vTCP for ALG Support

When a Layer 7 protocol uses TCP for transportation, the payload can be segmented due to various reasons, such as Maximum Segment Size (MSS), application design, TCP window size, and so forth. Proper recognition of these TCP segments is required to perform the parsing. Therefore, a generic framework called vTCP is used by various ALGs to tackle TCP segmentation.

Some applications like SIP and NAT require the entire payload to rewrite the embedded data. In addition to this, current ALGs are not developed to take into account the data splitting between the packets that are required for the firewall. Therefore, vTCP is also required for the firewall without any changes to the current ALGs. NAT and the firewall ALG configuration activates the vTCP functionality.

ALG is a subcomponent of NAT and the firewall. Both NAT and the firewall have a framework to dynamically couple their ALGs. When the firewall performs the L7 inspection or NAT performs the L7 fix-up, the parser function registered by ALG is called and the ALG takes over packet inspection. vTCP is interposed between NAT or the firewall and the ALGs that use these applications. In other words, the packets are first processed by vTCP and then passed on to the ALGs. vTCP reassembles the TCP segments in both directions within a TCP connection.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    class-map type inspect match-any class-map-name

4.    match protocol protocol-name

5.    exit

6.    policy-map type inspect policy-map-name

7.    class type inspect class-map-name

8.    inspect

9.    class class-default

10.    exit

11.    exit

12.    zone security zone-name1

13.    exit

14.    zone security zone-name2

15.    exit

16.    zone-pair security zone-pair-name source source-zone-name destination destination-zone-name

17.    service-policy type inspect policy-map-name

18.    exit

19.    interface type number

20.    zone-member security zone-name1

21.    exit

22.    interface type number

23.    zone-member security zone-name

24.    end

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	class-map type inspect match-any class-map-name Example: Router(config)# class-map type inspect match-any rtsp_class1	Creates an inspect type class map and enters class-map configuration mode.
Step 4	match protocol protocol-name Example: Router(config-cmap)# match protocol rtsp	Configures the match criteria for a class map on the basis of the named protocol. Use DNS in place of RTSP to configure DNS as the match protocol.
Step 5	exit Example: Router(config-cmap)# exit	Returns to global configuration mode.
Step 6	policy-map type inspect policy-map-name Example: Router(config)# policy-map type inspect rtsp_policy	Creates an inspect type policy map and enters policy-map configuration mode.
Step 7	class type inspect class-map-name Example: Router(config-pmap)# class type inspect rtsp_class1	Specifies the class on which the action is performed and enters policy-map-class configuration mode.
Step 8	inspect Example: Router(config-pmap-c)# inspect	Enables stateful packet inspection.
Step 9	class class-default Example: Router(config-pmap-c)# class class-default	Specifies that these policy map settings apply to the predefined default class. If traffic does not match any of the match criteria in the configured class maps, it is directed to the predefined default class.
Step 10	exit Example: Router(config-pmap-c)# exit	Returns to policy-map configuration mode.
Step 11	exit Example: Router(config-pmap)# exit	Returns to global configuration mode.
Step 12	zone security zone-name1 Example: Router(config)# zone security private	Creates a security zone to which interfaces can be assigned and enters security-zone configuration mode.
Step 13	exit Example: Router(config-sec-zone)# exit	Returns to global configuration mode.
Step 14	zone security zone-name2 Example: Router(config)# zone security public	Creates a security zone to which interfaces can be assigned and enters security-zone configuration mode.
Step 15	exit Example: Router(config-sec-zone)# exit	Returns to global configuration mode.
Step 16	zone-pair security zone-pair-name source source-zone-name destination destination-zone-name Example: Router(config)# zone-pair security pair-two source private destination public	Creates a pair of security zones and enters security-zone-pair configuration mode. To apply a policy, you must configure a zone pair.
Step 17	service-policy type inspect policy-map-name Example: Router(config-sec-zone-pair)# service-policy rtsp_policy	Attaches a firewall policy map to the destination zone pair. If a policy is not configured between a pair of zones, traffic is dropped by default.
Step 18	exit Example: Router(config-sec-zone-pair)# exit	Returns to global configuration mode.
Step 19	interface type number Example: Router(config)# GigabitEthernet0/1/0	Specifies an interface for configuration. Enters interface configuration mode.
Step 20	zone-member security zone-name1 Example: Router(config-if)# zone-member security private	Assigns an interface to a specified security zone. When you make an interface a member of a security zone, all traffic into and out of that interface (except traffic bound for the router or initiated by the router) is dropped by default. To let traffic through the interface, you must make the zone part of a zone pair to which you apply a policy. If the policy permits traffic, traffic can flow through that interface.
Step 21	exit Example: Router(config-if)# exit	Returns to global configuration mode.
Step 22	interface type number Example: Router(config)# GigabitEthernet0/1/0	Specifies an interface for configuration. Enters interface configuration mode.
Step 23	zone-member security zone-name Example: Router(config-if)# zone-member security public	Assigns an interface to a specified security zone. When you make an interface a member of a security zone, all traffic into and out of that interface (except traffic bound for the router or initiated by the router) is dropped by default. To let traffic through the interface, you must make the zone part of a zone pair to which you apply a policy. If the policy permits traffic, traffic can flow through that interface.
Step 24	end Example: Router(config-if)# end	Returns to privileged EXEC mode.

• Troubleshooting Tips