Cisco PIX 525 Especificaciones descargar pdf (Pagina 209)

5-33

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 5 Configuring Application Inspection (Fixup)

Management Protocols

Example 5-2 Configuring NFS Access

access-list acl_out permit udp host 209.165.201.2 host 209.165.201.11 eq sunrpc

access-list acl_out permit udp host 209.165.201.2 host 209.165.201.11 eq 2049

Oracle SQL*Net (V1/V2)

The SQL*Net protocol consists of different packet types that PIX Firewall handles to make the data

stream appear consistent to the Oracle applications on either side of the firewall. You can use the fixup

command to change the default port assignment for Oracle SQL*Net. The command syntax is as follows.

fixup protocol sqlnet [port[-port]]

Use the port option to change the default port assignment from 1521. This is the value used by Oracle

for SQL*Net, but this value does not agree with IANA port assignments for Structured Query Language

(SQL). Use the -port option to apply SQL*Net inspection to a range of port numbers.

The PIX Firewall NATs all addresses and looks in the packets for all embedded ports to open for

SQL*Net Version 1.

For SQL*Net Version 2, all DATA or REDIRECT packets that immediately follow REDIRECT packets

with a zero data length will be fixed up.

The packets that need fix-up contain embedded host/port addresses in the following format:

(ADDRESS=(PROTOCOL=tcp)(DEV=6)(HOST=a.b.c.d)(PORT=a))

SQL*Net Version 2 TNSFrame types (Connect, Accept, Refuse, Resend, and Marker) will not be

scanned for addresses to NAT nor will inspection open dynamic connections for any embedded ports in

the packet.

SQL*Net Version 2 TNSFrames, Redirect, and Data packets will be scanned for ports to open and

addresses to NAT, if preceded by a REDIRECT TNSFrame type with a zero data length for the payload.

When the Redirect message with data length zero passes through the PIX

Firewall, a flag will be set in

the connection data structure to expect the Data or Redirect message that follows to be NATed and ports

to be dynamically opened. If one of the TNS frames in the preceding paragraph arrive after the Redirect

message, the flag will be reset.

The SQL*Net fixup will recalculate the checksum, change IP, TCP lengths, and readjust Sequence

Numbers and Acknowledgment Numbers using the delta of the length of the new and old message.

SQL*Net Version 1 is assumed for all other cases. TNSFrame types (Connect, Accept, Refuse, Resend,

Marker, Redirect, and Data) and all packets will be scanned for ports and addresses. Addresses will be

NATed and port connections will be opened.

Management Protocols

This section describes how the PIX Firewall supports management protocols to solve specific problems.

It includes the following topics:

• Internet Control Message Protocol, page 5-34

• Remote Shell, page 5-34

• X Display Manager Control Protocol, page 5-34

• Simple Network Management Protocol Fixup, page 5-34

1 2 ... 204 205 206 207 208 209 210 211 212 213 214 ... 465 466

Comentarios a estos manuales

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 209

Comentarios a estos manuales

Relacionado con productos y manuales para Los Sistemas De Control De Acceso De Seguridad Cisco PIX 525