IP Application Services Configuration Guide, Cisco IOS XE Release 3S (Cisco ASR 1000)
vTCP for ALG Support
vTCP for ALG Support
Last Updated: December 17, 2012
Virtual Transport Control Protocol (vTCP) functionality provides a framework for various Application Layer Gateway (ALG) protocols to appropriately handle the Transport Control Protocol (TCP) segmentation and parse the segments in the Cisco firewall, Network Address Translation (NAT) and other applications.
Finding Feature Information
Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Prerequisites for vTCP for ALG Support
Your system must be running Cisco IOS XE Release 3.1 or a later Cisco IOS XE software release. The latest version of NAT or firewall ALG should be configured.
Restrictions for vTCP for ALG Support
vTCP does not support data channel traffic. To protect system resources vTCP does not support reassembled messages larger than 8K.
vTCP does not support Hardware Availability (HA) functionality. HA mainly relies on the firewall or NAT to sync session information to the standby forwarding engine.
Information About vTCP for ALG Support
Overview of vTCP for ALG Support
When a Layer 7 protocol uses TCP for transportation, the TCP payload can be segmented due to various reasons, such as application design, maximum segment size (MSS), TCP window size, and so on. The ALGs that the firewall and NAT support do not have the capability to recognize TCP fragments for packet inspection. vTCP is a general framework that ALGs use to understand TCP segments and to parse the TCP payload.
vTCP helps applications like NAT and Session Initiation Protocol (SIP) that require the entire TCP payload to rewrite the embedded data. The firewall uses vTCP to help ALGs support data splitting between packets.
When you configure firewall and NAT ALGs, the vTCP functionality is activated.
TCP Acknowledgment and Reliable Transmission
Because vTCP resides between two TCP hosts, a buffer space is required to store TCP segments temporarily, before they are sent to other hosts. vTCP ensures that data transmission occurs properly between hosts. vTCP sends a TCP acknowledgment (ACK) to the sending host if vTCP requires more data for data transmission. vTCP also keeps track of the ACKs sent by the receiving host from the beginning of the TCP flow to closely monitor the acknowledged data.
vTCP reassembles TCP segments. The IP header and the TCP header information of the incoming segments are saved in the vTCP buffer for reliable transmission.
vTCP can make minor changes in the length of outgoing segments for NAT-enabled applications. vTCP can either squeeze the additional length of data to the last segment or create a new segment to carry the extra data. The IP header or the TCP header content of the newly created segment is derived from the original incoming segment. The total length of the IP header and the TCP header sequence numbers are adjusted accordingly.
vTCP with NAT and Firewall ALGs
ALG is a subcomponent of NAT and the firewall. Both NAT and the firewall have a framework to dynamically couple their ALGs. When the firewall performs a Layer 7 inspection or NAT performs a Layer 7 fix-up, the parser function registered by the ALGs is called and ALGs take over the packet inspection. vTCP mediates between NAT and the firewall and the ALGs that use these applications. In other words, packets are first processed by vTCP and then passed on to ALGs. vTCP reassembles the TCP segments in both directions within a TCP connection.
How to Configure vTCP for ALG Support
The RTSP, DNS, NAT, and the firewall configurations enable vTCP functionality by default. Therefore no new configuration is required to enable vTCP functionality.
Enabling RTSP on Cisco ASR 1000 Series Routers to Activate vTCP
2. configure terminal
3. class-map type inspect match-any class-map-name
4. match protocol protocol-name
6. policy-map type inspect policy-map-name
7. class type inspect class-map-name
9. class class-default
12. zone security zone-name1
14. zone security zone-name2
16. zone-pair security zone-pair-name source source-zone-name destination destination-zone-name
17. service-policy type inspect policy-map-name
19. interface type number
20. zone-member security zone-name1
22. interface type number
23. zone-member security zone-name
Configuration Examples for vTCP for ALG Support
Example RTSP Configuration on Cisco ASR 1000 Series Routers
The following example shows how to configure the Cisco ASR 1000 Series Routers to enable RTSP inspection:
class-map type inspect match-any rtsp_class1 match protocol rtsp policy-map type inspect rtsp_policy class type inspect rtsp_class1 inspect class class-default zone security private zone security public zone-pair security pair-two source private destination public service-policy type inspect rtsp_policy interface GigabitEthernet0/1/0 ip address 10.0.0.1 255.0.0.0 zone-member security private ! interface GigabitEthernet0/1/1 ip address 10.0.1.1 255.0.0.0 zone-member security public
Feature Information for vTCP for ALG Support
The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.
© 2012 Cisco Systems, Inc. All rights reserved.