Cisco PIX 525 Specifiche Scaricare il pdf (Pagina 182)

5-6

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 5 Configuring Application Inspection (Fixup)

Basic Internet Protocols

This section describes how the PIX Firewall supports the most common Internet protocols and how you

can use the fixup command and other commands to solve specific problems. It includes the following

topics:

• DNS, page 5-6

• FTP, page 5-7

• HTTP, page 5-9

• ICMP, page 5-9

• IPSec, page 5-9

• PPTP, page 5-10

• SMTP, page 5-11

• TFTP, page 5-11

DNS

The port assignment for the Domain Name System (DNS) is not configurable. DNS requires application

inspection so that DNS queries will not be subject to the generic UDP handling based on activity

timeouts. Instead, the UDP connections associated with DNS queries and responses are torn down as

soon as a reply to a DNS query has been received. This functionality is called DNS Guard.

DNS inspection performs the following tasks:

• Monitors the message exchange to ensure that the ID of the DNS reply matches the ID of the DNS

query.

• Translates the DNS A-record on behalf of the alias command. With PIX Firewall Version 6.2 and

higher, DNS inspection also supports static and dynamic NAT and outside NAT makes the use of the

alias command unnecessary.

• Reassembles the DNS packet to verify its length. Since DNS packets up to 65535 bytes are permitted

to traverse the PIX

Firewall, reassembly is done to verify that the packet length is less than the

maximum length specified by the user. Otherwise, the packet is dropped.

Only forward lookups are NATed, so PTR records are not touched. Alarms can also be set off in the

Intrusion Detection System (IDS) module for DNS zone transfers.

Note The PIX Firewall drops DNS packets sent to UDP port 53 that are larger than the configured maximum

length. The default value is 512 bytes.

Note If the DNS fixup is disabled, the A-record is not NATed and the DNS ID is not matched in requests and

responses. By disabling the DNS fixup, the maximum length check on UDP DNS packets can be

bypassed and packets greater than the maximum length configured will be permitted. However,

fragmented DNS packets will not go though since reassembling is done only if the fixup is turned on.

1 2 ... 177 178 179 180 181 182 183 184 185 186 187 ... 465 466

Nessun commento

Cisco PIX 525 Specifiche Pagina 182