Cisco PIX 525 Specifikace stáhnout pdf (Strana 329)

21-3

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 21 Applying Application Layer Protocol Inspection

Application Inspection Engines

In Figure 21-1, operations are numbered in the order they occur, and are described as follows:

1. A TCP SYN packet arrives at the security appliance to establish a new connection.

2. The security appliance checks the access list database to determine if the connection is permitted.

3. The security appliance creates a new entry in the connection database (XLATE and CONN tables).

4. The security appliance checks the Inspections database to determine if the connection requires

application-level inspection.

5. After the application inspection engine completes any required operations for the packet, the

security appliance forwards the packet to the destination system.

6. The destination system responds to the initial request.

7. The security appliance receives the reply packet, looks up the connection in the connection database,

and forwards the packet because it belongs to an established session.

The default configuration of the security appliance includes a set of application inspection entries that

associate supported protocols with specific TCP or UDP port numbers and that identify any special

handling required. For certain applications some inspection engines do not support NAT or PAT because

of the constraints imposed by the applications. You can change the port assignments for some

applications, while other applications have fixed port assignments that you cannot change. Table 21-1

summarizes this information about the application inspection engines provided with the security

appliance.

Supported Protocols

Table 21-1 summarizes the type of application inspections that is provided for each protocol supported

by the security appliance. The following inspection engines are described in this chapter:

• CTIQBE—See the “Managing CTIQBE Inspection” section on page 21-10

• FTP—See the “Managing FTP Inspection” section on page 21-14

• GTP—See the “Managing GTP Inspection” section on page 21-19

• H.323—See the “Managing H.323 Inspection” section on page 21-24

• HTTP—See the “Managing HTTP Inspection” section on page 21-30

• MGCP—See the “Managing MGCP Inspection” section on page 21-33

• RTSP—See the “Managing RTSP Inspection” section on page 21-39

• SIP—See the “Managing SIP Inspection” section on page 21-43

• Skinny—See the “Managing Skinny (SCCP) Inspection” section on page 21-47

• SMTP/ESMTP—See the “Managing SMTP and Extended SMTP Inspection” section on page 21-50

• SNMP—See the “Managing SNMP Inspection” section on page 21-53

For more information about the other inspection engines, which are not discussed in this chapter, see the

following inspect command pages in the Cisco Security Appliance Command Line Configuration Guide.

1 2 ... 324 325 326 327 328 329 330 331 332 333 334 ... 603 604

Žádné komentáře

Cisco PIX 525 Specifikace Strana 329