Table Of Contents
vTCP for ALG Support
First Published: July 23, 2010First Published: July 23, 2010
Virtual Transport Control Protocol (vTCP) functionality provides a framework for various Application Layer Gateway (ALG) protocols to appropriately handle the Transport Control Protocol (TCP) segmentation and parse the segments in the Cisco firewall, Network Address Translation (NAT) and other applications.
Finding Feature Information
Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the "Feature Information for vTCP for ALG Support" section.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Prerequisites for vTCP for ALG Support
Your system must be running Cisco IOS XE Release 3.1 or a later Cisco IOS XE software release. The latest version of NAT or firewall ALG should be configured.
Restrictions for vTCP for ALG Support
vTCP does not support data channel traffic. To protect system resources vTCP does not support reassembled messages larger than 8K.
vTCP does not support Hardware Availability (HA) functionality. HA mainly relies on the firewall or NAT to sync session information to the standby forwarding engine.
vTCP currently supports Real Time Streaming Protocol (RTSP) and Domain Name System (DNS) protocols. vTCP support for Session Initiation Protocol (SIP), H323, and Skinny protocols will be added in future releases.
Information About vTCP for ALG Support
vTCP for ALG Support Overview
When a Layer 7 protocol uses TCP for transportation, the payload can be segmented due to various reasons, such as Maximum Segment Size (MSS), application design, TCP window size, and so forth. Proper recognition of these TCP segments is required to perform the parsing. Therefore, a generic framework called vTCP is used by various ALGs to tackle TCP segmentation.
Some applications like SIP and NAT require the entire payload to rewrite the embedded data. In addition to this, current ALGs are not developed to take into account the data splitting between the packets that are required for the firewall. Therefore, vTCP is also required for the firewall without any changes to the current ALGs. NAT and the firewall ALG configuration activates the vTCP functionality.
TCP Acknowledgment and Reliable Transmission
Because vTCP resides between two TCP hosts, buffer space is required to store TCP segments temporarily, before they are sent to the other hosts. During this process vTCP ensures that data transmission occurs properly between the hosts. To achieve this, vTCP uses the TCP acknowledgment (ACK) to the sending host if it requires more data. On the other side of the process, vTCP keeps track of the ACKs sent by the receiving host from the beginning of the TCP flow to closely monitor the acknowledged data.
vTCP reassembles the TCP segments. The IP and the TCP header information of the incoming segments are saved in the vTCP buffer for reliable transmission.
There can be minor changes in the length of the outgoing segments for NAT-enabled applications. vTCP can either squeeze the additional length of data to the last segment or create a new segment to carry the extra data. The IP or TCP header content of the newly created segment is derived from the original incoming segment. The total length of the IP header and the TCP header sequence number are adjusted accordingly.
vTCP Relation with NAT/Firewall and ALG
ALG is a subcomponent of NAT and the firewall. Both NAT and the firewall have a framework to dynamically couple their ALGs. When the firewall performs the L7 inspection or NAT performs the L7 fix-up, the parser function registered by ALG is called and the ALG takes over packet inspection. vTCP is interposed between NAT or the firewall and the ALGs that use these applications. In other words, the packets are first processed by vTCP and then passed on to the ALGs. vTCP reassembles the TCP segments in both directions within a TCP connection.
How to Configure vTCP for ALG Support
The RTSP, DNS, NAT, and the firewall configurations enable vTCP functionality by default. Therefore no new configuration is required to enable vTCP functionality.
Enabling RTSP on Cisco ASR 1000 Series Routers to Activate vTCP
Perform this task to enable RTSP packet inspection.
2. configure terminal
3. class-map type inspect match-any class-map-name
4. match protocol protocol-name
6. policy-map type inspect policy-map-name
7. class type inspect class-map-name
9. class class-default
12. zone security zone-name1
14. zone security zone-name2
16. zone-pair security zone-pair-name source source-zone-name destination destination-zone-name
17. service-policy type inspect policy-map-name
19. interface type number
20. zone-member security zone-name1
22. interface type number
23. zone-member security zone-name2
The following commands can be used to troubleshoot your RTSP-enabled configuration:
•show policy-map type inspect zone-pair
•show zone-pair security
Configuration Examples for vTCP for ALG Support
Example: RTSP Configuration on Cisco ASR 1000 Series Routers
The following example shows how to configure the Cisco ASR 1000 Series Routers to enable RTSP inspection:class-map type inspect match-any rtsp_class1 match protocol rtsppolicy-map type inspect rtsp_policyclass type inspect rtsp_class1inspectclass class-defaultzone security privatezone security publiczone-pair security pair-two source private destination publicservice-policy type inspect rtsp_policyinterface GigabitEthernet0/1/0ip address 10.0.0.1 255.0.0.0zone-member security private!interface GigabitEthernet0/1/1ip address 10.0.1.1 255.0.0.0zone-member security public
MIB MIBs Link
To locate and download MIBs for selected platforms, Cisco software releases, and feature sets, use Cisco MIB Locator found at the following URL:
Feature Information for vTCP for ALG Support
Table 1 lists the features in this module and provides links to specific configuration information.
Use Cisco Feature Navigator to find information about platform support and software image support. Cisco Feature Navigator enables you to determine which software images support a specific software release, feature set, or platform. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Note Table 1 lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.
Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1005R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.
© 2010 Cisco Systems, Inc. All rights reserved.