Sun RPC ALG Support for Firewall and NAT

• Cisco does not recommend configuring both security zones and inspect rules on the same interfaces.
• If you are inspecting the Sun RPC protocol (that is, you have specified the match protocol sunrpc command in the Layer 4 class map), a Layer 7 Sun RPC policy map is required.

For more information about the zone-based firewall policy, see the "Zone-Based Firewall Policy" module in the Cisco IOS Security Configuration Guide: Securing the Data Plane.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    class-map type inspect protocol-name {match-any | match-all} class-map-name

4.    match program-number program-number

5.    exit

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	class-map type inspect protocol-name {match-any | match-all} class-map-name Example: Router(config)# class-map type inspect sunrpc match-any sunrpc-l7-cmap	Creates a Layer 7 (application-specific) inspect type class map and enters class-map configuration mode.
Step 4	match program-number program-number Example: Router(config-cmap)# match program-number 100005	Specifies the allowed RPC protocol program number as a match criterion.
Step 5	exit Example: Router(config-cmap)# exit	Exits class-map configuration mode and enters global configuration mode.

SUMMARY STEPS

1.    class-map type inspect {match-any | match-all} class-map-name

2.    match protocol protocol-name

3.    exit

DETAILED STEPS

	Command or Action	Purpose
Step 1	class-map type inspect {match-any | match-all} class-map-name Example: Router(config)# class-map type inspect match-any sunrpc-l4-cmap	Creates a Layer 3 and Layer 4 inspect type class map and enters class-map type configuration mode.
Step 2	match protocol protocol-name Example: Router(config-cmap)# match protocol sunrpc	Configures the match criterion for a class map on the basis of a specified protocol.
Step 3	exit Example: Router(config-cmap)# exit	Exits class-map configuration mode and enters global configuration mode.

SUMMARY STEPS

1.    policy-map type inspect protocol-name policy-map-name

2.    class type inspect protocol-name class-map-name

3.    allow

4.    exit

5.    exit

DETAILED STEPS

	Command or Action	Purpose
Step 1	policy-map type inspect protocol-name policy-map-name Example: Router(config)# policy-map type inspect sunrpc sunrpc-l7-pmap	Creates a Layer 7 (protocol-specific) inspect type policy map and enters policy-map configuration mode.
Step 2	class type inspect protocol-name class-map-name Example: Router(config-pmap)# class type inspect sunrpc sunrpc-l7-cmap	Specifies the traffic (class) on which an action is to be performed and enters policy-map class configuration.
Step 3	allow Example: Router(config-pmap-c)# allow	Allows packet transfer.
Step 4	exit Example: Router(config-pmap-c)# exit	Exits policy-map class configuration mode and returns to policy-map configuration mode.
Step 5	exit Example: Router(config-pmap)# exit	Exits policy-map configuration mode and returns to global configuration mode.

SUMMARY STEPS

1.    policy-map type inspect policy-map-name

2.    class type inspect class-map-name

3.    inspect [parameter-map-name]

4.    service-policy protocol-name policy-map-name

5.    exit

6.    class class-default

7.    drop

8.    exit

9.    exit

DETAILED STEPS

	Command or Action	Purpose
Step 1	policy-map type inspect policy-map-name Example: Router(config)# policy-map type inspect sunrpc-l4-pmap	Creates a Layer 3 and Layer 4 inspect type policy map and enters policy-map configuration.
Step 2	class type inspect class-map-name Example: Router(config-pmap)# class type inspect sunrpc-l4-cmap	Specifies the traffic (class) on which an action is to be performed and enters policy-map class configuration.
Step 3	inspect [parameter-map-name] Example: Router(config-pmap-c)# inspect	Enables Cisco IOS stateful packet inspection.
Step 4	service-policy protocol-name policy-map-name Example: Router(config-pmap-c)# service-policy sunrpc sunrpc-l7-pmap	Attaches the Layer 7 policy map to the top-level Layer 3 or Layer 4 policy map.
Step 5	exit Example: Router(config-pmap-c)# exit	Exits policy-map class configuration mode and returns to policy-map configuration mode.
Step 6	class class-default Example: Router(config-pmap)# class class-default	Specifies the default class (commonly known as the class-default class) before you configure its policy and enters policy-map class configuration mode.
Step 7	drop Example: Router(config-pmap-c)# drop	Configures a traffic class to discard packets belonging to a specific class.
Step 8	exit Example: Router(config-pmap-c)# exit	Exits policy-map class configuration mode and returns to policy-map configuration mode.
Step 9	exit Example: Router(config-pmap)# exit	Exits policy-map configuration mode and returns to global configuration mode.

SUMMARY STEPS

1.    zone security {zone-name | default}

2.    exit

3.    zone security {zone-name | default}

4.    exit

5.    zone-pair security zone-pair-name source {source-zone-name | self | default} destination {destination-zone-name | self | default}

6.    service-policy type inspect policy-map-name

7.    exit

8.    interface type number

9.    ip address ip-address mask [secondary [vrf vrf-name]]

10.    zone-member security zone-name

11.    exit

12.    interface type number

13.    ip address ip-address mask [secondary [vrf vrf-name]]

14.    zone-member security zone-name

15.    end

DETAILED STEPS

	Command or Action	Purpose
Step 1	zone security {zone-name | default} Example: Router(config)# zone security z-client	Creates a security zone and enters security zone configuration mode.
Step 2	exit Example: Router(config-sec-zone)# exit	Exits security zone configuration mode and returns to global configuration mode.
Step 3	zone security {zone-name | default} Example: Router(config)# zone security z-server	Creates a security zone and enters security zone configuration mode.
Step 4	exit Example: Router(config-sec-zone)# exit	Exits security zone configuration mode and returns to global configuration mode.
Step 5	zone-pair security zone-pair-name source {source-zone-name | self | default} destination {destination-zone-name | self | default} Example: Router(config)# zone-pair security clt2srv source z-client destination z-server	Creates a zone pair and enters zone-pair configuration mode.
Step 6	service-policy type inspect policy-map-name Example: Router(config-sec-zone-pair)# service-policy type inspect sunrpc-l4-pmap	Attaches a firewall policy map to a zone pair.
Step 7	exit Example: Router(config-sec-zone-pair)# exit	Exits zone-pair configuration mode and returns to global configuration mode.
Step 8	interface type number Example: Router(config)# interface Serial2/0	Configures an interface type and enters interface configuration mode.
Step 9	ip address ip-address mask [secondary [vrf vrf-name]] Example: Router(config-if)# ip address 192.168.6.5 255.255.255.0	Sets a primary or secondary IP address for an interface.
Step 10	zone-member security zone-name Example: Router(config-if)# zone-member security z-client	Attaches an interface to a security zone.
Step 11	exit Example: Router(config-if)# exit	Exits interface configuration mode and returns to global configuration mode.
Step 12	interface type number Example: Router(config)# interface Serial2/1	Configures an interface type and enters interface configuration mode.
Step 13	ip address ip-address mask [secondary [vrf vrf-name]] Example: Router(config-if)# ip address 192.168.6.5 255.255.255.0	Sets a primary or secondary IP address for an interface.
Step 14	zone-member security zone-name Example: Router(config-if)# zone-member security z-server	Attaches an interface to a security zone.
Step 15	end Example: Router(config-if)# end	Exits interface configuration mode and returns to privileged EXEC mode.