Political map SFR

Similar Questions

• How can I see traffic firesight firepower?

  Hi all

  After that I put the traffic via the module and added firepower unit in the centre of defence. In the analysis > Explorer context, it shows me that no data. I see the traffic in the center of defense?

  Thank you

  Hello

  I see that you have several class cards for SFR binded in political map which is bad practice and also show service-strategy sfr, I see no redirected traffic.

  Remove all the cards from class under the policy maps for SFR. Simply create 1 class-card as below:

  SFR SFR a permit ip extended access-list

  class-map SFR

  corresponds to the SFR access list

  international policy-policy

  class SFR

  SFR rescue

  Reference: http://www.cisco.com/c/en/us/td/docs/security/asa/asa93/configuration/fi...

  Kind regards

  Aastha Bhardwaj

  Rate if this is useful!

• VPN IPsec: several LAN on one side - is it possible?

  Hi people!

  I have an IPsec Site to Site VPN branch (R2). There was a single LAN (LAN1) at HQ and another (LAN2) on the Executive.

  The tunnel end points:

  • R1 - Microsoft ISA Server
  • R2 - Cisco 2921 SRI

  LAN3 was created recently, behind R2 (see image below):

  

  So, I need to access LAN3 of LAN1. How could I solve this problem? I see two options for now.

  OPTION 1: Create a separate tunnel between R1 and R2

  

  I see a problem here:

  1. How to set a key for this tunnel?
     If I run something like this:
     ISAKMP crypto key LAN1_to_LAN2_key address 1.1.1.1
     then LAN1, LAN2 tunnel will be abandoned due to the modified key
  2. Everything else looks good - political maps, road maps, etc.
     Traffic stand between them

  OPTION 2: Create a summary route in config VPN

  

  Questions:

  1. R1 does not seem to support this kind of configuration (source, article "political quick mode negotiation fails with an error 'No configured policy'")

  How could I solve this problem?

  Running-config (security framework) is attached

  On the side of Cisco, it's easy to solve. I can't explain how to fix the side R1 Microsoft but suspect that it is not difficult.

  You don't want a second tunnel to solve this problem. You want to modify the access list that identifies the traffic is encrypted. If it were me, I would add this line to your existing access list

   permit ip 192.168.3.0 0.0.0.255 192.168.101.0 0.0.0.255

  or alternatively, you can replace this line

   permit ip 192.168.2.0 0.0.0.255 192.168.101.0 0.0.0.255

  with this line

   permit ip 192.168.2.0 0.0.1.255 192.168.101.0 0.0.0.255

  HTH

  Rick

• QoS policy & policy-card entry on marking interface

  Dear experts from Cisco,

  I am deploying QoS on a WAN. On the LAN to the interface of a 3845 router, I need police and mark traffic between the local network. I tried to add two separate policies of the interface, but this was rejected.

  So my questions are;

  1. is it possible to have two incoming policies on an interface? If so, how?

  2. If the above is not possible how the above is possible using nested policies?

  Here's my policy:

  Policy-map MARKING
  class VOICE
  set ip dscp ef
  class in time REAL-INTERACTIVE
  set ip dscp af41
  class CRITICISM-DATA-AF31
  set ip dscp af31
  class CRITICISM-DATA-AF21
  set ip dscp af21
  SIGNALLING of class
  set ip dscp cs3
  the class of DATA MASS
  set ip dscp af13
  class SCAVENGER
  set ip dscp cs1
  NETWORK-CONTROL class
  set ip dscp cs6
  class class by default

  !

  POLICE policy-map
  class VOICE
  Police cir 5000000
  EF game-dscp-transmit action in line
  EF exceed the action set-dscp-transmit
  failure to send set-dscp action violate

  This is the error I get when you try to add the second sheet of policy to the interface:

  Router (config) #int IM 0/0/0
  Router(Config-if) #service - political POLICING entry
  Political map of MARKING is already attached

  Thanking you in advance for your help and your time.

  Kind regards

  Paul

  Disclaimer

  The author of this announcement offers the information in this publication without compensation and with the understanding of the reader that there is no implicit or explicit adequacy or adaptation to any purpose. Information provided is for information purposes only and should not be interpreted as making the professional advice of any kind. Use information from this announcement is only at risk of the reader.

  RESPONSIBILITY

  Any author will be responsible for any wha2tsoever of damage and interest (including, without limitation, damages for loss of use, data or profits) arising out of the use or inability to use the information in the view even if author has been advised of the possibility of such damages.

  Poster

  Only one service entry and/or authorized release policy.

  You don't need a strategy nested.  Change class of your MARKING policy VOICE to be what you have for your POLICE policy VOICE class.

  i.e.

  Policy-map MARKING
  class VOICE
  set ip dscp ef

  Police cir 5000000
  EF game-dscp-transmit action in line
  EF exceed the action set-dscp-transmit
  failure to send set-dscp action violate
  class in time REAL-INTERACTIVE
  set ip dscp af41
  class CRITICISM-DATA-AF31
  set ip dscp af31
  class CRITICISM-DATA-AF21
  set ip dscp af21
  SIGNALLING of class
  set ip dscp cs3
  the class of DATA MASS
  set ip dscp af13
  class SCAVENGER
  set ip dscp cs1
  NETWORK-CONTROL class
  set ip dscp cs6
  class class by default

  ! You can also set a default class marking

  ! MAYBE

• ASA of asymmetric routing

  Hi all

  Having an ASA anyconnect and s2s tunnels running.

  Goal: enable anyconnect to users access to resources on ipsec tunnel.

  Problem: anyconnect users and s2s tunnels using the same outside the interface.

  Applied configuration:

  1. permit same-security-traffic intra-interface

  2 strategy map configured to bypass tcp on the external interface connections

  But these measures did not help. RA users may not join s2s subnet.

  Please tell us how to achieve this goal.

  Thanks in advance

  Alex

  You shouldn't have political map of workaround.

  You will need a NAT exemption for the pool VPN for remote subnets. Ethan Banks has a nice article on exactly this Setup here:

  http://packetpushers.NET/Cisco-ASA-8-38-4-Hairpinning-NAT-configuration/

• Enabling QoS on the router

  Hello
  I am pretty raw on qos in layer 3 and let me know if Miss me something, or one that is most simple/better way to do this. I have a standard c881 cisco on my provider MPLS network and I'm trying to do the router on location1 qos in the router on guest place.2.
  I'm tagging 3 types of traffic to give priority and bandwidth reserved for some and shape the other, I mark with access-list, voip, 1 based on the ports, important traffic traffic traffic 2 based on ports. I haved create the group class cards matched access those access the lists, then the political cards on these classes and that's where it's a blur.

  AS FAR AS I KNOW:
  (1) I must apply the marking map policy on the entry of my local lan and the law enforcement out of my output interface?
  (2) QoS applies when theres is congestion on the network?
  (3) display all types of qos are, you have to choose, or you can mix them I'm confuse between DSCP and IP which is the best priority
  (4) after all this don't I have still have to control the interface as fair-queue or simply by the interface of police am good?

  * I have no control over the provider's on the MPLS router and I do not have a managed switch

  Thank you for everything I want to know if I'm in the right direction.

  OK quite a general question, you asked, but I'll try my best to answer them for you. Yes, you must mark your packages, you can do this entering the LAN interface that works perfectly. Mark using IP (0-7) prec or DSCP (https://www.tucny.com/Home/dscp-tos). This link will give you the numbers for both the DSCP or IP prec markings in decimal form and by class name. Personally if you are a beginner to QoS I think fair use IP prec sound much simpler.

  Prev IP you can skip classes 6 & 7 are for control, and routing protocols that are (dependent on platform of course) marked by the router automatically must be preferred. Class 5 is usually used for voice traffic, 4 for video, 1-3 for data traffic according to its importance and 0 for traffic best effort.

  So the first step is to decide what you want mark to what levels. Create ACLs or similar to match the traffic you want to match, then mark this traffic to the previous IP.

  Then on the outbound queue to the provider you want to prioritize. So if you have the voice traffic and you marked it IP prec 5 (exp its often called) so usually you would setup a queue to low latency to ensure that traffic is always priority over all others and sent immediately - reason being to reduce jitter causing major problems to voice packets. Do you this by using the priority order. Be careful with this command as the bandwidth that you put in after the declaration of priority is also a policeman to that number. Then in the other class-maps you match other numbers of IP precedence and use 'bandwidth' instructions to give them specific levels of bandwidth - are not controllers but package corresponding to these statements is less preferred than those corresponding to the queue of "priority".

  As below:

  http://www.Cisco.com/c/en/us/support/docs/quality-of-service-QoS/QoS-PAC...

  This part is more complex and may not be necessary depending on what you do, but you can do a few child-parent, formatted at this time as well. Some people will create a parent policy map called the previous policy card in it and the EIF of the circuit you have forms of PSI. This helps avoid maxing out the link congestion and better deals in gusts only one traffic profiles policeman. Or you can just put controllers in your class cards rather than statements of "bandwidth" If you know what each class requires.

  Finally and probably the forest hardest as it might involve talking to your access provider, make sure that they carry your brands through their base to your other sites. If they are, you should be able to create a political map on your other sites entering the WAN corresponding to different brands of IP precedence. You can then send the test traffic and you should see the stats of policy-plan of traffic on the corresponding end if the ISP realizes your markings. Most do so.

  Hope that covers everything you need, please rate answer.

• Dashboard empty Cisco PRSM

  Hello

  I have problems with configuring Cisco PRSM on ASA5512-SSD120-K9.

  Here is the Conference on the ASA:

  interface GigabitEthernet0/2

  LAN description

  nameif inside

  security-level 100

  10.1.1.1 IP address 255.255.255.0

  !

  political INNER-political map

  INTERIOR-class

  cxsc rescue

  !

  INTERIOR-policy-policy of service inside interface

  CX module details:

  ASA - FW # display the module cxsc details

  The details of the Service module, please wait...

  Card type: ASA Security Appliance CX5512

  Model: ASA CX5512

  Hardware version: N/A

  Firmware version: N/A

  Software version: 9.1.1

  App name: ASA CX

  App status. : to the top

  App Status / / Desc: Normal operation

  App version: 9.1.1

  Flight status data: to the top

  Status: to the top

  Mgmt IP addr: 10.1.1.250

  MGMT network mask: 255.255.255.0

  Gateway of MGMT: 10.1.1.1

  Web to MGMT ports: 443

  Mgmt TLS enabled: true

  And when I go to https://10.1.1.250 and login, it shows all graph (see photo). The same happens when I click on the tabs 'Policies', 'events '. Only "Administraton" tab works well, I can add new users or enter new licenses. The same phenomenon occurs in all browsers.

  Am I missing something obvious here? What could be the problem?

  I see you run 9.1.1. Is it possible for you to upgrade to the latest version?

• Of SSL VPN is not able to access from the outside

  Configuration SSL VPN, unable to access from outside, when trying to access the browser site, it says "cannot display the Page.

  Area basic firewall is configured, there must be something that I'm missing, please see the attached config.

  Any help please

  Looks like you will have to allow SSL VPN from the WAN traffic to the free zone (ZP-WAN-to-self), so you need to update the political map (PMAP-JM-WAN) in particular the ACL (ACL-VPN-PROTOCOL), must allow access to port 443 of any source IP address:

  permit tcp any  eq 443

  .. .should do the trick. Cheers, Seb.

• URL filtering - allowing one single site, blocking all the others

  Hello.

  I want to use ASA to allow a computer to access a single website (www.tsf.pt).

  I used the following Setup, but I'm not be able to put it to work, since all web traffic is prohibited.

  access-list Inside_mpc line 1 extended permits object-group Web_Access virtual object TI any4 (Web_Access group allows http and https)

  Regex TSF "tsf\.pt."
       
  type of policy-card inspect http TSF
  parameters
  violation of Protocol action drop-connection
  not match request uri regex TSF
  Reset log

  TSF-filter-class of the class-map
  matches the access list Inside_mpc

  Policy-map filter TSF
  TSF-filter-class
  inspect the http TSF

  interface of TSF-filter service-policy inside

  My idea is that anything which did not correspond to the www.tsf.pt would be refused. After I failed to do so I configured the policy with an match request uri regex TSF (with delivery to zero and newspaper) and when I opened the site I have seen increasing political access number (it was just to check that the ASA dealt with regex).

  After I tried the following policy which does not also (did this because I didn't know if it was implicitly refuse at the end of the political map)

  type of policy-card inspect http TSF
  parameters
  violation of Protocol action drop-connection
  matches the query uri regex TSF
  Journal

   match not request uri regex TSF
  Reset log

  Is there something wrong with my config? Am I missing something?

  Thanks in advance,

  João.

  Hello, João,.

  Fix your regular expression:

  Regex TSF "\.tsf\.pt."

  You can test if your regex is correct by testing using cmd:

  ciscoasa (config) # test regex www.tsf.pt "\.tsf\.pt".
  NEWS: Regular expression match succeeded.

  HTH

  "Please rate messages helpul.

• Policy global config use IPS (ASA 5520)

  I get an error... ERROR: Global_policy political map is already configured as a service policy when I try to configure the IP addresses. How can I fix this config?

  -Change in Config attempt-

  HO1ASA01 # conf t

  HO1ASA01 (config) # IPS ip access list allow a whole

  Class-map IPS-CLASS of HO1ASA01 (config) #.

  HO1ASA01(config-CMAP) # match access-list IPS

  HO1ASA01(config-CMAP) # policy - map IPS POLICY

  HO1ASA01(config-pmap) # IPS - class

  HO1ASA01(config-pmap-c) # ips overcrowding relief

  HO1ASA01(config-pmap-c) # service - IPS - comprehensive POLICY

  ERROR: Global_policy political map is already configured as a service policy

  HO1ASA01 (config) #.

  HO1ASA01 (config) #.

  -During the running Config.

  IPS-CLASS class-map

  corresponds to the IP access list

  class-map inspection_default

  match default-inspection-traffic

  !

  !

  type of policy-card inspect dns preset_dns_map

  parameters

  message-length maximum 1024

  Policy-map global_policy

  class inspection_default

  inspect the preset_dns_map dns

  inspect the ftp

  inspect h323 h225

  inspect the h323 ras

  inspect the rsh

  inspect the rtsp

  inspect sqlnet

  inspect the skinny

  inspect sunrpc

  inspect xdmcp

  inspect the sip

  inspect the netbios

  inspect the tftp

  inspect the icmp

  IPS-POLICY policy-map

  IPS-class

  IPS overcrowding relief

  !

  global service-policy global_policy

  The reason why you got the warning is because you already had the global "service-policy global_policy" line in the config. You didn't have to be reintroduced in this one.

  You must get rid of "policy-map IPS-POLICY.".

• AIP SSM-10 - how to check traffic being passed for inspection?

  Hello

  I've implemented an AIP - SSM on our ASA5510 for the first time, as a result of this excellent guide, http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00807335ca.shtml.

  The difference between the environment used in the doco and ours are the specifications of our ASA and module, the following IOS version 8.0 (4), version ASDM is 6.1 (3), the version of the application of SSM is 5,0000 E2.

  I have followed all the steps to enable connectivity to the module of the ASDM, created the access list to allow all ip traffic to be transmitted to the inspection module, map of the class and the political map indicating promiscous mode, relief. The service policy is applied throughout the world.

  The problem I'm having is that when I try to check as indicated on the guide to the alert of events see the command on the CLI module I don't get any output, so I don't know if the traffic is passed to the module. Can someone plese help me clarify this?

  Kind regards

  Esteban

  Run 'show conf' on your AIP SSM CLI. Check interface GigabitEthernet0/1 basket of the MSS background assigned to sensor virtual vs0.

  If it does not, then run "setup" and towards the end of the installation wizard, there will be an option to change the interface and the virtual sensor configuration. Use this option to change the configuration for sensor virtual vs0 and in the interface.

  You can also run "show stat vs0 virtual sensor" to see the number of packets being crawled by vs0.

• Assign the virtual sensor in the MODE SINGLE ASA5510-AIP10SP-K9

  Hello

  I install asa 2 ASA5510-AIP10SP-K9 in standby mode active failover. I know how to assign virtual devices to the contexts of the ASA in multiple mode (active/active failover). But I want it to be done in simple mode (active/standby failover). Any idea will be welcomed.

  OK, now I understand what you need.

  Most users need only the single default «vs0» virtual sensor

  To get traffic from the ASA to send to the SSM for follow-up here are the basic steps:

  (The assumption is that you have already previously connected and changed the password and went through the steps in "setup" to set the IP address, network and other settings on your sensor mask.)

  (1) in the AIP - SSM (telnet or ssh) session as the default user "cisco".

  (2) adding interface backplane of the AIP - SSM GigabitEthernet0/1 in the virtual sensor default "vs0" using these commands:

  Configure the terminal

  service-analysis engine

  vs0 virtual sensor

  phyiscal-interface GigabitEthernet0/1

  output

  output

  Answer Yes when prompted

  output

  NOTE: The above could also be done through the advanced configuration command, or could be done through ASDM or IDM. To put it simply I just give you the CLI commands.

  3) connect to the ASA CLI. If you're "ridden" on the SSM, then an exit from your session will respond to the ASA CLI. If connect you via the console through a ssh or telnet or ASA ASA.

  (4) set the ASA to send traffic to the AIP - SSM.

  To do this, you would create an ACL for the traffic you want to monitor. This ACL is then used to create a class map. The plan of the class is then added in a political map. The political map is applied.

  Here's an example of how you can get any traffic to monitor histocompatibility of the AIP - SSM:

  conf t

  IPS ip access list allow a whole

  my class-map-ips-class

  corresponds to the IP access list

  Policy-map global_policy

  My ips-category

  IPS overcrowding relief

  global service-policy global_policy

  NOTE: The foregoing will send all IP packets to the SSM for surveillance of promiscuity. To change monitoring online simply substitute "inline" instead of promiscuity in the line of configuration of IP addresses.

  Note 2: The service-policy command is a reptition of the command that should already be in your configuration of ASA by default. So, it will probably generate an error/warning letting you know that the policy is already applied.

  IF you do not use the default configuration on the SAA and instead create your own policy, then you can use the steps above, but add the class to your own policy rather than the value default 'global_policy '.

  (4) repeat steps 1 and 2 on the MSS of your Eve ASA.

  The configuration of the AIP - SSM does NOT automatically copied between the AIP-SSMs. If you need to do the configuration manually on the two AIP-SSMs.

  (5) connection to standby you ASA and check tha the configuration in step 3 is automatically copied to your Eve ASA.

  The steps above are in force at step 4/5 in your original list.

  Your AIP - SSM should now be followed by traffic.

  You can now proceed to step 6 of your original list.

• Another issue of queues DSCP/QoS/CoS of 6500/7600

  OK... a little confused, thinking, that I know what needs to happen, and what is happening now, but it is true UN-certainty with that I hope that people can help.  Here are the basic configuration:

  A---|6500|--10G--|7604|---10G---|7604|---10G---|6500|---B

  You get the point.  Traffic crossing A-> B or vica versa.

  All the links of the kernel are L3/Routed, not L2/Vlan/.1q/ISL

  Traffic is marked on the Board with a political map of penetration.

  Traffic is confirmed through DURATION that it contains both CoS and DSCP/ToS, leaving the 6500 s two-way headed the core of 7600

  Traffic is ALSO confirmed through extending classes * receipt * on the other side by the 6500, that DSCP is maintained but CoS is gone/0.

  Considering that only 6708 - 10G modules allow apparently dscp values mapped to the queues/thresholds, which leaves me with the research of the queue on the penetration (for VoIP traffic priority) with cos-of-queue / beat mapping as well as output with cos to queue mappings.  Of course, this is not possible (at least on the penetration) if the 7600 are not preserving the CoS on the output of the port.

  This leaves wondering if the 7600 are same queue evacuation traffic based on internal mapping supposed DSCP-to-CoS that is supposed to happen before the queue/Scheduler.  Interfaces are all set up as "trust dscp" right now.  So the CISCO docs should be rewriting CoS to 0 on the penetration and using reliable dscp values to determine internal DSCP, which in turn should be used with DSCP-CoS map appropriate queue on exit... I am a sceptic, what happens really... and unfortunately, have really no way to verify (that I know) because the show on the 6500/7600 commands are fairly primitive about QoS stats...

  Then, we have been re - think about it and thought that maybe the thing to do to solve this problem is to:

  -Trust cos instead of dscp

  -enable transparency dscp (no rewriting dscp) so it is kept on the side of the switch output

  And so by doing this it would be:

  -use CoS to tail of penetration

  -use CoS to output queues

  - And to preserve the original CoS and DSCP/ToS values

  Would that be correct?

  Two other config options I thought were:

  -queue only mode

  -mpls cos spread (although I don't think that would do what I want, but rather simply spread non-existent MPLS EXP bits)

  Any help would be greatly appreciated... I read so many different docs now, my head is swimming

  Couple of caveats-

  (1) all the below apply to pre IOS 15, as I have no experience with which it may be different

  (2) I have not used a 7600, but I used the 6500 much but both share a large number of the linecards and I suspect you're referring to this kind of linecards.

  The main problem is that the CoS value is contained in the 802. 1 q non-native added tag VLANs on a trunk link. But your links are L3 if there is no value CoS to preserve.

  This creates two problems for you-

  (1) input queues. On penetration, the queues are CoS based which means you need to a CoS value to assign packets into queues. On the 7600 s you're obviously not see a CoS value for the reason explained. Now, you can use a political map and a service policy to classify and mark inbound traffic. But, as far as I know, you can set the IP precedence or DSCP marking in a map policy on traffic of the penetration. Some cards like cards ARE for the 7600 support defining a CoS value but I think they are the exception rather than the norm.

  (2) output queues. You are right in what you say, IE. You can trust the DSCP/IPP incoming value and then, assuming that the line card doesn't support based DSCP output queue, the 7600 may derive a value based on the internal DSCP value CoS and then put in the correct output queue.

  Yet once, however, without a trunk there no value written in the packet CoS.

  I entirely agree that it can be very difficult to tell exactly what the 6500 in terms of marking internal etc. This is one of the great frustrations with the 6500.

  Hope some of that helped.

  Edit - the only way that you can trust CoS on penetration as far as I can see is to make the trunk links IE. you use a vlan dedicated for each interconnection and allow only that vlan on the link. Then you simply transfer the IP addresses assigned to the physical ports for the SVI to the new VLAN on each switch. You should make sure that the vlan that you authorized through the link was not the vlan native because you need a tag to add.

  Jon

• SETP setp ASA 5505 configuration to inspect traffic

  I have,

  I m strugling with the correct procedure to configure ASA to inspect traffic and only allow traffic any inside out and DMZ.

  Fix my not if necessary:

  1. Configure the interfaces
     • IP address
     • Nameif
     • Security level
  2. Configure the NAT
     • Translation on the inside to the outside
     • Trasnlation from inside the DMZ
     • Static translation from the outside to the DMZ
  3. Create ACLs
     • ACL to allow traffic between the inside and outside
     • ACL to allow traffic from inside the DMZ
     • ACL to form of traffic outside DMZ
  4. Create inspect policy
     1. Class creat card
     2. Create political map
     3. Define type of traffic to be inspected
     4. Associate the policy with the interface

  After that I shoul http ping server and access from outside the network.

  Rigth?

  Greetings from King,

  Antonio

  Hello

  Firstly, the route you created is false. It should be a default route that points to a destination 'ANY' and 'ANY' destination mask. For example, Road outside 0 62.28.190.65 0.

  Second, you don't have politically at the moment because there is a map of default policy already configured with the most important protocols. As a result, ICMP is inspected by default.

  In the third place, to test the traffic between hosts no ICMP routers. Maybe the ISP router blocking an incoming ICMP packets to itself. This means that you will need to create an ACL that applies to the ISP router to allow ICMP to himself. Then, to save all these hassle, just add two hosts as mentioned.

  If you insist on working with routers, do a trace of package for me as shown below:

  entry packet-trace inside 8 0 and post the result.

  Kind regards

  AM

• PIX 7.1 amp (2) IPSEC

  I recently updated my 515E with 7.1 (2), when I noticed, in the documentation, a new feature called 'inspect ipsec-passthrough ". I tried different ways of activating this feature with no joy.

  Can someone help to get this feature is enabled.

  Thank you Paul

  After a serious look and control test

  Is supported only on pix721.bin, so you may need to upgrade to it.

  See the below.

  ULHAMFC (config) # policy-map type to inspect?

  set up the mode commands/options:

  DCERPC set up a political map of the DCERPC type

  DNS set up a card type DNS policy

  ESMTP set up a political map of the ESMTP type

  FTP set up a card type FTP policy

  GTP set up a political map of the GTP type

  H323 set up a political map of the H.323 type

  http set up a political map of the type HTTP

  IM setting up a political map of the type IM

  IPSec-pass-thru sets up a political map of the IPSEC-PASS-THRU type

  MGCP configure a policy with the MGCP map

  NetBIOS set up a political map of the NETBIOS type

  RADIUS account management set up a card type Radius account management policy

  Configure a SIP to SIP type political map

  Skinny set up a political map of the Skinny type

  Hope this helps.

  Concerning