Cisco PIX 525 Especificaciones descargar pdf (Pagina 187)

5-11

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 5 Configuring Application Inspection (Fixup)

Basic Internet Protocols

SMTP

This section describes how application inspection works with the Simple Mail Transfer Protocol

(SMTP). It includes the following topics:

• Application Inspection, page 5-12

• Sample Configuration, page 5-13

You can use the fixup command to change the default port assignment for SMTP. The command syntax

is as follows.

fixup protocol smtp [port[-port]]

The fixup protocol smtp command enables the Mail Guard feature. This restricts mail servers to

receiving the seven minimal commands defined in RFC 821, section 4.5.1 (HELO, MAIL, RCPT, DATA,

RSET, NOOP, and QUIT). All other commands are rejected.

Microsoft Exchange server does not strictly comply with RFC 821 section 4.5.1, using extended SMTP

commands such as EHLO. PIX

Firewall will convert any such commands into NOOP commands, which

as specified by the RFC, forces SMTP servers to fall back to using minimal SMTP commands only. This

may cause Microsoft Outlook clients and Exchange servers to function unpredictably when their

connection passes through PIX

Firewall.

Use the port option to change the default port assignments from 25. Use the -port option to apply SMTP

application inspection to a range of port numbers.

As of Version 5.1 and higher, the fixup protocol smtp command changes the characters in the server

SMTP banner to asterisks except for the “2”, “0”, “0” characters. Carriage return (CR) and linefeed (LF)

characters are ignored. PIX

Firewall Version 4.4 converts all characters in the SMTP banner to asterisks.

TFTP

Trivial File Transfer Protocol (TFTP), described in RFC1350, is a simple protocol to read and write files

between a TFTP server and client. Previous to PIX

Firewall Version 6.3(2), the protocol was handled

with a built-in rule that permits all UDP connections from a TFTP server back to a client source port if

there was a TFTP connection between the server and client.

The fixup protocol tftp command enhances the built-in offers several advantages over an implicit rule.

The advantages of using TFTP application inspection over an implicit rule are:

• DoS prevention—To prevent a host from opening many invalid connections, a secondary channel is

not created if there is an existing incomplete connection between the two hosts. This restriction

dictates a client can spoof at most one request.

• Penetration prevention—When TFTP request a read or write request, a secondary channel must be

opened, and traffic using the secondary channel must be initiated from the server. This restriction

prevents the client from creating the secondary connection and then using that connection.

• Configurable—The fixup protocol tftp command can be disabled if needed.

1 2 ... 182 183 184 185 186 187 188 189 190 191 192 ... 465 466

Comentarios a estos manuales

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 187

Comentarios a estos manuales

Relacionado con productos y manuales para Los Sistemas De Control De Acceso De Seguridad Cisco PIX 525