Cisco PIX 525 Spécifications télécharger pdf (Page 208)

5-32

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 5 Configuring Application Inspection (Fixup)

Database and Directory Support

Network File System and Sun RPC

The port assignment for Sun Remote Procedure Call (RPC) is not configurable. Sun RPC is used by

Network File System (NFS) and Network Information Service (NIS).

Sun RPC services can run on any port on the system. When a client attempts to access an RPC service

on a server, it must find out which port that service is running on. It does this by querying the portmapper

process on the well-known port of 111.

The client sends the RPC program number of the service, and gets back the port number. From this point

on, the client program will send its RPC queries to that new port.

Only frames going from inside to outside are inspected. (for example, the portmapper service running

on one of the internal servers has sent a reply). When a server behind the firewall (on the inside interface)

sends out a reply, PIX

Firewall intercepts this packet and opens both embryonic TCP and UDP

connections on that port.

NAT or PAT of RPC payload information is not supported.

Note The sunrpc fixup only inspects the original portmapper connection if it is over UDP. TCP portmapper

traffic is not inspected.

The following commands demonstrate how to implement Network File System (NFS) for the network

shown in

Figure 5-3. These commands are used in addition to the basic firewall configuration required:

Step 1 Refine the accessibility of the static command by permitting Sun RPC over the UDP portmapper on port

111 with the sunrpc literal:

access-list acl_out permit udp host 209.165.201.2 host 209.165.201.11 eq sunrpc

Refer to the UNIX /etc/rpc file and the UNIX rpc(3N) command page for more information.

Once you create an access-list command statement for RPC, you can use the following command from

outside host 209.165.201.2 to track down the activity of a PCNFSD on RPC 150001:

rpcinfo -u 209.165.201.11 150001

Another use of RPC is with the following command to see the exports of 209.165.201.11 if you want to

allow mounting NFS from the outside network to the inside network:

showmount -e 209.165.201.11

Many protocols based on RPC, as well as NFS, are insecure and should be used with caution. Review

your security policies carefully before permitting access to RPC.

Step 2 Permit NFS access:

access-list acl_out permit udp host 209.165.201.2 host 209.165.201.11 eq 2049

NFS access occurs at port 2049 and provides access between the outside and inside, such that host

209.165.201.2 can mount 10.1.1.11 via the global address 209.165.201.11.

Example 5-2 shows the command listing for configuring access to services for the network illustrated in

Figure 5-3.

1 2 ... 203 204 205 206 207 208 209 210 211 212 213 ... 465 466

Pas de commentaire

Cisco PIX 525 Spécifications Page 208