Cisco PIX 525 Spécifications télécharger pdf (Page 188)

5-12

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 5 Configuring Application Inspection (Fixup)

Basic Internet Protocols

The PIX Firewall inspects TFTP traffic and dynamically creates connections and translations, if

necessary, to permit file transfer between a TFTP client and server with the fixup protocol tftp

command. Specifically, the fixup inspects TFTP read request (RRQ), write request (WRQ), and error

notification (ERROR).

A dynamic secondary channel and a PAT translation, if necessary, are allocated on a reception of a valid

read (RRQ) or write (WRQ) request. This secondary channel is subsequently used by TFTP for file

transfer or error notification.

TFTP application inspection enforces the following characteristics on the secondary channel. Only the

TFTP server can initiate traffic over the secondary channel, and at most one incomplete secondary

channel can exist between the TFTP client and server. An error notification from the server closes the

secondary channel.

Note Note: The fixup protocol tftp command is enabled by default.

TFTP Fixup must be enabled if static PAT is used to redirect TFTP traffic.

Application Inspection

An SMTP server responds to client requests with numeric reply codes and optional human readable

strings. SMTP application inspection controls and reduces the commands that the user can use as well

as the messages that the server returns. SMTP inspection performs three primary tasks:

• Restricts SMTP requests to seven minimal commands (HELO, MAIL, RCPT, DATA, RSET, NOOP,

and QUIT).

• Monitors the SMTP command-response sequence.

• Generates an audit trail—Audit record 108002 is generated when invalid character embedded in the

mail address is replaced. For more information, see RFC 821.

SMTP inspection monitors the command and response sequence for the following anomalous signatures:

• Truncated commands.

• Incorrect command termination (not terminated with <CR><LR>).

• The MAIL and RCPT commands specify who are the sender and the receiver of the mail. Mail

addresses are scanned for strange characters. The pipeline character (|) is deleted (changed to a blank

space) and “<” ‚”>” are only allowed if they are used to define a mail address (“>” must be preceded

by “<”).

• Unexpected transition by the SMTP server.

• For unknown commands, the PIX Firewall changes all the characters in the packet to X. In this case,

the server will generate an error code to the client. Because of the change in the packed, the TCP

checksum has to be recalculated or adjusted.

• TCP stream editing.

• Command pipelining.

1 2 ... 183 184 185 186 187 188 189 190 191 192 193 ... 465 466

Pas de commentaire

Cisco PIX 525 Spécifications Page 188