Cisco PIX 525 Specifiche Scaricare il pdf (Pagina 207)

5-31

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 5 Configuring Application Inspection (Fixup)

Database and Directory Support

ILS and LDAP

The Internet Locator Service (ILS) is based on the Lightweight Directory Access Protocol (LDAP) and

is LDAPv2 compliant. ILS was developed by Microsoft for use with its NetMeeting, SiteServer, and

Active Directory products.

By default, fixup protocol ils is disabled. You can use the fixup command to enable the ILS fixup and,

optionally, change the default port assignment. The command syntax is as follows.

[no] fixup protocol ils [port[-port]]

Use the port option to change the default port assignment from 389. Use the -port option to apply ILS

inspection to a range of port numbers.

To show the configuration of ILS inspection, enter the following command:

show fixup [protocol ils]

PIX Firewall Version 6.2 introduces NAT support for ILS, which is used to register and locate endpoints

in the ILS or SiteServer Directory. PAT cannot be supported because only IP addresses are stored by an

LDAP database.

For search responses, when the LDAP server is located outside, NAT should be considered to allow

internal peers to communicate locally while registered to external LDAP servers. For such search

responses, xlates will be searched first, and then DNAT entries to obtain the correct address. If both of

these searches fail, then the address will not be changed. For sites using NAT 0 (no NAT) and not

expecting DNAT interaction, we recommend that the fixup be turned off to provide better performance.

Additional configuration may be necessary when the ILS server is located inside the PIX Firewall

border. This would require a hole for outside clients to access the LDAP server on the specified port,

typically TCP 389.

ILS/LDAP follows a client/server model with sessions handled over a single TCP connection.

Depending on the client's actions, several of these sessions may be created.

During connection negotiation time, a BIND PDU is sent from the client to the server. Once a successful

BIND RESPONSE from the server is received, other operational messages may be exchanged (such as

ADD, DEL, SEARCH, or MODIFY) to perform operations on the ILS Directory. The ADD REQUEST

and SEARCH RESPONSE PDUs may contain IP addresses of NetMeeting peers, used by H.323 (SETUP

and CONNECT messages) to establish the NetMeeting sessions. Microsoft NetMeeting v2.X and v3.X

provides ILS support.

The ILS inspection performs the following operations:

• Decodes the LDAP REQUEST/RESPONSE PDUs using the BER decode functions

• Parses the LDAP packet

• Extracts IP addresses

• Translates IP addresses as necessary

• Encodes the PDU with translated addresses using BER encode functions

• Copies the newly encoded PDU back to the TCP packet

• Performs incremental TCP checksum and sequence number adjustment

ILS inspection has the following limitations:

• Referral requests and responses are not supported

• Users in multiple directories are not unified

• Single users having multiple identities in multiple directories cannot be recognized by NAT

1 2 ... 202 203 204 205 206 207 208 209 210 211 212 ... 465 466

Commenti su questo manuale

Nessun commento

Cisco PIX 525 Specifiche Pagina 207

Commenti su questo manuale

Prodotti e manuali riguardandi Sistemi di controllo di accesso Cisco PIX 525