Cisco PIX 525 Spécifications télécharger pdf (Page 177)

CHAPTER

5-1

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Configuring Application Inspection (Fixup)

This chapter describes how to use and configure application inspection, which is often called “fixup”

because you use the fixup command to configure it. This chapter includes the following sections:

• How Application Inspection Works, page 5-1

• Using the fixup Command, page 5-4

• Basic Internet Protocols, page 5-6

• Voice Over IP, page 5-14

• Multimedia Applications, page 5-27

• Database and Directory Support, page 5-30

• Management Protocols, page 5-33

How Application Inspection Works

The Adaptive Security Algorithm (ASA), used by the PIX Firewall for stateful application inspection,

ensures the secure use of applications and services. Some applications require special handling by the

PIX

Firewall application inspection function. Applications that require special application inspection

functions are those that embed IP addressing information in the user data packet or open secondary

channels on dynamically assigned ports.

The application inspection function works with NAT to help identify the location of embedded

addressing information. This allows NAT to translate these embedded addresses and to update any

checksum or other fields that are affected by the translation.

The application inspection function also monitors sessions to determine the port numbers for secondary

channels. Many protocols open secondary TCP or UDP ports to improve performance. The initial session

on a well-known port is used to negotiate dynamically assigned port numbers. The application inspection

function monitors these sessions, identifies the dynamic port assignments, and permits data exchange on

these ports for the duration of the specific session.

As illustrated in Figure 5-1, ASA uses three databases for its basic operation:

• Access control lists (ACLs)—Used for authentication and authorization of connections based on

specific networks, hosts, and services (TCP/UDP port numbers).

• Inspections—Contains a static, pre-defined set of application-level inspection functions.

• Connections (XLATE and CONN tables)—Maintains state and other information about each

established connection. This information is used by ASA and cut-through proxy to efficiently

forward traffic within established sessions.

1 2 ... 172 173 174 175 176 177 178 179 180 181 182 ... 465 466

Pas de commentaire

Cisco PIX 525 Spécifications Page 177