The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
The Sun RPC ALG Support for Firewall and NAT feature adds support for the Sun Microsystems (Sun) Remote Procedure Call (RPC) Application Layer Gateway (ALG) on the firewall and Network Address Translation (NAT). Sun RPC is an application layer protocol that enables client programs to call functions in a remote server program.
Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the Feature Information Table at the end of this document.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Sun RPC ALG provides a deep packet inspection of the Sun RPC protocol. It works with a provisioning system that allows the administrator to configure match filters. The match filters define a match criterion used for search in a Sun RPC packet, thereby permitting only the packets that match the criterion.
In RPC, a client program calls the functions in a server program. The RPC library packages the procedure arguments into a network message and sends it to the server. The server in turn, using the RPC library, takes the arguments from the network message, and calls the specified server procedure. When the server function returns, the return values are packaged into a network message and sent back to the client.
For a detailed description of the Sun RPC protocol, see RFC 1057, RPC: Remote Procedure Call Protocol Specification Version 2 .
For Sun RPC to work when the firewall and NAT are enabled, ALG has to inspect the Sun RPC packets. ALG also has to handle Sun RPC-specific issues like establishing dynamic firewall sessions and fixing the packet content after NAT translation.
Sun RPC is configured using the zone-based firewall that is created using policies and class maps. The Layer 7 class map allows the administrator to configure match filters. The filters specify the program numbers to be searched in the Sun RPC packet. The Sun RPC Layer 7 policy map is configured as a child policy of the Layer 4 policy map using the service-policy command.
When a Sun RPC Layer 4 class map is configured but no Layer 7 firewall policy is configured, the traffic returned by Sun RPC can pass through the firewall, but the sessions are not inspected at the Layer 7 level. As a result, the subsequent RPC call is blocked by the firewall. Configuring a Sun RPC Layer 4 class map and a Layer 7 policy allows Layer 7 inspection. You can configure an empty Layer 7 firewall policy--that is, with no match filters configured.
Configuring a firewall consists of the following tasks:
For more information about the zone-based firewall policy, see the "Zone-Based Firewall Policy" module in the Cisco IOS Security Configuration Guide: Securing the Data Plane.
Perform this task to configure a class map for classifying network traffic. This configuration enables programs like mount (100005) and Network File System (NFS) (100003) using Sun RPC. 100005 and 100003 are Sun RPC program numbers. By default, Sun RPC ALG blocks all programs.
For more information about Sun RPC programs and program numbers, see RFC 1057, RPC: Remote Procedure Call Protocol Specification Version 2 .
Perform this task to configure a class map for classifying network traffic. When you specify the match-all criterion, the Sun RPC traffic obeys all the Sun RPC Layer 7 filters (specified as program numbers) in the class. When you specify the match-any criterion, the Sun RPC traffic follows at least one of the Sun RPC Layer 7 filters (specified as program numbers) in the class.
Command or Action | Purpose | |
---|---|---|
|
Example: Router(config)# class-map type inspect match-any sunrpc-l4-cmap |
Creates a Layer 3 and Layer 4 inspect type class map and enters class-map type configuration mode. |
|
Example: Router(config-cmap)# match protocol sunrpc |
Configures the match criterion for a class map on the basis of a specified protocol. |
|
Example: Router(config-cmap)# exit |
Exits class-map configuration mode and enters global configuration mode. |
Perform this task to configure a Sun RPC firewall policy map. Use a policy map to allow packet transfer for each Sun RPC Layer 7 class that is defined in a class map for a Layer 7 firewall policy.
Command or Action | Purpose | |
---|---|---|
|
Example: Router(config)# policy-map type inspect sunrpc sunrpc-l7-pmap |
Creates a Layer 7 (protocol-specific) inspect type policy map and enters policy-map configuration mode. |
|
Example: Router(config-pmap)# class type inspect sunrpc sunrpc-l7-cmap |
Specifies the traffic (class) on which an action is to be performed and enters policy-map class configuration. |
|
Example: Router(config-pmap-c)# allow |
Allows packet transfer. |
|
Example: Router(config-pmap-c)# exit |
Exits policy-map class configuration mode and returns to policy-map configuration mode. |
|
Example: Router(config-pmap)# exit |
Exits policy-map configuration mode and returns to global configuration mode. |
Perform this task to assign a Layer 4 class and a Layer 7 policy map.
Command or Action | Purpose | |
---|---|---|
|
Example: Router(config)# policy-map type inspect sunrpc-l4-pmap |
Creates a Layer 3 and Layer 4 inspect type policy map and enters policy-map configuration. |
|
Example: Router(config-pmap)# class type inspect sunrpc-l4-cmap |
Specifies the traffic (class) on which an action is to be performed and enters policy-map class configuration. |
|
Example: Router(config-pmap-c)# inspect |
Enables Cisco IOS stateful packet inspection. |
|
Example: Router(config-pmap-c)# service-policy sunrpc sunrpc-l7-pmap |
Attaches the Layer 7 policy map to the top-level Layer 3 or Layer 4 policy map. |
|
Example: Router(config-pmap-c)# exit |
Exits policy-map class configuration mode and returns to policy-map configuration mode. |
|
Example: Router(config-pmap)# class class-default |
Specifies the default class (commonly known as the class-default class) before you configure its policy and enters policy-map class configuration mode. |
|
Example: Router(config-pmap-c)# drop |
Configures a traffic class to discard packets belonging to a specific class. |
|
Example: Router(config-pmap-c)# exit |
Exits policy-map class configuration mode and returns to policy-map configuration mode. |
|
Example: Router(config-pmap)# exit |
Exits policy-map configuration mode and returns to global configuration mode. |
You need two security zones to create a zone pair. However, you can create only one security zone and the second one can be the system-defined security zone. To create the system-defined security zone, configure the zone-pair securitycommand with the self keyword.
Note |
If you select a self zone, you cannot configure inspect policing. |
Use this process to complete the following tasks:
Command or Action | Purpose | |
---|---|---|
|
Example: Router(config)# zone security z-client |
Creates a security zone and enters security zone configuration mode. |
|
Example: Router(config-sec-zone)# exit |
Exits security zone configuration mode and returns to global configuration mode. |
|
Example: Router(config)# zone security z-server |
Creates a security zone and enters security zone configuration mode. |
|
Example: Router(config-sec-zone)# exit |
Exits security zone configuration mode and returns to global configuration mode. |
|
Example: Router(config)# zone-pair security clt2srv source z-client destination z-server |
Creates a zone pair and enters zone-pair configuration mode. |
|
Example: Router(config-sec-zone-pair)# service-policy type inspect sunrpc-l4-pmap |
Attaches a firewall policy map to a zone pair. |
|
Example: Router(config-sec-zone-pair)# exit |
Exits zone-pair configuration mode and returns to global configuration mode. |
|
Example: Router(config)# interface Serial2/0 |
Configures an interface type and enters interface configuration mode. |
|
Example: Router(config-if)# ip address 192.168.6.5 255.255.255.0 |
Sets a primary or secondary IP address for an interface. |
|
Example: Router(config-if)# zone-member security z-client |
Attaches an interface to a security zone. |
|
Example: Router(config-if)# exit |
Exits interface configuration mode and returns to global configuration mode. |
|
Example: Router(config)# interface Serial2/1 |
Configures an interface type and enters interface configuration mode. |
|
Example: Router(config-if)# ip address 192.168.6.5 255.255.255.0 |
Sets a primary or secondary IP address for an interface. |
|
Example: Router(config-if)# zone-member security z-server |
Attaches an interface to a security zone. |
|
Example: Router(config-if)# end |
Exits interface configuration mode and returns to privileged EXEC mode. |
By default, Sun RPC ALG is automatically enabled when NAT is enabled. There is no need to explicitly enable Sun RPC ALG in the NAT-only configuration. You can use the no ip nat service alg command to disable Sun RPC ALG on NAT.
The following is a sample firewall configuration for Sun RPC ALG support.
class-map type inspect sunrpc match-any sunrpc-l7-cmap match program-number 100005 class-map type inspect match-any sunrpc-l4-cmap match protocol sunrpc ! ! policy-map type inspect sunrpc sunrpc-l7-pmap class type inspect sunrpc sunrpc-l7-cmap allow policy-map type inspect sunrpc-l4-pmap class type inspect sunrpc-l4-cmap inspect service-policy sunrpc sunrpc-l7-pmap class class-default drop ! zone security z-client zone security z-server zone-pair security clt2srv source z-client destination z-server service-policy type inspect sunrpc-l4-pmap ! interface GigabitEthernet0/1 ip address 192.168.10.1 255.255.255.0 zone-member security z-client ! interface GigabitEthernet0/2 ip address 192.168.23.1 255.255.255.0 zone-member security z-server
Related Topic |
Document Title |
---|---|
Cisco IOS commands |
|
IP Addressing commands |
Cisco IOS IP Addressing Command Reference |
Security commands |
Cisco IOS Security Command Reference |
Firewall |
"Zone-Based Firewall Policy" module in the Cisco IOS Security Configuration Guide: Securing the Data Plane |
NAT |
"Configuring NAT" module in the Cisco IOS IP Addressing Configuration Guide |
Standard |
Title |
---|---|
No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature. |
-- |
MIB |
MIBs Link |
---|---|
None |
To locate and download MIBs for selected platforms, Cisco software releases, and feature sets, use Cisco MIB Locator found at the following URL: |
RFC |
Title |
---|---|
RFC 1057 |
RPC: Remote Procedure Call Protocol Specification Version 2 |
Description |
Link |
---|---|
The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password. |
The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Table 1 | Feature Information for Sun RPC ALG Support for Firewall and NAT |
Feature Name |
Releases |
Feature Information |
---|---|---|
Sun RPC ALG Support for Firewall and NAT |
15.1(1)S |
The Sun RPC ALG Support for Firewall and NAT feature adds support for the Sun RPC ALG on the firewall and NAT. |
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.