Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 37)

1-11

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 1 Getting Started

Supporting Specific Protocols and Applications

This section describes how the PIX Firewall enables the secure use of specific protocols and

applications. It includes the following sections:

• How Application Inspection Works, page 1-11

• Voice over IP, page 1-11

• Multimedia Applications, page 1-13

• LDAP Version 2 and ILS, page 1-14

• NetBIOS over IP, page 1-14

• Forwarding Multicast Transmissions, page 1-14

For further information about application inspection and how it works with different applications, refer

Chapter 5, “Configuring Application Inspection (Fixup).”

How Application Inspection Works

The behavior of certain Internet applications, such as FTP or multimedia applications, requires

PIX

Firewall to make some adjustments to how it performs NAT or PAT, and for the ports it opens to

receive replies to outbound requests for services. Application inspection provides PIX

Firewall with the

information it needs to make these adjustments.

As described in the “Address Translation” section, PIX Firewall applies NAT or PAT to the source

address of IP packets from hosts for which it is enabled. However, “badly behaved” applications create

IP packets with network addresses and other information in the user data portion of the packet. If this

information is left unchanged, the application will not work because the address in the source address

field will not match the address embedded in the user data field.

To solve this problem, when NAT or PAT is applied to these packets, the application inspection function

helps the PIX

Firewall find the extra address information so address translation can be applied to it. After

changing this addressing information, the PIX

Firewall uses application inspection to adjust other fields

in the packet that are affected, such as those containing packet length and checksum information.

By default, the PIX Firewall allows replies to outbound requests using many Internet applications, such

as HTTP. These services send requests and replies on well-known TCP ports.

However, some applications, such as FTP, use a well-known TCP port to negotiate the use of secondary

ports, which are used for the actual exchange of user data. To support the secure use of these

applications, PIX

Firewall must monitor the negotiation that occurs on the first port to determine on

which port replies will be received. Again, it is application inspection that provides the information

required to identify and open ports required to receive replies from these applications.

Voice over IP

This section describes the support provided by the PIX Firewall for the transmission of Voice over IP

(VoIP) traffic and includes the following topics:

• CTIQBE (TAPI), page 1-12

• H.323, page 1-12

• RAS Version 2, page 1-12

• MGCP, page 1-12

1 2 ... 32 33 34 35 36 37 38 39 40 41 42 ... 465 466

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 37

Kommentare zu diesen Handbüchern

Verwandte Produkte und Handbücher für Sicherheitszugriffskontrollsysteme Cisco PIX 525