Cisco PIX 525 Specifikace stáhnout pdf (Strana 184)

5-8

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 5 Configuring Application Inspection (Fixup)

Basic Internet Protocols

The FTP application inspection inspects the FTP sessions and performs four tasks:

• Prepares dynamic secondary data connection

• Tracks ftp command-response sequence

• Generates an audit trail

• NATs embedded IP address

FTP application inspection prepares secondary channels for FTP data transfer. The channels are

allocated in response to a file upload, a file download, or a directory listing event and must be

pre-negotiated. The port is negotiated through the PORT or PASV commands.

If the strict option is enabled, each ftp command and response sequence is tracked for the following

anomalous activity:

• Truncated command—Number of commas in the PORT and PASV reply command is checked to see

if it is five. If it is not five, then the PORT command is assumed to be truncated and the TCP

connection is closed.

• Incorrect command—Checks the ftp command to see if it ends with <CR><LF> characters, as

required by the RFC. If it does not, the connection is closed.

• Size of RETR and STOR commands—These are checked against a fixed constant. If the size is

greater, then an error message is logged and the connection is closed.

• Command spoofing—The PORT command should always be sent from the client. The TCP

connection is denied if a PORT command is sent from the server.

• Reply spoofing—PASV reply command (227) should always be sent from the server. The TCP

connection is denied if a PASV reply command is sent from the client. This prevents the security

hole when the user executes “227 xxxxx a1, a2, a3, a4, p1, p2.”

• TCP stream editing.

• Invalid port negotiation—The negotiated dynamic port value is checked to see if it is less than 1024.

As port numbers in the range from 1 to 1024 are reserved for well-known connections, if the

negotiated port falls in this range, then the TCP connection is freed.

• Command pipelining—The number of characters present after the port numbers in the PORT and

PASV reply command is cross checked with a constant value of 8. If it is more than 8, then the TCP

connection is closed.

FTP application inspection generates the following log messages:

• An Audit record 302002 is generated for each file that is retrieved or uploaded.

• The ftp command is checked to see if it is RETR or STOR and the retrieve and store commands are

logged.

• The username is obtained by looking up a table providing the IP address.

• The username, source IP address, destination IP address, NAT address, and the file operation are

logged.

• Audit record 201005 is generated if the secondary dynamic channel preparation failed due to

memory shortage.

In conjunction with NAT, the FTP application inspection translates the IP address within the application

payload. This is described in detail in RFC 959.

1 2 ... 179 180 181 182 183 184 185 186 187 188 189 ... 465 466

Komentáře k této Příručce

Žádné komentáře

Cisco PIX 525 Specifikace Strana 184

Komentáře k této Příručce

Související produkty a manuály pro Bezpečnostní systémy pro řízení přístupu Cisco PIX 525