policy map for FPM, see the following section "How to Configure a Flexible Packet Matching Traffic Class and Traffic Policy."

Traffic Classification Definition Files (TCDFs) for the Flexible Packet Matching XML Configuration

FPM uses a traffic classification definition file (TCDF) to define policies that can block attacks on the network. Before Cisco IOS Release 12.4(6)T, FPM defined traffic classes (class maps), policies (policy maps), and service policies (attach policy maps to class maps) through the use of CLI commands. With TCDFs, FPM can use XML as an alternative to the CLI to define classes of traffic and specify actions to apply to the traffic classes. Traffic classification behavior is the same whether you create the behavior using a TCDF or configure it using CLI commands. Once a TCDF is created, it can be loaded on any FPM-enabled device in the network.

---

Note TCDFs are supported only in Cisco IOS Release 12.4(6)T and later T-train releases.

---

For more information on configuring FPM using TCDFs, see Flexible Packet Matching XML Configuration.

FPM on The Catalyst 6500 Equipped with PISA Overview

The PISA functions as a network-processor based daughter card that is mounted on the Catalyst 6500 Supervisor. PISA provides a superset of the multilater switch feature card 2a (MSFC2a) capabilities. In addition to performing all of the same functions as the MSFC2a, PISA also provides a dedicated hardware to accelerate certain features, such as FPM.

Network-Based Application Recognition (NBAR) occurs before FPM; thus, packets that are dropped by FPM are processed by NBAR.

Logging FPM Activity

In software-based FPM logging, every flow is logged and aggregated statistics are provided for each flow. Logging every flow for FPM on PISA would overwhelm the CPU; thus, only selective packets are logged. That is, when a packet matches a policy that is to be logged or the first time, the packet is logged, time-stamped, and stored. For every subsequent packet that matches any policy with a log action, the packet is checked for the difference between the current time (which is clocked by the global timer) and the last time stamp. If the current time is greater than the last time stamp, the packet is logged and the "stamp time" is updated with the current time.

Memory Requirements

---

Note Because memory requirements vary among system configurations, the requirements listed in this document are estimates.

---

•PISA will support a maximum of 1024 interfaces; however, it is expected that no more than 256 interfaces will be configured with FPM.

•A maximum of 32 classes per policy map, and a total of 1024 classes globally, are supported.

•A maximum of 32 filters (such as match entries) per class map are supported. (However, some optimizations for better performance are possible with match-any type of class maps that have filters starting at same the same offset and the same size.)

Encrypted TCDF Support

Traffic Classification Definition Files (TCDFs) provide pre-configured FPM filters written in XML format which can be directly loaded onto a router. The XML format prohibits the Cisco Product Security Incident Response Team (PSIRT) from being able to provide public TCDF filters as it would expose the vulnerability to potential attackers. This information could then be used to exploit PSIRT vulnerabilities in some systems.

FPM encrypted TCDF (eTCDF) filter support will provide encrypted FPM filters. Applying the PSIRT provided eTCDF FPM filter will protect routers from PSIRT incidents allowing time to certify new IOS releases that contains the PSIRT fixes.

To access eTCDFs you configure the router using the time-range command to periodically check for package updates. At the specified time the router connects to the server containing the FPM packages to request the latest version. When the router gets feedback from the server it compares the FPM packet version number from the server with the local FPM packet version. If there is an updated package on the server the router downloads the package content, replacing the old package with the new package and updating the local configuration.

TCDF Packaging Support

TCDFs are FPM filters in XML format, each TCDF file is designed to filter for a single individual worm or virus. TCDF packaging support provides packages containing at least one or more worm or virus filters and efficiently updates FPM filters as threat characteristics change. When FPM filters are updated all systems in a network are automatically updated. This reduces the the amount of router configuration needed to deploy FRM filters.

Full Packet FPM Search Window Increase

FPM now supports searching for patterns up to 256 bytes long anywhere within the entire packet. Also, the number of filters that can be configured per class map has increased from 8 to 32. The additional filters can help offset adverse CPU performance that may occur if the "window" for pattern searching is increased. This will also allow FPM users to take advantage of the regex strings used by IPS in their signatures.

How to Configure a Flexible Packet Matching Traffic Class and Traffic Policy

This section contains the following procedures that should be followed when configuring a FPM traffic class and traffic policy within your network:

•Creating a Traffic Class for Flexible Packet Matching

•Creating a Traffic Policy for Flexible Packet Matching

•Configuring Packaging Support for Flexible Packet Matching

Creating a Traffic Class for Flexible Packet Matching

Perform this task to create an FPM traffic class; that is, create a stateless packet classification criteria that, when used in conjunction with an appropriately defined policy, can mitigate network attacks.

---

Note If the PHDF protocol fields are referenced in the access-control classmap, the stack classmap is required in order to make FPM work properly

---

SUMMARY STEPS

1. enable

2. configure terminal

3. load protocol location:filename

4. class-map [type {stack | access-control}] class-map-name [match-all | match-any]

5. description character-string

6. match field protocol protocol-field {eq [mask] | neq [mask] | gt | lt | range range | regex string} value [next next-protocol]

7. match start {l2-start | l3-start} offset number size number
{eq | neq | gt | lt | range range | regex string} value [value2]

8. exit

9. show class-map [type {stack | access-control}] [class-map-name]

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. •Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	load protocol location:filename Example: Router(config)# load protocol disk2:udp.phdf	(Optional) Loads a PHDF onto a router. •The specified location must be local to the router. Note If a PHDF is not loaded, only the match start command can be used; that is, you cannot issue the match field command. Note For the ASR platform, PHDF files should be manually copied (via the load protocol command) to the active and standby route processor (RP) file systems.
Step 4	class-map [type {stack | access-control}] class-map-name [match-all | match-any] Example: Router(config)# class-map type access-control slammer match-all	Creates a class map to be used for matching packets to a specified class and enters class-map configuration mode. •type stack —Enables FPM to determine the correct protocol stack in which to examine. •type access-control—Determines the exact pattern to look for in the protocol stack of interest. •class-map-name—Can be a maximum of 40 alphanumeric characters. •If match-all or match-any are not specified, traffic must match all the match criterion to be classified as part of the traffic class.
Step 5	description character-string Example: Router(config-cmap)# description "match on slammer packets"	(Optional) Adds a description to the class map.
Step 6	match field protocol protocol-field {eq [mask] | neq [mask] | gt | lt | range range | regex string} value [next next-protocol] Example: Router(config-cmap)# match field udp dest-port eq 0x59A	(Optional) Configures the match criteria for a class map on the basis of the fields defined in the PHDFs.
Step 7	match start {l2-start | l3-start} offset number size number {eq | neq | gt | lt | range range | regex string} value [value2] Example: Router(config-cmap)# match start l3-start offset 224 size 4 eq 0x4011010	(Optional) Configures the match criteria for a class map on the basis of the datagram header (Layer 2) or the network header (Layer 3).
Step 8	exit Example: Router(config-cmap)# exit Example: Router(config)# exit	Exits class-map configuration mode and global configuration mode.
Step 9	show class-map [type {stack | access-control}] [class-map-name] Example: Router# show class-map type access-control slammer	(Optional) Displays all configured FPM class maps.

Troubleshooting Tips

To track all FPM events, issue the debug fpm event command.

The following sample output is from the debug fpm event command:

*Jun 21 09:22:21.607: policy-classification-inline(): matches class: class-default *Jun 21 
09:22:21.607: packet-access-control(): policy-map: fpm-policy, dir: input, match. retval: 
0x0, ip-flags: 0x80000000

What to Do Next

After you have defined at least one class map for your network, you must create a traffic policy and apply that policy to an interface as shown in the following task "Creating a Traffic Policy for Flexible Packet Matching."

Creating a Traffic Policy for Flexible Packet Matching

Perform this task to create an FPM traffic policy and apply the policy to a given interface.

SUMMARY STEPS

1. enable

2. configure terminal

3. policy-map [type access-control] policy-map-name

4. description character-string

5. class class-name [insert-before class-name]

6. drop

7. service-policy policy-map-name

8. exit

9. interface type name

10. service-policy [type access-control] {input | output} policy-map-name

11. exit

12. show policy-map interface [type access-control] interface-name [input | output]

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. •Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	policy-map [type access-control] policy-map-name Example: Router(config)# policy-map type access-control fpm-udp-policy	Creates or modifies a policy map that can be attached to one or more interfaces to specify a service policy and enters policy-map configuration mode.
Step 4	description character-string Example: Router(config-pmap)# description "policy for UDP based attacks"	(Optional) Adds a description to the policy map.
Step 5	class class-name [insert-before class-name] Example: Router(config-pmap)# class slammer	Specifies the name of a predefined traffic class, which was configured with the class-map command, used to classify traffic to the traffic policy. •insert-before class-name—Adds a class map to any location within the policy map. If this option is not issued, the class map is appended to the end of the policy map.
Step 6	drop Example: Router(config-pmap)# drop	(Optional) Configures a traffic class to discard packets belonging to a specific class. If this command is issued, note the following restrictions: •Discarding packets is the only action that can be configured in a traffic class. •When a traffic class is configured with the drop command, a "child" (nested) policy cannot be configured for this specific traffic class through the service policy command. •Discarding packets cannot be configured for the default class specified via the class class-default command.
Step 7	service-policy policy-map-name Example: Router(config-pmap-c)# service policy fpm-udp-policy	Creates hierarchical service policies.
Step 8	exit Example: Router(config-pmap-c)# exit Example: Router(config-pmap)# exit	Exits policy-map class configuration mode and policy-map configuration mode.
Step 9	interface type number Example: Router(config)# interface gigabitEthernet 0/1	Configures an interface type and enters interface configuration mode.
Step 10	service-policy [type access-control] {input | output} policy-map-name Example: Router(config-if)# service-policy type access-control input fpm-policy	Specifies the type and the name of the traffic policy to be attached to the input or output direction of an interface.
Step 11	exit Example: Router(config-if)# exit Example: Router(config)# exit	Exits interface configuration and global configuration modes.
Step 12	show policy-map interface [type access-control] interface-name [input | output] Example: Router# show policy-map interface type access-control interface gigabit 0/1	(Optional) Verifies the FPM configuration.

Copying a Matched Packet To a Different Destination Interface

Perform this task to configure a traffic class to copy packets belonging to a specific class to a different destination interface.

SUMMARY STEPS

1. enable

2. configure terminal

3. policy-map [type access-control] policy-map-name

4. description character-string

5. class class-name [insert-before class-name]

6. copy interface type number

7. service-policy policy-map-name

8. exit

9. interface type name

10. service-policy [type access-control] {input | output} policy-map-name

11. exit

12. show policy-map interface [type access-control] interface-name [input | output]

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. •Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	policy-map [type access-control] policy-map-name Example: Router(config)# policy-map type access-control fpm-udp policy	Creates or modifies a policy map that can be attached to one or more interfaces to specify a service policy and enters policy-map configuration mode.
Step 4	description character-string Example: Router(config-pmap)# description "policy for UDP based attacks"	(Optional) Adds a description to the policy map.
Step 5	class class-name [insert-before class-name] Example: Router(config-pmap)# class cmtest	Specifies the name of a predefined traffic class, which was configured with the class-map command, used to classify traffic to the traffic policy. •insert-before class-name—Adds a class map to any location within the policy map. If this option is not issued, the class map is appended to the end of the policy map.
Step 6	copy interface type number Example: Router(config-pmap-c)# copy interface FastEthernet 4/15	(Optional) Configures a traffic class to copy packets belonging to a specific class to a different destination inteface. If this command is issued, note the following restrictions: •This command cannot be using with drop or redirect interface command. •This command cannot be configured with a service policy for a stack class. •The packets can only be copied to the following interfaces: Ethernet, Fast Ethernet, Gigabit Ethernet and Ten Gigabit Ethernet.
Step 7	service-policy policy-map-name Example: Router(config-pmap-c)# service policy fpm-udp-policy	Creates hierarchical service policies.
Step 8	exit Example: Router(config-pmap-c)# exit Example: Router(config-pmap)# exit	Exits policy-map class configuration mode and policy-map configuration mode.
Step 9	interface type number Example: Router(config)# interface gigabitEthernet 0/1	Configures an interface type and enters interface configuration mode.
Step 10	service-policy [type access-control] {input | output} policy-map-name Example: Router(config-if)# service-policy type access-control input fpm-policy	Specifies the type and the name of the traffic policy to be attached to the input or output direction of an interface.
Step 11	exit Example: Router(config-if)# exit Example: Router(config)# exit	Exits interface configuration and global configuration modes.
Step 12	show policy-map interface [type access-control] interface-name [input | output] Example: Router# show policy-map interface type access-control interface gigabit 0/1	(Optional) Verifies the FPM configuration.

Redirecting a Matched Packet To a Different Destination Interface

Perform this task to configure a traffic class to redirect packets belonging to a specific class to a different destination.

SUMMARY STEPS

1. enable

2. configure terminal

3. policy-map [type access-control] policy-map-name

4. description character-string

5. class class-name [insert-before class-name]

6. redirect interface type number

7. service-policy policy-map-name

8. exit

9. interface type name

10. service-policy [type access-control] {input | output} policy-map-name

11. exit

12. show policy-map interface [type access-control] interface-name [input | output]

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. •Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	policy-map [type access-control] policy-map-name Example: Router(config)# policy-map type access-control fpm-udp policy	Creates or modifies a policy map that can be attached to one or more interfaces to specify a service policy and enters policy-map configuration mode.
Step 4	description character-string Example: Router(config-pmap)# description "policy for UDP based attacks"	(Optional) Adds a description to the policy map.
Step 5	class class-name [insert-before class-name] Example: Router(config-pmap)# class cmtest	Specifies the name of a predefined traffic class, which was configured with the class-map command, used to classify traffic to the traffic policy. •insert-before class-name—Adds a class map to any location within the policy map. If this option is not issued, the class map is appended to the end of the policy map.
Step 6	redirect interface type number Example: Router(config-pmap-c)# redirect interface FastEthernet 4/15	(Optional) Configures a traffic class to redirect packets belonging to a specific class to a different destination interface. If this command is issued, note the following restrictions: •This command cannot be using with drop or copy interface command. •This command cannot be configured with a service policy for a stack class. •The packets can only be copied to the following interfaces: Ethernet, Fast Ethernet, Gigabit Ethernet and Ten Gigabit Ethernet.
Step 7	service-policy policy-map-name Example: Router(config-pmap-c)# service policy fpm-udp-policy	Creates hierarchical service policies.
Step 8	exit Example: Router(config-pmap-c)# exit Example: Router(config-pmap)# exit	Exits policy-map class configuration mode and policy-map configuration mode.
Step 9	interface type number Example: Router(config)# interface gigabitEthernet 0/1	Configures an interface type and enters interface configuration mode.
Step 10	service-policy [type access-control] {input | output} policy-map-name Example: Router(config-if)# service-policy type access-control input fpm-policy	Specifies the type and the name of the traffic policy to be attached to the input or output direction of an interface.
Step 11	exit Example: Router(config-if)# exit Example: Router(config)# exit	Exits interface configuration and global configuration modes.
Step 12	show policy-map interface [type access-control] interface-name [input | output] Example: Router# show policy-map interface type access-control interface gigabit 0/1	(Optional) Verifies the FPM configuration.

Configuring Packaging Support for Flexible Packet Matching

Perform this task to configure FPM packaging support.

SUMMARY STEPS

1. enable

2. configure terminal

3. fpm package-info

4. time-range time-setting

5. host ip-address

6. local-path memory-option

7. remote-path path-name

8. exit

9. fpm package-group fpm-group-name

10. package fpm-packet-name

11. action log

12. auto-load

13. exit

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. •Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	fpm package-info Example: Router(config)# fpm package-info	Enters fpm configuration mode.
Step 4	time-range time-setting Example: Router(config-fpm-pak-info)# time-range weekly	Specifies the time interval to check for new fpm packages.
Step 5	host ip-address Example: Router(config-fpm-pak-info)#host 10.0.0.1	Specifies the location from where fpm package updates are downloaded.
Step 6	local-path memory-option Example: Router(config-fpm-pak-info)# local-path flash:	Specifies where the fpm packages are stored locally.
Step 7	remote-path path-name Example: Router(config-fpm-pak-info)# remote-path fpm-security	Specifies the location of the fpm packages on the fpm-server.
Step 8	exit Example: Router(config-fpm-pak-info)# exit	Exits fpm configuration.
Step 9	fpm package-group fpm-group-name Example: Router(config)# fpm package-group fpm-update	Specifies an fpm group and enters into fpm group definition mode.
Step 10	package fpm-package-name Example: Router(config-fpm-pak-grp)#package fpm-group-44	Specifies an fpm package and enters into fpm package definition mode.
Step 11	action log Example: Router(config-fpm-pak-grp-pak)#action log	Enables logging for this fpm package.
Step 12	auto-load Example: Router(config-fpm-pak-grp-pak)#auto-load	Enable automatic loading of the fpm package.
Step 13	exit Example: Router(config-fpm-pak-grp-pak)# exit Example: Router(config-fpm-pak-grp)# exit	Exits fpm package definition and fpm group definition modes.

Configuration Examples for FPM Configuration

This section contains the following configuration examples:

•Configuring FPM for Slammer Packets: Example

•Configuring FPM for Blaster Packets: Example

•Configuring FPM for MyDoom Packets: Example

•Configuring and Verifying FPM on ASR Platform: Example

•Verifying FPM Package Support: Example

Configuring FPM for Slammer Packets: Example

The following example shows how to define FPM traffic classes for slammer packets (UDP port 1434). The match criteria defined within the class maps is for slammer packets with an IP length not to exceed 404 bytes, UDP port 1434, and pattern 0x4011010 at 224 bytes from start of IP header. This example also shows how to define the service policy "fpm-policy" and apply it to the Gigabit Ethernet interface. Show commands have been issued to verify the FPM configuration. (Note that PHDFs are not displayed in show output because they are in XML format.)

Router(config)# load protocol disk2:ip.phdf

Router(config)# load protocol disk2:udp.phdf

Router(config)# class-map type stack match-all ip-udp

Router(config-cmap)# description "match UDP over IP packets"

Router(config-cmap)# match field ip protocol eq 0x11 next udp

Router(config)# class-map type access-control match-all slammer

Router(config-cmap)# description "match on slammer packets"

Router(config-cmap)# match field udp dest-port eq 0x59A

Router(config-cmap)# match field ip length eq 0x194

Router(config-cmap)# match start l3-start offset 224 size 4 eq 0x4011010

Router(config)# policy-map type access-control fpm-udp-policy

Router(config-pmap)# description "policy for UDP based attacks"

Router(config-pmap)# class slammer

Router(config-pmap-c)# drop

Router(config)# policy-map type access-control fpm-policy

Router(config-pmap)# description "drop worms and malicious attacks"

Router(config-pmap)# class ip-udp

Router(config-pmap-c)# service-policy fpm-udp-policy

Router(config)# interface gigabitEthernet 0/1

Router(config-if)# service-policy type access-control input fpm-policy

Router# show policy-map type access-control interface gigabit 0/1

GigabitEthernet0/1

Service-policy access-control input: fpm-policy

Class-map: ip-udp (match-all)

0 packets, 0 bytes

3 minute offered rate 0 bps

Match: field IP protocol eq 0x11 next UDP

Service-policy access-control : fpm-udp-policy

Class-map: slammer (match-all)

0 packets, 0 bytes

3 minute offered rate 0 bps, drop rate 0 bps

Match: field UDP dest-port eq 0x59A

Match: field IP length eq 0x194

Match: start l3-start offset 224 size 4 eq 0x4011010

drop

Class-map: class-default (match-any)

0 packets, 0 bytes

3 minute offered rate 0 bps, drop rate 0 bps

Match: any

Class-map: class-default (match-any)

0 packets, 0 bytes

3 minute offered rate 0 bps, drop rate 0 bps

Match: any

Router# show protocol phdf ip

Protocol ID: 1

Protocol name: IP

Description: Definition-for-the-IP-protocol

Original file name: disk2:ip.phdf

Header length: 20

Constraint(s):

Total number of fields: 12

Field id: 0, version, IP-version

Fixed offset. offset 0

Constant length. Length: 4

Field id: 1, ihl, IP-Header-Length

Fixed offset. offset 4

Constant length. Length: 4

Field id: 2, tos, IP-Type-of-Service

Fixed offset. offset 8

Constant length. Length: 8

Field id: 3, length, IP-Total-Length

Fixed offset. offset 16

Constant length. Length: 16

Field id: 4, identification, IP-Identification

Fixed offset. offset 32

Constant length. Length: 16

Field id: 5, flags, IP-Fragmentation-Flags

Fixed offset. offset 48

Constant length. Length: 3

Field id: 6, fragment-offset, IP-Fragmentation-Offset

Fixed offset. offset 51

Constant length. Length: l3

Field id: 7, ttl, Definition-for-the-IP-TTL

Fixed offset. offset 64

Constant length. Length: 8

Field id: 8, protocol, IP-Protocol

Fixed offset. offset 72

Constant length. Length: 8

Field id: 9, checksum, IP-Header-Checksum

Fixed offset. offset 80

Constant length. Length: 16

Field id: 10, source-addr, IP-Source-Address

Fixed offset. offset 96

Constant length. Length: 32

Field id: 11, dest-addr, IP-Destination-Address

Fixed offset. offset 128

Constant length. Length: 32

Router# show protocol phdf udp

Protocol ID: 3

Protocol name: UDP

Description: UDP-Protocol

Original file name: disk2:udp.phdf

Header length: 8

Constraint(s):

Total number of fields: 4

Field id: 0, source-port, UDP-Source-Port

Fixed offset. offset 0

Constant length. Length: 16

Field id: 1, dest-port, UDP-Destination-Port

Fixed offset. offset 16

Constant length. Length: 16

Field id: 2, length, UDP-Length

Fixed offset. offset 32

Constant length. Length: 16

Field id: 3, checksum, UDP-Checksum

Fixed offset. offset 48

Constant length. Length: 16

Configuring FPM for Blaster Packets: Example

The following example shows how to configure FPM for blaster packets. The class map contains the following match criteria: TCP port 135, 4444 or UDP port 69; and pattern 0x0030 at 3 bytes from start of IP header.

Router(config)# load protocol disk2:ip.phdf

Router(config)# load protocol disk2:tcp.phdf

Router(config)# load protocol disk2:udp.phdf 

Router(config)# class-map type stack match-all ip-tcp

Router(config-cmap)# match field ip protocol eq 0x6 next tcp

Router(config)# class-map type stack match-all ip-udp

Router(config-cmap)# match field ip protocol eq 0x11 next udp

Router(config)# class-map type access-control match-all blaster1

Router(config-cmap)# match field tcp dest-port eq 135

Router(config-cmap)# match start l3-start offset 3 size 2 eq 0x0030

Router(config)# class-map type access-control match-all blaster2

Router(config-cmap)# match field tcp dest-port eq 4444

Router(config-cmap)# match start l3-start offset 3 size 2 eq 0x0030

Router(config)# class-map type access-control match-all blaster3

Router(config-cmap)# match field udp dest-port eq 69

Router(config-cmap)# match start l3-start offset 3 size 2 eq 0x0030

Router(config)# policy-map type access-control fpm-tcp-policy

Router(config-pmap)# class blaster1

Router(config-pmap-c)# drop

Router(config-pmap-c)# class blaster2

Router(config-pmap-c)# drop

Router(config)# policy-map type access-control fpm-udp-policy

Router(config-pmap)# class blaster3

Router(config-pmap-c)# drop

Router(config)# policy-map type access-control fpm-policy

Router(config-pmap)# class ip-tcp

Router(config-pmap-c)# service-policy fpm-tcp-policy

Router(config-pmap)# class ip-udp

Router(config-pmap-c)# service-policy fpm-udp-policy

Router(config)# interface gigabitEthernet 0/1

Router(config-if)# service-policy type access-control input fpm-policy

Configuring FPM for MyDoom Packets: Example

The following example shows how to configure FPM for MyDoom packets. The match criteria is as follows:

•90 > IP length > 44

•pattern 0x47455420 at 40 bytes from start of IP header

or

•IP length > 44

•pattern 0x6d3a3830 at 48 bytes from start of IP header

•pattern 0x47455420 at 40 bytes from start of IP header

Router(config)# load protocol disk2:ip.phdf

Router(config)# load protocol disk2:tcp.phdf

Router(config)# class-map type stack match-all ip-tcp

Router(config-cmap)# match field ip protocol eq 0x6 next tcp

Router(config)# class-map type access-control match-all mydoom1

Router(config-cmap)# match field ip length gt 44

Router(config-cmap)# match field ip length lt 90

Router(config-cmap)# match start l3-start offset 40 size 4 eq 0x47455420

Router(config)# class-map type access-control match-all mydoom2

Router(config-cmap)# match field ip length gt 44

Router(config-cmap)# match start l3-start offset 40 size 4 eq 0x47455420

Router(config-cmap)# match start l3-start offset 78 size 4 eq 0x6d3a3830

Router(config)# policy-map type access-control fpm-tcp-policy

Router(config-pmap)# class mydoom1

Router(config-pmap-c)# drop

Router(config-pmap-c)# class mydoom2

Router(config-pmap-c)# drop

Router(config)# policy-map type access-control fpm-policy

Router(config-pmap)# class ip-tcp

Router(config-pmap-c)# service-policy fpm-tcp-policy

Router(config)# interface gigabitEthernet 0/1

Router(config-if)# service-policy type access-control input fpm-policy

Configuring and Verifying FPM on ASR Platform: Example

The following example shows how to configure FPM on the ASR platform.

load protocol bootflash:ip.phdf

load protocol bootflash:tcp.phdf

class-map type stack match-all ip_tcp

 match field IP protocol eq 6 next TCP

class-map type access-control match-all test_class

 match field TCP dest-port gt 10

 match start l3-start offset 40 size 32 regex "ABCD"

policy-map type access-control child

 class test_class

  drop

policy-map type access-control parent

 class ip_tcp

  service-policy child

interface GigabitEthernet0/3/0

 ip address 10.1.1.1 255.0.0.0

 service-policy type access-control input parent

In the following sample output, all TCP packets are seen under the class-map "ip_tcp" and all packets matching the specific pattern are seen under the class-map "test_class." TCP packets without the specific pattern are seen under the child policy "class-default," while all non-tcp packets are seen under the parent policy "class-default." (The counter is 0 in this example.)

Router# show policy-map type access-control interface gig0/3/0

GigabitEthernet0/3/0

 Service-policy access-control input: parent

  Class-map: ip_tcp (match-all)

  2024995578 packets, 170099628552 bytes

  5 minute offered rate 775915000 bps

  Match: field IP version eq 4

  Match: field IP ihl eq 5

  Match: field IP protocol eq 6 next TCP

 Service-policy access-control : child

 Class-map: test_class (match-all)

  1598134279 packets, 134243279436 bytes

  5 minute offered rate 771012000 bps, drop rate 771012000 bps

  Match: field TCP dest-port gt 10

  Match: start l3-start offset 40 size 32 regex "ABCD"

 drop

 Class-map: class-default (match-any)

  426861294 packets, 35856348696 bytes

  5 minute offered rate 4846000 bps, drop rate 0 bps

  Match: any

 Class-map: class-default (match-any)

  0 packets, 0 bytes

  5 minute offered rate 0 bps, drop rate 0 bps

  Match: any

Router#

Verifying FPM Package Support: Example

The following example shows how to verify FPM Package support.

Router# show fpm package-info 

 fpm package-info

  host 10.0.0.1

  remote-path fpm-group/

  local-path archive/

  user cisco

  password 

  protocol 

  time-range weekly

Router# show fpm package-group

 group name: fpm-weekly-update

  auto-load

  fpm package: fpm-package-45

  fpm package: fpm-group-secure

   package action: log 

Additional References

The following sections provide references related to Flexible Packet Matching.

Related Documents

Related Topic	Document Title
Configuring FPM using traffic classification definition files (TCDFs).	Flexible Packet Matching XML Configuration
Complete suite of QoS commands	Cisco IOS Quality of Service Solutions Command Reference

Standards

Standards	Title
None	—

MIBs

MIBs	MIBs Link
None	To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL: http://www.cisco.com/go/mibs

RFCs

RFCs	Title
None	—

Technical Assistance

Description

Link

The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies. To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds. Access to most tools on the Cisco Support website requires a Cisco.com user ID and password.

http://www.cisco.com/techsupport

Feature Information for Flexible Packet Matching

Table 1 lists the release history for this feature.

Not all commands may be available in your Cisco IOS software release. For release information about a specific command, see the command reference documentation.

Use Cisco Feature Navigator to find information about platform support and software image support. Cisco Feature Navigator enables you to determine which Cisco IOS and Catalyst OS software images support a specific software release, feature set, or platform. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.

---

Note Table 1 lists only the Cisco IOS software release that introduced support for a given feature in a given Cisco IOS software release train. Unless noted otherwise, subsequent releases of that Cisco IOS software release train also support that feature.

---

Table 1 Feature Information for Flexible Packet Matching 

Feature Name	Releases	Feature Information
Flexible Packet Matching	12.4(4)T 12.2(18)ZY Cisco IOS XE Release 2.2	FPM is a packet classification feature that allows users to define one or more classes of network traffic by pairing a rich set of standard matching operators with user-defined protocol header fields. In Cisco IOS Release 12.2(18)ZY, FPM was implemented on the Catalyst 6500 series of switches equipped with the PISA. In Cisco IOS XE Release 2.2, FPM was introduced on Cisco ASR 1000 Series Routers. The following sections provide information about this feature: •Information About Flexible Packet Matching •Flexible Packet Matching Functional Overview The following commands were introduced or modified: class (policy-map) , class-map, debug fpm event, description (class-map), load protocol, match field, match start, policy-map, service-policy, show class-map, show policy-map interface, show protocol phdf, copy interface, redirect interface
FPM Full Packet Filtering	12.4(15)T	In Cisco IOS Release 12.4(15)T, FPM now supports searching for patterns up to 56 bytes long anywhere within the entire packet. Prior to 12.4(15)T, FPM only supported searching for patterns up to 32 bytes long within the first 256 bytes of the packet.
Enhance FPM Search Window Size To 128 bytes	12.2(18)ZYA	FPM now supports searching for patterns up to 128 bytes long anywhere within the entire packet. Also, the number of filters that can be configured per class map has increased from 8 to 32. The additional filters can help offset adverse CPU performance that may occur if the "window" for pattern searching is increased. (However, some optimizations for better performance are possible with match-any type of class maps that have filters starting at same the same offset and the same size.)
FPM copy or redirect matched packets	12.2(18)ZYA1	When a match of the policy is found, the packet can be redirected to a different destination or a copy of the packet can be sent to a different destination. This is possible with the copy interface and redirect interface commands introduced in this release. The actions supported in this release are drop, log, copy, redirect, drop and log, copy and log, redirect and log.
FPM- Packaging, eTCDF and Full Packet Search Enhancements	15.0(1)M	FPM- Packaging, eTCDF and Full Packet Search Enhancements provide pre-configured FPM filters written in XML format which can be directly loaded onto a router. The following sections provide information about this feature: •Encrypted TCDF Support •TCDF Packaging Support •Full Packet FPM Search Window Increase •Configuring Packaging Support for Flexible Packet Matching •Verifying FPM Package Support: Example The following commands were introduced or modified: fpm package-group, fpm package-info, show fpm-package-group, show fpm package-info.

CCDE, CCENT, CCSI, Cisco Eos, Cisco HealthPresence, Cisco IronPort, the Cisco logo, Cisco Lumin, Cisco Nexus, Cisco Nurse Connect, Cisco Pulse, Cisco StackPower, Cisco StadiumVision, Cisco TelePresence, Cisco Unified Computing System, Cisco WebEx, DCE, Flip Channels, Flip for Good, Flip Mino, Flipshare (Design), Flip Ultra, Flip Video, Flip Video (Design), Instant Broadband, and Welcome to the Human Network are trademarks; Changing the Way We Work, Live, Play, and Learn, Cisco Capital, Cisco Capital (Design), Cisco:Financed (Stylized), Cisco Store, and Flip Gift Card are service marks; and Access Registrar, Aironet, AllTouch, AsyncOS, Bringing the Meeting To You, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, CCVP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco  IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Collaboration Without Limitation, Continuum, EtherFast, EtherSwitch, Event Center, Explorer, Fast Step, Follow Me Browsing, FormShare, GainMaker, GigaDrive, HomeLink, iLYNX, Internet Quotient, IOS, iPhone, iQuick Study, IronPort, the IronPort logo, Laser Link, LightStream, Linksys, MediaTone, MeetingPlace, MeetingPlace Chime Sound, MGX, Networkers, Networking Academy, Network Registrar, PCNow, PIX, PowerKEY, PowerPanels, PowerTV, PowerTV (Design), PowerVu, Prisma, ProConnect, ROSA, ScriptShare, SenderBase, SMARTnet, Spectrum Expert, StackWise, The Fastest Way to Increase Your Internet Quotient, TransPath, WebEx, and the WebEx logo are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.

All other trademarks mentioned in this document or website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0908R)

Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.

© 2007—2009 Cisco Systems, Inc. All rights reserved

¹ Send ICMP unreachable is currently not supported on the Supervisor Engine 32 PISA.