| 3.5 |  | Task 3: Port to Application Mapping (PAM) |
| 3.5.3 |  | User-defined port mapping |

| Network services or applications that use nonstandard ports require user-defined entries in the PAM table. For example, the network might run HTTP services on the nonstandard port 8000 instead of on the system-defined default port 80. In this case, PAM can be used to map port 8000 with HTTP services. If HTTP services run on other ports, use PAM to create additional port mapping entries. After defining a port mapping entry, it is possible to overwrite that entry at a later time by simply mapping that specific port with a different application.

User-defined port mapping information can also specify a range of ports for an application by establishing a separate entry in the PAM table for each port number in the range. User-defined entries are saved with the default mapping information when the router configuration is saved.

To establish PAM, use the ip port-map configuration command. Use the no form of this command to delete user-defined PAM entries. The syntax for the ip port-map command is demonstrated in Figures and .

User-defined entries in the mapping table can include host or network-specific mapping information. This establishes port mapping information for specific hosts or subnets. In some environments, it might be necessary to override the default port mapping information for a specific host or subnet.

With host-specific port mapping, it is possible to use the same port number for different services on different hosts. This means that port 8000 can be mapped to HTTP services for one host, while mapping port 8000 with telnet services for another host.

Host-specific port mapping also enables PAM to be applied to a specific subnet when that subnet runs a service that uses a port number that is different from the port number defined in the default mapping information. For example, hosts on subnet 192.168.0.0 might run HTTP services on nonstandard port 8000, while other traffic through the firewall uses the default port 80 for HTTP services.

Host or network-specific port mapping can override a system-defined entry in the PAM table. For example, if CBAC finds an entry in the PAM table that maps port 25, the system-defined port for SMTP, with HTTP for a specific host, CBAC identifies port 25 as HTTP protocol traffic on that host.

Use the list option for the ip port-map command to specify an ACL for a host or subnet that uses PAM.

To display the PAM information, use the show ip port-map privileged EXEC command. The syntax for the show ip port-map command is shown in Figure .

| Lab Activity e-Lab Activity: Port-to-Application Mapping In this activity, students will apply host-specific port mapping.