Block Skype using IOS

Block Skype using IOS
Do you want to or need to be able to block Skype traffic? Did you know you can block it using your IOS based Cisco router? You sure can using Flexible Packet Matching (FPM). FPM is a next-generation access control list (ACL) technology that is capable of filtering at a bit-level, deep within IP packets. FPM provides the granularity to filter anomalous traffic from networks while minimizing the risk of filtering legitimate business traffic. Flexible Packet Matching provides the means to configure match criteria for any or all fields in a packet’s header, as well as bit-patterns within the packet’s payload within the first 256 bytes.
This allows the characteristics of an attack (source port, packet size, byte string) to be uniquely matched and allows a designated action to be taken. FPM provides a flexible Layer 2-7 stateless classification mechanism. The user can specify classification criteria based on any protocol and any field of the traffic’s protocol stack. Based on the classification result, actions such as drop or log can be taken. In order to get started you first have to have the pdlm or tcdf files that you need load into the router. These can be found on CCO at the following location:
http://www.cisco.com/cgi-bin/tablebuild.pl/fpm
in our example we will use the udp.phdf, tcp.phdf and ip.phdf files…if you prefer to use xml you can use the skype.tcdf file and follow the documentation located here for enabling it: Doc Guide. Next we will ‘load’ the phdf files into the router and configure the parameters that we need FPM to match on in order to identify Skype using class-maps, then we will call the class-maps within two policy-maps and define and action of drop for that traffic for one class-map and then nest that policy-map inside another policy-map. The final configuration is as follows:
load protocol system:fpm/phdf/udp.phdfload protocol system:fpm/phdf/tcp.phdfload protocol system:fpm/phdf/ip.phdf!class-map type stack match-all ip_tcp match field IP protocol eq 6 next TCP!class-map type access-control match-all skype match start TCP payload-start offset 0 size 4 eq 0×17030100!policy-map type access-control skype-policy class skype drop!policy-map type access-control fpm-policy class ip_tcp service-policy skype-policy