Cisco IOS XE 3S

Table Of Contents

vTCP for ALG Support

Finding Feature Information

Contents

Prerequisites for vTCP for ALG Support

Restrictions for vTCP for ALG Support

Information About vTCP for ALG Support

vTCP for ALG Support Overview

vTCP Relation with NAT/Firewall and ALG

How to Configure vTCP for ALG Support

Enabling RTSP on Cisco ASR 1000 Series Routers to Activate vTCP

Troubleshooting Tips

Configuration Examples for vTCP for ALG Support

Example: RTSP Configuration on Cisco ASR 1000 Series Routers

Additional References

Related Documents

MIBs

RFCs

Technical Assistance

Feature Information for vTCP for ALG Support

vTCP for ALG Support

---

First Published: July 23, 2010

First Published: July 23, 2010

Virtual Transport Control Protocol (vTCP) functionality provides a framework for various Application Layer Gateway (ALG) protocols to appropriately handle the Transport Control Protocol (TCP) segmentation and parse the segments in the Cisco firewall, Network Address Translation (NAT) and other applications.

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the "Feature Information for vTCP for ALG Support" section.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.

Contents

•Prerequisites for vTCP for ALG Support

•Restrictions for vTCP for ALG Support

•Information About vTCP for ALG Support

•How to Configure vTCP for ALG Support

•Configuration Examples for vTCP for ALG Support

•Additional References

•Feature Information for vTCP for ALG Support

Prerequisites for vTCP for ALG Support

Your system must be running Cisco IOS XE Release 3.1 or a later Cisco IOS XE software release. The latest version of NAT or firewall ALG should be configured.

Restrictions for vTCP for ALG Support

vTCP does not support data channel traffic. To protect system resources vTCP does not support reassembled messages larger than 8K.

vTCP does not support Hardware Availability (HA) functionality. HA mainly relies on the firewall or NAT to sync session information to the standby forwarding engine.

Supported ALGs

vTCP currently supports Real Time Streaming Protocol (RTSP) and Domain Name System (DNS) protocols. vTCP support for Session Initiation Protocol (SIP), H323, and Skinny protocols will be added in future releases.

Information About vTCP for ALG Support

•vTCP for ALG Support Overview

•vTCP Relation with NAT/Firewall and ALG

vTCP for ALG Support Overview

When a Layer 7 protocol uses TCP for transportation, the payload can be segmented due to various reasons, such as Maximum Segment Size (MSS), application design, TCP window size, and so forth. Proper recognition of these TCP segments is required to perform the parsing. Therefore, a generic framework called vTCP is used by various ALGs to tackle TCP segmentation.

Some applications like SIP and NAT require the entire payload to rewrite the embedded data. In addition to this, current ALGs are not developed to take into account the data splitting between the packets that are required for the firewall. Therefore, vTCP is also required for the firewall without any changes to the current ALGs. NAT and the firewall ALG configuration activates the vTCP functionality.

TCP Acknowledgment and Reliable Transmission

Because vTCP resides between two TCP hosts, buffer space is required to store TCP segments temporarily, before they are sent to the other hosts. During this process vTCP ensures that data transmission occurs properly between the hosts. To achieve this, vTCP uses the TCP acknowledgment (ACK) to the sending host if it requires more data. On the other side of the process, vTCP keeps track of the ACKs sent by the receiving host from the beginning of the TCP flow to closely monitor the acknowledged data.

vTCP reassembles the TCP segments. The IP and the TCP header information of the incoming segments are saved in the vTCP buffer for reliable transmission.

There can be minor changes in the length of the outgoing segments for NAT-enabled applications. vTCP can either squeeze the additional length of data to the last segment or create a new segment to carry the extra data. The IP or TCP header content of the newly created segment is derived from the original incoming segment. The total length of the IP header and the TCP header sequence number are adjusted accordingly.

vTCP Relation with NAT/Firewall and ALG

ALG is a subcomponent of NAT and the firewall. Both NAT and the firewall have a framework to dynamically couple their ALGs. When the firewall performs the L7 inspection or NAT performs the L7 fix-up, the parser function registered by ALG is called and the ALG takes over packet inspection. vTCP is interposed between NAT or the firewall and the ALGs that use these applications. In other words, the packets are first processed by vTCP and then passed on to the ALGs. vTCP reassembles the TCP segments in both directions within a TCP connection.

How to Configure vTCP for ALG Support

The RTSP, DNS, NAT, and the firewall configurations enable vTCP functionality by default. Therefore no new configuration is required to enable vTCP functionality.

•Enabling RTSP on Cisco ASR 1000 Series Routers to Activate vTCP

Enabling RTSP on Cisco ASR 1000 Series Routers to Activate vTCP

Perform this task to enable RTSP packet inspection.

SUMMARY STEPS

1. enable

2. configure terminal

3. class-map type inspect match-any class-map-name

4. match protocol protocol-name

5. exit

6. policy-map type inspect policy-map-name

7. class type inspect class-map-name

8. inspect

9. class class-default

10. exit

11. exit

12. zone security zone-name1

13. exit

14. zone security zone-name2

15. exit

16. zone-pair security zone-pair-name source source-zone-name destination destination-zone-name

17. service-policy type inspect policy-map-name

18. exit

19. interface type number

20. zone-member security zone-name1

21. exit

22. interface type number

23. zone-member security zone-name2

24. end

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. •Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	class-map type inspect match-any class-map-name Example: Router(config)# class-map type inspect match-any rtsp_class1	Creates an inspect type class map and enters class-map configuration mode.
Step 4	match protocol protocol-name Example: Router(config-cmap)# match protocol rtsp	Configures the match criteria for a class map on the basis of the named protocol. •Use DNS in place of RTSP to configure DNS as the match protocol.
Step 5	exit Example: Router(config-cmap)# exit	Returns to global configuration mode.
Step 6	policy-map type inspect policy-map-name Example: Router(config)# policy-map type inspect rtsp_policy	Creates an inspect type policy map and enters policy-map configuration mode.
Step 7	class type inspect class-map-name Example: Router(config-pmap)# class type inspect rtsp_class1	Specifies the class on which the action is performed and enters policy-map-class configuration mode.
Step 8	inspect Example: Router(config-pmap-c)# inspect	Enables stateful packet inspection.
Step 9	class class-default Example: Router(config-pmap-c)# class class-default	Specifies that these policy map settings apply to the predefined default class. If traffic does not match any of the match criteria in the configured class maps, it is directed to the predefined default class.
Step 10	exit Example: Router(config-pmap-c)# exit	Returns to policy-map configuration mode.
Step 11	exit Example: Router(config-pmap)# exit	Returns to global configuration mode.
Step 12	zone security zone-name1 Example: Router(config)# zone security private	Creates a security zone to which interfaces can be assigned and enters security-zone configuration mode.
Step 13	exit Example: Router(config-sec-zone)# exit	Returns to global configuration mode.
Step 14	zone security zone-name2 Example: Router(config)# zone security public	Creates a security zone to which interfaces can be assigned and enters security-zone configuration mode.
Step 15	exit Example: Router(config-sec-zone)# exit	Returns to global configuration mode.
Step 16	zone-pair security zone-pair-name source source-zone-name destination destination-zone-name Example: Router(config)# zone-pair security pair-two source private destination public	Creates a pair of security zones and enters security-zone-pair configuration mode. •To apply a policy, you must configure a zone pair.
Step 17	service-policy type inspect policy-map-name Example: Router(config-sec-zone-pair)# service-policy rtsp_policy	Attaches a firewall policy map to the destination zone pair. •If a policy is not configured between a pair of zones, traffic is dropped by default.
Step 18	exit Example: Router(config-sec-zone-pair)# exit	Returns to global configuration mode.
Step 19	interface type number Example: Router(config)# GigabitEthernet0/1/0	Specifies an interface for configuration. •Enters interface configuration mode.
Step 20	zone-member security zone-name1 Example: Router(config-if)# zone-member security private	Assigns an interface to a specified security zone. •When you make an interface a member of a security zone, all traffic into and out of that interface (except traffic bound for the router or initiated by the router) is dropped by default. To let traffic through the interface, you must make the zone part of a zone pair to which you apply a policy. If the policy permits traffic, traffic can flow through that interface.
Step 21	exit Example: Router(config-if)# exit	Returns to global configuration mode.
Step 22	interface type number Example: Router(config)# GigabitEthernet0/1/0	Specifies an interface for configuration. •Enters interface configuration mode.
Step 23	zone-member security zone-name Example: Router(config-if)# zone-member security public	Assigns an interface to a specified security zone. •When you make an interface a member of a security zone, all traffic into and out of that interface (except traffic bound for the router or initiated by the router) is dropped by default. To let traffic through the interface, you must make the zone part of a zone pair to which you apply a policy. If the policy permits traffic, traffic can flow through that interface.
Step 24	end Example: Router(config-if)# end	Returns to privileged EXEC mode.

Troubleshooting Tips

The following commands can be used to troubleshoot your RTSP-enabled configuration:

•clear zone-pair

•show policy-map type inspect zone-pair

•show zone-pair security

Configuration Examples for vTCP for ALG Support

•Example: RTSP Configuration on Cisco ASR 1000 Series Routers

Example: RTSP Configuration on Cisco ASR 1000 Series Routers

The following example shows how to configure the Cisco ASR 1000 Series Routers to enable RTSP inspection:

class-map type inspect match-any rtsp_class1 
match protocol rtsp 

policy-map type inspect rtsp_policy

class type inspect rtsp_class1

inspect

class class-default

zone security private

zone security public

zone-pair security pair-two source private destination public

service-policy type inspect rtsp_policy

interface GigabitEthernet0/1/0

 ip address 10.0.0.1 255.0.0.0

zone-member security private

!

interface GigabitEthernet0/1/1

 ip address 10.0.1.1 255.0.0.0

  zone-member security public

Additional References

Related Documents

Related Topic	Document Title
Cisco IOS commands	Cisco IOS Master Commands List, All Releases
Cisco IOS firewall commands	Cisco IOS Security Command Reference
Cisco Firewall—SIP Enhancements: ALG	Cisco IOS XE Security Configuration Guide: Securing the Data Plane
Network Address Translation	Cisco IOS XE IP Addressing Services Configuration

MIBs

MIB	MIBs Link
None	To locate and download MIBs for selected platforms, Cisco software releases, and feature sets, use Cisco MIB Locator found at the following URL: http://www.cisco.com/go/mibs

RFCs

RFC	Title
RFC 793	Transport Control Protocol
RFC 813	Window and Acknowledge Strategy in TCP

Technical Assistance

Description	Link
The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.	http://www.cisco.com/cisco/web/support/index.html

Feature Information for vTCP for ALG Support

Table 1 lists the features in this module and provides links to specific configuration information.

Use Cisco Feature Navigator to find information about platform support and software image support. Cisco Feature Navigator enables you to determine which software images support a specific software release, feature set, or platform. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.

---

Note Table 1 lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

---

Table 1 Feature Information for vTCP for ALG Support

Feature Name	Releases	Feature Information
vTCP for ALG Support	Cisco IOS XE Release 3.1S	This functionality provides an enhancement to handle the TCP segmentation and reassembling for the firewall and NAT ALGs, in Cisco IOS XE software on the Cisco ASR 1000 Series Routers.

Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1005R)

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.

© 2010 Cisco Systems, Inc. All rights reserved.