-
Cisco IOS XR Virtual Firewall Configuration Guide, Release 3.7
-
Preface
-
Configuring Virtual Firewalls on the Multiservice Blade
-
Configuring the Management Interface on the Virtual Firewall
-
Configuring Virtualization on the Virtual Firewall
-
Configuring Authentication and Accounting Services on the Virtual Firewall
-
Configuring Security Access Control Lists on the Virtual Firewall
-
Configuring Application Protocol Inspection on the Virtual Firewall
-
Configuring High Availability on the Virtual Firewall
-
Configuring SNMP on the Virtual Firewall
-
Configuring an XML Interface on the Virtual Firewall
-
Configuring System Message Logging on the Virtual Firewall
-
Managing the Virtual Firewall Software
-
Configuring VRF-Aware Service Infrastructure for the Virtual Firewall
-
Configuring TCP/IP Normalization and IP Reassembly Parameters on the Virtual Firewall
-
Configuring Network Address Translation on the Virtual Firewall
-
Using the Command-Line Interface on the Virtual Firewall
-
Virtual Firewall System Error Messages
-
Index
-
Table Of Contents
Configuring Application Protocol Inspection on the Virtual Firewall
Information About Application Protocol Inspection
Application Protocol Inspection Support
Application Inspection Protocol Overview
How to Configure Application Protocol Inspection
Configuring a Layer 7 HTTP Deep Inspection Policy
Creating a Layer 7 HTTP Deep Inspection Class Map
Configuring a Layer 7 HTTP Deep Packet Inspection Policy Map
Configuring a Layer 3 and Layer 4 Traffic Policy for Layer 7 HTTP Deep Packet Inspection
Applying a Traffic Policy to an Interface
Configuring a Layer 7 FTP Command Inspection Policy
Configuring a Layer 3 and Layer 4 Application Protocol Inspection Traffic Policy
Applying a Traffic Policy to an Interface
Displaying Application Protocol Inspection Statistics and Service Policy Information
How to Configure an HTTP Parameter Map for Use in a Layer 3 and Layer 4 Policy Map
Configuring an HTTP Parameter Map
Configuration Examples for Application Protocol Inspection
Layer 7 HTTP Deep Inspection Policy Configuration: Example
Layer 7 FTP Inspection Policy Configuration: Example
Configuring Application Protocol Inspection on the Virtual Firewall
This module describes how to configure application protocol inspection for the VFW application. Application protocol inspection provides functionality for several protocols that carry Layer 3 and Layer 4 information in the application payload, require some form of deep packet inspection of the HTTP protocol, or require FTP request command filtering.
Feature History for Configuring Application Protocol Inspection on the VFW Application
Release 3.5.0
This feature was introduced on the multiservice blade (MSB) for the Cisco XR 12000 Series Router.
Release 3.6.0
No modification.
Release 3.7.0
No modification.
Contents
•
Information About Application Protocol Inspection
•
•
•
Information About Application Protocol Inspection
Certain applications require special handling of the data portion of a packet as the packets pass through the VFW application. Application protocol inspection helps to verify the protocol behavior and identify unwanted or malicious traffic passing through the VFW application. Based on the specifications of the traffic policy, the VFW application accepts or rejects the packets to ensure the secure use of applications and services.
This section includes the following topics on application protocol inspection:
•
•
Application Protocol Inspection Support
You can configure the VFW application to perform application protocol inspection, sometimes referred to as application protocol fixup, for applications that:
•
•
You may require that the VFW application perform application inspection of HTTP, FTP, Domain Name System (DNS), Internet Control Message Protocol (ICMP), and Real Time Streaming Protocol (RTSP) as a first step before passing the packets to the destination server. For HTTP, the VFW application performs deep packet inspection to statefully monitor the HTTP protocol and permits or denies traffic based on user-defined traffic policies. HTTP deep packet inspection focuses mainly on HTTP attributes such as HTTP header, URL, and payload. For FTP, the VFW application performs FTP command inspection for FTP sessions, allowing you to restrict specific commands with the VFW application.
Application inspection helps you identify the location of embedded IP addressing information in the TCP or UDP flow. This inspection allows the VFW application to translate embedded IP addresses and to update any checksum or other fields that are affected by the translation.
The need to translate IP addresses embedded in the payload of protocols is especially important for Network Address Translation (NAT), that is explicitly configured by the user.
Application inspection also monitors TCP or UDP sessions to determine the port numbers for secondary channels. Some protocols open secondary TCP or UDP ports to improve performance. The initial session on a well-known port is used to negotiate dynamically assigned port numbers. The application protocol inspection function monitors these sessions, identifies the dynamic port assignments, and permits data exchange on these ports for the duration of the session.
Table 9 describes the application inspection protocols supported by the VFW application, the default TCP or UDP protocol and port, and whether the protocol is compatible with NAT and Port Address Translation (PAT).
Table 9 Application Inspection Support
DNS
UDP
Src—Any
Dest—53
NAT
No
RFC 1123
Inspects DNS packets destined to port 53. You can specify the maximum length of the DNS packet to be inspected. See the "DNS Inspection" section for background information.
FTP
TCP
Src—Any
Dest—21
Both
No
RFC 959
Inspects FTP packets, translates address and port embedded in the payload, and opens up secondary channel for data. See the "FTP Inspection" section for background information.
FTP strict
TCP
Src—Any
Dest—21
Both
No
RFC 959
The inspect ftp strict command allows the VFW application to track each FTP command and response sequence, and prevents an FTP client from determining valid usernames that are supported on an FTP server. See the "FTP Inspection" section for background information.
HTTP
TCP
Src—Any
Dest—80
Both
No
RFC 2616
Inspects HTTP packets. See the "HTTP Deep Packet Inspection" section for background information.
ICMP
ICMP
Src—N/A
Dest—N/A
Both
No
—
See the "ICMP Inspection" section for background information.
ICMP error
ICMP
Src—N/A
Dest—N/A
NAT
No
—
The error keyword supports NAT of ICMP error messages. When you enable ICMP error inspection, the VFW application creates translation sessions for intermediate hops that send ICMP error messages, based on the NAT configuration. The VFW application overwrites the packet with the translated IP addresses. See the "ICMP Inspection" section for background information.
RTSP
TCP
Src—Any
Dest—554
NAT
No
RFC 2326, RFC 2327, RFC 1889
Inspects RTSP packets and translates the payload according to NAT rules. The VFW application opens up the secondary channels for audio and video. Not all the RTSP methods (packet types) specified in the RFC are supported. See the "RTSP Inspection" section for background information.
1 The VFW application is in compliance with these standards, but it does not enforce compliance on packets being inspected. For example, FTP commands are supposed to be in a particular order, but the VFW application does not enforce the order.
You configure rules for application protocol inspection through the use of class maps, policy maps, and service policies. The following items summarize the role of each function in configuring application protocol inspection:
•
•
•
•
•
The flow chart shown in Figure 15 provides a basic overview of the process required to configure class maps and policy maps to perform application protocol inspection. The flow chart also illustrates how the VFW application associates the various components of the class map and policy map configuration with each other.
Figure 15 Application Protocol Inspection Configuration Flow Diagram
Application Inspection Protocol Overview
This section provides an overview of the following application inspection protocols supported by the VFW application:
HTTP Deep Packet Inspection
The VFW application performs a stateful deep packet inspection of the HTTP protocol. Deep packet inspection is a special case of application inspection in which the VFW application examines the application payload of a packet or a traffic stream and makes decisions based on the content of the data. During HTTP deep inspection, the main focus of the application inspection process is on HTTP attributes such as HTTP header, URL, and to a limited extent, the payload. User-defined regular expressions can also be used to detect "signatures" in the payload.
You define policies to permit or deny the traffic or to send a TCP reset message to the client or server to close the connection.
The security features covered by HTTP application inspection include:
•
•
•
•
•
DNS Inspection
Domain Name System (DNS) inspection performs the following tasks:
•
•
•
Note
•
Note
•
–
–
–
A single connection is created for multiple DNS sessions, as long as the DNS sessions are between the same two hosts, and the sessions have the same 5-tuple (source and destination IP address, source and destination port, and protocol). DNS identification is tracked by app_id, and the idle timer for each app_id runs independently.
Because the app_id expires independently, a legitimate DNS response can pass through the security appliance only within a limited period of time, and there is no resource buildup. However, if you enter the show connection command, you see the idle timer of a DNS connection being reset by a new DNS session. This reset action is due to the nature of the shared DNS connection and is intended by design.
FTP Inspection
File Transfer Protocol (FTP) inspection inspects FTP sessions for address translation in a message, dynamic opening of ports and stateful tracking of request and response messages. Each specified FTP command must be acknowledged before the VFW application allows a new command. Command filtering allows you to restrict specific commands by the VFW application. When the VFW application denies a command, it closes the connection.
The FTP command inspection process, as performed by the VFW application:
•
•
Note
–
–
–
–
–
–
–
•
ICMP Inspection
Internet Control Message Protocol (ICMP) inspection allows ICMP traffic to have a "session" so that it can be inspected similarly to TCP and UDP traffic. Without using ICMP inspection, we recommend that you do not allow ICMP traffic to pass through the VFW application in an ACL. Without performing stateful inspection, ICMP can be used to attack your network. ICMP inspection ensures that there is only one response for each request, and that the sequence number is correct.
For stateful ICMP, state information, as maintained for TCP or UDP flows, is maintained for ICMP instead of performing only the ACL and NAT functions. The maintenance of ICMP state information is required to resolve the following problems:
•
•
•
ICMP error messages are generated by intermediate nodes situated on the network path to a destination whenever a packet sent to that destination cannot be forwarded. ICMP error messages may also be generated by endpoint nodes, as in the case of port unreachable errors. These error messages carry the original packet for which the error is generated in the data part of the message. They also contain the addresses of the intermediate node or endpoint node in the outer header and the destination in the inner header. ICMP error fixup handles address translation of node address and destination address to global addresses using NAT configuration.
ICMP error fixup is user-configurable, and if not enabled, intermediate node or endpoint node addresses are translated in the same way as the destination address of the embedded packet. As a result, error messages appear as if originating from the destination, and the node addresses or the route to the destination is not revealed.
ICMP inspection performs the following tasks for ICMP request or reply messages:
•
•
•
•
•
ICMP error message inspection performs the following tasks:
•
•
•
•
RTSP Inspection
Real Time Streaming Protocol (RTSP) is used by RealAudio, RealNetworks, Apple QuickTime 4, RealPlayer, and Cisco IP/TV connections. RTSP applications use the well-known port 554 with TCP and UDP as the control channel. The VFW application supports TCP only in conformity with RFC 2326.
The TCP control channel negotiates the data channels used to transmit audio and video traffic, depending on the transport mode that is configured on the client. The supported data transport modes are rtp/avp, rtp/avp/udp, x-real-rdt, x-real-rdt/udp, and x-pn-tng/udp. Data transport types rtp/avp/tcp and x-real-rdt/tcp use the control channel to stream data. RTSP inspection is not required in this case to open a pinhole for the data channel.
The VFW application parses SETUP response messages with a status code of 200.
Because RFC 2326 does not require that the client and server ports be contained in the SETUP response message, the VFW application must keep track of state and remember the client ports in the SETUP message. QuickTime places the client ports in the SETUP message; the server responds with only the server ports.
During RTSP inspection, the VFW application does not:
•
•
•
•
The following additional restrictions apply to RTSP inspection as performed by the VFW application:
•
•
–
–
How to Configure Application Protocol Inspection
The following tasks detail the procedures required to configure application protocol inspection on the VFW application:
•
•
•
•
•
Configuring a Layer 7 HTTP Deep Inspection Policy
This task describes how to create a Layer 7 class map and policy map to be used for HTTP deep packet inspection by the VFW application. The VFW application performs a stateful deep packet inspection of the HTTP protocol and permits or restricts traffic based on the actions in your configured policy maps. The following security features are included as part of HTTP deep packet inspection as performed by the VFW application:
•
•
•
•
•
•
•
Note
•
•
•
To configure a Layer 7 HTTP deep inspection policy, you must perform each of the following tasks:
•
•
•
•
Creating a Layer 7 HTTP Deep Inspection Class Map
This task describes how to create a Layer 7 HTTP deep inspection class map.
Prerequisites
You must attach from the route processor to the VFW application before you can perform this task. See the "Attaching to the VFW Application" section on page VFC-14.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
DETAILED STEPS
Step 1
changeto context_name
Example:firewall/Admin# changeto C1
firewall/C1#
Logs into the correct context. If you are operating in multiple contexts, observe the CLI prompt to verify that you are operating in the desired context.
Note
Step 2
configure
Example:firewall/Admin# configure
Enter configuration commands, one per line. End with CNTL/Z.
firewall/Admin(config)#
Enters global configuration mode. You are now within configuration mode of the VFW application.
Step 3
class-map type http [match-all | match-any] map_name
Example:firewall/Admin(config)# class-map type http inspect match-any HTTP_INSPECT_L7CLASSfirewall/Admin(config-cmap-http-insp)#Creates a Layer 7 class map that is used for the deep packet inspection of HTTP traffic. If you do not specify match-all or match-any, traffic must match all the match criteria to be classified as part of the traffic class.
Note
Step 4
[line_number] match content expression
Example:firewall/Admin(config-cmap-http-insp)# match content .*newp2psig(Optional) Use the match content command to configure the class map to define HTTP application inspection decisions based on content expressions contained within the HTTP content. The expression argument specifies the content contained within the HTTP entity-body. The range is from 1 to 255 alphanumeric characters. See Table 11 for a list of the supported characters that you can use in regular expressions.
Step 5
[line_number] match content length operator bytes
Example:firewall/Admin(config-cmap-http-insp)# match content length eq 1000(Optional) Use the match content length command to configure the class map to define application inspection decisions in the HTTP content up to the configured maximum content parse length. Allowable operators are as follows:
•
•
•
•
•
The bytes argument represents the content parse length in an HTTP message received by the VFW application. Valid entries are from 1 to 65535 bytes.
Step 6
[line_number] match header {header_name | header_field} header-value expression
Example:firewall/Admin(config-cmap-http-insp)# match header Host header-value .mycompanyexample.com(Optional) Use the match header command to configure the class map to define application inspection decisions based on the name and value in an HTTP header.
header_name—Specifies the name of the HTTP header to match (for example, www.example1.com). Enter an unquoted text string with no spaces and a maximum of 64 alphanumeric characters. Alternatively, you can enter a text string with spaces, provided that you enclose the entire string in quotation marks (").
header_field—Specifies a standard HTTP/1.1 header field. Valid selections include request-header fields, general-header fields, and entity-header field. Table 10 lists the supported HTTP/1.1 header fields.
header-value expression—Specifies the header value expression string to compare against the value in the specified field in the HTTP header. The range is from 1 to 255 alphanumeric characters. The VFW application supports the use of regular expressions for matching. Expressions are stored in a header map in the form header-name: expression. Header expressions allow spaces, provided that the spaces are escaped or quoted. See Table 11 for a list of the supported characters that you can use in regular expressions.
Step 7
[line_number] match header length {request | response} operator bytes
Example:firewall/Admin(config-cmap-http-insp)# match header length request eq 256(Optional) Limits the HTTP traffic allowed through the VFW application based on the length of the entity body in the HTTP message.
•
•
Allowable operators are as follows:
•
•
•
•
•
The bytes argument represents the size of the entity-body in an HTTP message received by the VFW application. Valid entries are from 1 to 65535 bytes.
Step 8
[line_number] match header mime-type mime_type
Example:firewall/Admin(config-cmap-http-insp)# match header mime-type audio\midifirewall/Admin(config-cmap-http-insp)# match header mime-type audio\mpeg(Optional) Specifies a subset of the Multipurpose Internet Mail Extension (MIME)-type messages to be permitted or denied by the VFW application. The mime_type argument specifies the MIME type to be permitted through the VFW application. By default all mime-types are allowed. Table 12 lists all supported MIME types.
Step 9
[line_number] match port-misuse application_category
Example:firewall/Admin(config-cmap-http-insp)# match port-misuse p2p(Optional) Configures the class map to define application inspection compliance decisions that restrict certain HTTP traffic from passing through the VFW application. The application_category argument specifies the restricted HTTP application category for the class map. The possible values for application_category include:
•
•
•
Step 10
[line_number] match request-method {ext | rfc} method
Example:firewall/Admin(config-cmap-http-insp)# match request-method rfc connectfirewall/Admin(config-cmap-http-insp)# match request-method rfc getfirewall/Admin(config-cmap-http-insp)# match request-method rfc headfirewall/Admin(config-cmap-http-insp)# match request-method ext index(Optional) Configures the class map to define application inspection compliance decisions based on the request methods defined in RFC 2616 and by HTTP extension methods.
•
•
Step 11
[line_number] match transfer-encoding coding_types
Example:firewall/Admin(config-cmap-http-insp)# match transfer-encoding chunked•
•
•
•
•
•
Step 12
[line_number] match url expression
Example:firewall/Admin(config-cmap-http-insp)# match url .*.giffirewall/Admin(config-cmap-http-insp)# match url .*.html(Optional) Configures the class map to define application inspection decisions based on URL name. The expression argument specifies the URL, or portion of a URL, to match and can be from 1 to 255 characters. Include only the portion of the URL following www.hostname.domain in the match statement. For example, in the URL www.anydomain.com/latest/whatsnew.html, include only /latest/whatsnew.html. To match the www.anydomain.com portion, the URL string can take the form of a URL regular expression. The VFW application supports the use of regular expressions for matching. See Table 11 for a list of the supported characters that you can use in regular expressions.
Step 13
[line_number] match url length operator bytes
Example:firewall/Admin(config-cmap-http-insp)# match url length eq 10000(Optional) Limits the HTTP traffic allowed through the VFW application by specifying the maximum length of a URL in a request message that can be received by the VFW application. Allowable operators are as follows:
•
•
•
•
•
The bytes argument represents the size of the URL received by the VFW application. Valid entries are from 1 to 65535 bytes.
Step 14
exit
Example:firewall/Admin(config-if-mgmt)# exit
firewall/Admin#
Exits class map configuration mode.
Step 15
copy running-config startup-config
Example:firewall/Admin# copy running-config startup-config
(Optional) Saves your configuration changes to flash memory.
Table 10 lists the supported HTTP/1.1 header fields.
Table 11 provides a list of the supported characters that you can use in regular expressions.
Table 12 lists the supported MIME types.
Example
The following example illustrates how to specify HTTP_INSPECT_L7CLASS as the name of a class map and identify that at least one command in the Layer 7 HTTP application inspection class map must be satisfied for the VFW application to indicate a match:
host1/Admin(config)# class-map type http inspect match-any HTTP_INSPECT_L7CLASSfirewall/Admin(config-cmap-http-insp)# match header length request eq 200firewall/Admin(config-cmap-http-insp)# match header Host header-value .*mycompanyexample.comfirewall/Admin(config-cmap-http-insp)# match url length eq 10000firewall/Admin(config-cmap-http-insp)# match url .*.gifWhat to Do Next
After configuring a Layer 7 HTTP deep inspection class map, you need to configure a Layer 7 HTTP deep packet inspection policy map as described in the "Configuring a Layer 7 HTTP Deep Packet Inspection Policy Map" section.
Configuring a Layer 7 HTTP Deep Packet Inspection Policy Map
This task describes how to configure a Layer 7 HTTP deep inspection policy map. The Layer 7 policy map configures the applicable HTTP deep packet inspection actions executed on the network traffic that match the classifications defined in a class map, as defined in "Creating a Layer 7 HTTP Deep Inspection Class Map" section. You then associate the completed Layer 7 HTTP deep packet inspection policy with a Layer 3 and Layer 4 policy map, and activate the operation on an interface (see the "Configuring a Layer 3 and Layer 4 Traffic Policy for Layer 7 HTTP Deep Packet Inspection" section and the "Applying a Traffic Policy to an Interface" section for more information).
Prerequisites
•
•
SUMMARY STEPS
1.
2.
3.
4.
or
reset5.
6.
DETAILED STEPS
Step 1
configure
Example:firewall/Admin# configure
Enter configuration commands, one per line. End with CNTL/Z.
firewall/Admin(config)#
Enters global configuration mode. You are now within configuration mode of the VFW application.
Step 2
policy-map type inspect http all-match map_name
Example:firewall/Admin(config)# policy-map type inspect http all-match HTTP_INSPECT_L7POLICYCreates and configures a Layer 7 policy map that enables the deep packet inspection of the HTTP protocol.
Step 3
class map_name
Example:firewall/Admin(config-pmap-ins-http)# class HTTP_INSPECT_L7CLASSAssociates a class map defined in "Creating a Layer 7 HTTP Deep Inspection Class Map" section with the Layer 7 policy map, and enters policy map class configuration mode.
It is possible to include a single inline match criteria in the policy map without specifying a traffic class using an applicable Layer 7 match command. The inline Layer 7 policy map match commands function the same as with the Layer 7 class map match commands. However, when you use an inline match command, you can specify an action for only a single match statement in the Layer 7 policy map. Refer to the "Configuration Tip: Including Inline Match Statements in a Layer 7 HTTP Deep Packet Inspection Policy Map" section for more information.
Step 4
permit
or
resetExample:firewall/Admin(config-pmap-mgmt-c)# permitSpecifies to permit or deny the traffic defined by the class. If reset is used, a TCP reset message is sent to the client or server to close the connection.
By default, HTTP inspection allows traffic which does not match any of the configured Layer 7 HTTP deep packet inspection matches. You can modify this behavior by including the class class-default command with the reset action to deny the specified Layer 7 HTTP traffic. In this case, if none of the class matches configured in the Layer 7 HTTP deep packet inspection policy map are hit, the class-default action will be taken by the VFW application. For example, you can include a class map to allow the HTTP GET method and use the class class-default command to block all the other requests.
Note
Step 5
end
Example:firewall/Admin(config-pmap-mgmt-c)# end
firewall/Admin#
Exits configuration mode.
Step 6
copy running-config startup-config
Example:firewall/Admin# copy running-config startup-config
(Optional) Saves your configuration changes to flash memory.
Configuration Tip: Including Inline Match Statements in a Layer 7 HTTP Deep Packet Inspection Policy Map
To include a single inline match criterion in the policy map without specifying a traffic class, enter an applicable Layer 7 match command. The inline Layer 7 policy map match commands function the same as a Layer 7 class map with match commands. However, when you use an inline match command, you can specify an action for only a single match statement in the Layer 7 policy map.
The HTTP deep packet inspection policy map inline match commands include the following:
•
•
•
•
•
•
•
•
•
•
•
•
The match content-type-verification and match strict-http commands are available only as inline match commands under the Layer 7 policy-map type inspect http command. Because these two Layer 7 HTTP deep inspection match criteria cannot be combined with other match criteria, they appear as inline match commands for a policy map.
These two match commands perform the following HTTP deep inspection functions:
•
Note
•
For example, to add an inline match command to a Layer 7 HTTP deep inspection policy map, enter:
firewall/Admin(config-pmap-ins-http)# match L7httpinspect port-misuse p2pWhat to Do Next
You must configure a Layer 3 and Layer 4 policy map and associate it with the Layer 7 HTTP deep packet inspection policy map that you created in this task. See "Configuring a Layer 3 and Layer 4 Traffic Policy for Layer 7 HTTP Deep Packet Inspection" section.
Configuring a Layer 3 and Layer 4 Traffic Policy for Layer 7 HTTP Deep Packet Inspection
After you create a Layer 7 HTTP deep packet inspection policy, you must associate it with a Layer 3 and Layer 4 policy map. This task describes briefly how to create a Layer 3 and Layer 4 policy map and associate it with the Layer 7 HTTP deep packet inspection policy map. For more information regarding Layer 3 and Layer 4 class maps and policy maps, refer to the "Configuring a Layer 3 and Layer 4 Application Protocol Inspection Traffic Policy" section.
Prerequisites
•
•
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
9.
DETAILED STEPS
Step 1
configure
Example:firewall/Admin# configure
Enter configuration commands, one per line. End with CNTL/Z.
firewall/Admin(config)#
Enters global configuration mode. You are now within configuration mode of the VFW application.
Step 2
class-map [match-all | match-any] map_name
Example:firewall/Admin(config)# class-map match-all HTTP_INSPECT_L4CLASSCreates a Layer 3 and Layer 4 class map to classify network traffic passing through the VFW application for HTTP deep packet inspection. If you do not specify match-all or match-any, traffic must match all the match criteria to be classified as part of the traffic class.
Step 3
[line_number] match port {tcp | udp} {any | eq port_number | range port1 port2}
Example:firewall/Admin(config-cmap)# match port tcp eq 80Specifies a match command as part of the Layer 3 and Layer 4 class map. Refer to "Configuring a Layer 3 and Layer 4 Application Protocol Inspection Traffic Policy" section for a list of available match commands.
Step 4
exit
Example:firewall/Admin(config-cmap)# exit
firewall/Admin(config)#
Exits class map configuration mode.
Step 5
policy-map multi-match map_name
Example:firewall/Admin(config)# policy-map multi-match HTTP_INSPECT_L4POLICYCreates a Layer 3 and Layer 4 policy map and associates the Layer 7 HTTP deep packet inspection policy map to activate the operation. Specify the actions you want to apply to the Layer 3 and Layer 4 user-defined class map and, if appropriate, to the default class map.
Step 6
class map_name
Example:firewall/Admin(config-pmap)# class HTTP_INSPECT_L4CLASSAssociates the class map defined in Step 2 with the Layer 3 and Layer 4 policy map, and enters policy map class configuration mode.
Step 7
inspect http [policy policy_map | url-logging]
Example:firewall/Admin(config-pmap-c)# inspect http policy HTTP_INSPECT_L7POLICYAssociates the HTTP deep packet inspection policy map with the Layer 3 and Layer 4 class map being defined. For example, the HTTP deep packet inspection policy map created in "Configuring a Layer 7 HTTP Deep Packet Inspection Policy Map" section is associated with the Layer 3 and Layer 4 class map.
Step 8
end
Example:firewall/Admin(config-pmap-c)# end
firewall/Admin#
Exits configuration mode.
Step 9
copy running-config startup-config
Example:firewall/Admin# copy running-config startup-config
(Optional) Saves your configuration changes to flash memory.
What to Do Next
You must attach the Layer 3 and Layer 4 traffic policy that you created in this task to an interface. See "Applying a Traffic Policy to an Interface" section.
Applying a Traffic Policy to an Interface
After you have created the Layer 3 and Layer 4 traffic policy, you must attach it to a single interface or globally to all interfaces. This task describes how to attach the traffic policy to an interface.
Prerequisites
•
•
SUMMARY STEPS
1.
2.
3.
4.
5.
DETAILED STEPS
Configuring a Layer 7 FTP Command Inspection Policy
This section describes how to create a Layer 7 class map and policy map to be used for FTP command inspection by the VFW application, a security feature that prevents web browsers from sending embedded commands to the VFW application in FTP requests. Each FTP command must be acknowledged before the VFW application allows a new command. FTP inspection allows traffic by default and restricts traffic that fails the security checks. Command filtering allows you to restrict specific commands through the VFW application. When the VFW application denies a command, it closes the connection.
This task describes how to perform the following main procedures:
•
•
•
•
•
Note
•
•
•
Prerequisites
You must attach from the route processor to the VFW application before you can perform this task. See the "Attaching to the VFW Application" section on page VFC-14.
SUMMARY STEPS
Creates a Layer 7 class map for the inspection of FTP request commands
1.
2.
3.
4.
Creates and configures a Layer 7 policy map that enables FTP command inspection
5.
6.
7.
8.
or
mask-reply9.
Creates a Layer 3 and Layer 4 class map to classify network traffic for FTP command inspection
10.
11.
12.
Creates a Layer 3 and Layer 4 policy map and associates the Layer 7 FTP command inspection policy map
13.
14.
15.
16.
17.
Attaches the Layer 3 and Layer 4 traffic policy to an interface
18.
19.
20.
21.
DETAILED STEPS
Step 1
configure
Example:firewall/Admin# configure
Enter configuration commands, one per line. End with CNTL/Z.
firewall/Admin(config)#
Enters global configuration mode. You are now within configuration mode of the VFW application.
Step 2
class-map type ftp inspect match-any map_name
Example:firewall/Admin(config)# class-map type ftp inspect match-any FTP_INSPECT_L7CLASSfirewall/Admin(config-cmap-ftp-insp)#Creates a Layer 7 class map that is used for the inspection of FTP request commands.
Step 3
[line_number] match request-method ftp_commands
Example:firewall/Admin(config-cmap-ftp-insp)# match request-method mkdirConfigures the Layer 7 class map to define FTP request command inspection decisions through the VFW application. The match request-method command identifies the FTP commands that you want filtered by the VFW application. Possible ftp_commands include appe, cdup, dele, get, help, mkd, put, rmd, rnfr, rnto, site, stou, and syst.
Step 4
exit
Example:firewall/Admin(config-if-mgmt)# exit
firewall/Admin#
Exits class map configuration mode.
Step 5
policy-map type inspect ftp first-match map_name
Example:firewall/Admin(config)# policy-map type inspect ftp first-match FTP_INSPECT_L7POLICYCreates and configures a Layer 7 policy map that enables FTP command inspection.
•
•
Step 6
[line_number] match name request-method {appe | cdup | dele | get | help | mkd | put | rmd | rnfr | rnto | site | stou | syst}
Example:firewall/Admin(config-pmap-ftp-ins)# match FTP_REQUEST_MATCH request-method mkdirIncludes a single inline match criteria in the policy map without specifying a traffic class. The inline Layer 7 policy map match commands function the same as with the Layer 7 class map match commands. However, when you use an inline match command, you can specify an action for only a single match statement in the Layer 7 policy map.
Note
Step 7
class map_name
Example:firewall/Admin(config-pmap-ftp-ins)# class FTP_INSPECT_L7CLASSAssociates a class map defined in Step 2 with the Layer 7 policy map, and enters policy map class configuration mode for you to define the actions you want to apply.
Note
Step 8
deny
or
mask-replyExample:firewall/Admin(config-pmap-ftp-ins-c)# denyThe deny command denies the FTP request commands against the single inline match command or specified in the class map by resetting the FTP session.
The mask-reply command masks the system reply to the FTP SYST command by filtering sensitive information from the command output. This is applicable only to the FTP SYST command and its associated reply.
Step 9
exit
Example:firewall/Admin()# exit
firewall/Admin(config-pmap-ftp-ins)#
Exits policy map class configuration mode.
Step 10
class-map match-all map_name
Example:firewall/Admin(config)# class-map match-all FTP_INSPECT_L4CLASSfirewall/Admin(config-cmap)#
Creates a Layer 3 and Layer 4 class map to classify network traffic passing through the VFW application for FTP command inspection.
Step 11
[line_number] match port {tcp | udp} {any | eq port_number | range port1 port2}
Example:firewall/Admin(config-cmap)# match port tcp eq 21Specifies a match command as part of the Layer 3 and Layer 4 class map. Include one or more match commands as required. Refer to "Configuring a Layer 3 and Layer 4 Application Protocol Inspection Traffic Policy" section for a list of available match commands.
Step 12
exit
Example:firewall/Admin(config-cmap)# exit
firewall/Admin(config)#
Exits class map configuration mode.
Step 13
policy-map multi-match map_name
Example:firewall/Admin(config)# policy-map multi-match FTP_STRICT_INSPECT_L4POLICYCreates a Layer 3 and Layer 4 policy map and associates the Layer 7 FTP command inspection policy map to activate the operation.
Step 14
class map_name
Example:firewall/Admin(config-pmap)# class FTP_INSPECT_L4CLASSAssociates a class map defined in Step 10 with the Layer 7 FTP command inspection policy map, and enters policy map class configuration mode.
Step 15
inspect ftp [strict policy policy_map]
Example:firewall/Admin(config-pmap-c) inspect ftp strict policy FTP_INSPECT_L7POLICYSpecifies to examine the FTP protocol to verify the protocol behavior and identify unwanted or malicious traffic passing through the VFW application.
Step 16
exit
Example:firewall/Admin(config-pmap-c)# exit
firewall/Admin(config-pmap)#
Exits class map configuration mode.
Step 17
exit
Example:firewall/Admin(config-pmap)# exit
firewall/Admin(config)#
Exits policy map configuration mode.
Step 18
interface interface_name
Example:firewall/Admin(config)# interface management m1Enters interface configuration mode for an interface.
Step 19
service-policy input policy_name
Example:firewall/Admin(config-if)# service-policy input FTP_INSPECT_L4POLICYAttaches the Layer 3 and Layer 4 traffic policy to the firewall interface and specifies the direction in which the policy is applied.
Step 20
exit
Example:firewall/Admin(config-if)# end
firewall/Admin#
Exits interface configuration mode.
Step 21
copy running-config startup-config
Example:firewall/Admin# copy running-config startup-config
(Optional) Saves your configuration changes to flash memory.
Configuring a Layer 3 and Layer 4 Application Protocol Inspection Traffic Policy
This section describes how to create a Layer 3 and Layer 4 class map and policy map to classify network traffic passing through the VFW application to perform an applicable application protocol inspection traffic policy. The Layer 3 and Layer 4 traffic policy defines the Layer 3 and Layer 4 HTTP deep packet inspection, FTP command inspection, or application protocol inspection policy actions. Application inspection involves the examination of protocols such as DNS, FTP, HTTP, ICMP, and RTSP to verify the protocol behavior and identify unwanted or malicious traffic passing through the VFW application.
This task describes how to configure a Layer 3 and Layer 4 inspection traffic policy.
Prerequisites
You must attach from the route processor to the VFW application before you can perform this task. See the "Attaching to the VFW Application" section on page VFC-14.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
DETAILED STEPS
Step 1
configure
Example:firewall/Admin# configure
Enter configuration commands, one per line. End with CNTL/Z.
firewall/Admin(config)#
Enters global configuration mode. You are now within configuration mode of the VFW application.
Step 2
class-map [match-all | match-any] map_name
Example:firewall/Admin(config)# class-map match-all DNS_INSPECT_L4CLASSfirewall/Admin(config-cmap)#Creates a Layer 3 and Layer 4 class map to classify network traffic passing through the VFW application for DNS, FTP, HTTP, ICMP, and RTSP application protocol inspection.
•
•
Step 3
[line_number] match access-list identifier
Example:firewall/Admin(config-cmap)# match access-list INBOUND_ACL1(Optional) Configures the class map to filter Layer 3 and Layer 4 network traffic on a per-flow basis by using a predefined access control list. When a packet matches an entry in an access list, and if it is a permit entry, the VFW application allows the matching result. If it is a deny entry, the VFW application blocks the matching result. Refer to "Configuring Security Access Control Lists on the Virtual Firewall" for details about the creating access control lists.
Step 4
[line_number] match port {tcp | udp} {any | eq port_number | range port1 port2}
Example:firewall/Admin(config-cmap)# match port udp eq domainSpecifies a TCP or UDP port number or port range as the Layer 3 and Layer 4 network traffic matching criteria. Keywords and arguments are:
•
•
•
•
Step 5
exit
Example:firewall/Admin(config-cmap)# exit
firewall/Admin(config)#
Exits class map configuration mode.
Step 6
policy-map multi-match map_name
Example:firewall/Admin(config)# policy-map multi-match DNS_INSPECT_L4POLICYCreates and configures a Layer 3 and Layer 4 policy map.
Step 7
class map_name
Example:firewall/Admin(config-pmap)# class DNS_INSPECT_L4CLASSAssociates a class map defined in Step 2 with the Layer 3 and Layer 4 policy map, and enters policy map class configuration mode.
Step 8
inspect {dns [maximum-length bytes]} | {ftp [strict policy policy_map]} | {http [policy policy_map | url-logging]} | {icmp [error]} | rtsp
Example:firewall/Admin(config-pmap-c)# inspect dns maximum-length 1000Specifies to examine DNS, FTP, HTTP, ICMP or RTSP protocols to verify the protocol behavior and identify unwanted or malicious traffic passing through the VFW application.
Refer to the "Configuration Tips: Defining Layer 3 and Layer 4 Application Protocol Inspection Policy Actions" section for more information.
Step 9
exit
Example:firewall/Admin(config-pmap-c)# exit
firewall/Admin(config-pmap)#
Exits class map configuration mode.
Step 10
exit
Example:firewall/Admin(config-pmap)# exit
firewall/Admin(config)#
Exits policy map configuration mode.
Step 11
copy running-config startup-config
Example:firewall/Admin# copy running-config startup-config
(Optional) Saves your configuration changes to flash memory.
Table 13 lists the well-known TCP port numbers and key words.
Table 14 lists the well-known UDP port numbers and key words.
Configuration Tips: Defining Layer 3 and Layer 4 Application Protocol Inspection Policy Actions
Use the inspect command in policy map class configuration mode to define the Layer 3 and Layer 4 HTTP deep packet inspection, FTP command inspection, or application protocol inspection policy actions. Application inspection involves the examination of protocols such as DNS, FTP, HTTP, ICMP, and RTSP to verify the protocol behavior and identify unwanted or malicious traffic passing through the VFW application.
If you intend to perform Layer 7 application inspection of network traffic, first create a Layer 7 policy as described below:
•
•
You associate the Layer 7 policy map within the appropriate Layer 3 and Layer 4 policy map to provide an entry point for the traffic classification. Layer 7 policy maps are considered to be child policies and can be associated only within a Layer 3 and Layer 4 policy map. Only a Layer 3 and Layer 4 policy map can be applied to an interface or applied globally to all interfaces in the same context; a Layer 7 policy map cannot be directly applied on an interface.
Note
Applying a Traffic Policy to an Interface
After you have created a traffic policy, you must attach it to a single interface or globally to all interfaces. This task describes how to attach the traffic policy to an interface.
Prerequisites
•
•
SUMMARY STEPS
1.
2.
3.
4.
5.
DETAILED STEPS
Displaying Application Protocol Inspection Statistics and Service Policy Information
This task illustrates how to use the show commands that display application protocol inspection statistics and service policy configuration information. There is no particular order to the steps in this procedure.
Prerequisites
You must attach from the route processor to the VFW application before you can perform this task. See the "Attaching to the VFW Application" section on page VFC-14.
SUMMARY STEPS
1.
2.
3.
4.
DETAILED STEPS
Examples
The following example illustrates sample output from the show stats inspect http command:
firewall/Admin# show stats inspect http+------------------------------------------++--------- HTTP Inspect statistics --------++------------------------------------------+Total request/response : 0Total allow decisions : 0Total drop decisions : 0Total logging decisions : 0The following example displays service policy statistics for the HTTP_INSPECT_L4POLICY policy map:
firewall/Admin# show service-policy HTTP_INSPECT_L4POLICYStatus : ACTIVEDescription: HTTP protocol deep inspection of incoming traffic-----------------------------------------Interface: management ctx1service-policy: HTTP_INSPECT_L4POLICYclass: HTTP_INSPECT_L4CLASSinspect http:curr conns : 0 , hit count : 0dropped conns : 0client pkt count : 0 , client byte count: 0server pkt count : 0 , server byte count: 0L4 policy stats:TotalReq/Resp: 0 TotalAllowed: 0TotalDropped : 0 TotalLogged : 0L7 policy: HTTP_INSPECT_L7POLICY, url logging: disabledL7 policy stats: Total number of L7 rules 1L7 class/match HTTP_INSPECT_L7CLASS: resetTotalInspected : 0 TotalMatched: 0TotalDroppedOnError: 0 TotalLogged : 0The following example displays service policy statistics for the FTP_INSPECT_L4POLICY policy map:
firewall/Admin# show service-policy FTP_INSPECT_L4POLICYStatus : ACTIVEDescription: FTP command inspection of incoming traffic-----------------------------------------Context Global Policy:service-policy: FTP_INSPECT_L4POLICYclass: class-defaultinspect ftp:strict ftp: ENABLEDcurr conns : 0 , hit count : 0dropped conns : 0client pkt count : 0 , client byte count: 0server pkt count : 0 , server byte count: 0L7 policy: FTP_INSPECT_L4POLICYTotalReplyMasked : 0 TotalDropped: 0The following example displays service policy statistics for the APP_INSPECT_L4POLICY policy map:
firewall/Admin# show service-policy APP_INSPECT_L4POLICYStatus : ACTIVE-----------------------------------------Context Global Policy:service-policy: APP_INSPECT_L4POLICYclass: APP_INSPECT_L4CLASSinspect dns:max length: 0curr conns : 0 , hit count : 0dropped conns : 0client pkt count : 0 , client byte count: 0server pkt count : 0 , server byte count: 0How to Configure an HTTP Parameter Map for Use in a Layer 3 and Layer 4 Policy Map
•
Configuring an HTTP Parameter Map
A parameter map is a means to combine related actions for use in a Layer 3 and Layer 4 HTTP deep packet inspection policy map. You reference this parameter map in the appl-parameter command in policy map class configuration mode. This task describes how to configure an HTTP parameter map.
Prerequisites
You must attach from the route processor to the VFW application before you can perform this task. See the "Attaching to the VFW Application" section on page VFC-14.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
DETAILED STEPS
Configuration Examples for Application Protocol Inspection
This section provides the following configuration examples:
•
•
Layer 7 HTTP Deep Inspection Policy Configuration: Example
The following example illustrates how to configure Layer 7 HTTP deep inspection:
Create a Layer 7 class map that is used for the deep packet inspection of HTTP traffic
firewall/Admin# configurefirewall/Admin(config)# class-map type http inspect match-any HTTP_INSPECT_L7CLASSfirewall/Admin(config-cmap-http-insp)# match header length request eq 200firewall/Admin(config-cmap-http-insp)# match header Host header-value .*mycompanyexample.comfirewall/Admin(config-cmap-http-insp)# match url length eq 10000firewall/Admin(config-cmap-http-insp)# match url .*.gifCreate and configure a Layer 7 policy map that enables deep packet inspection of the HTTP protocol
firewall/Admin(config)# policy-map type inspect http all-match HTTP_INSPECT_L7POLICYfirewall/Admin(config-pmap-ins-http)# class HTTP_INSPECT_L7CLASSfirewall/Admin(config-pmap-ins-http-c)# permitfirewall/Admin(config-pmap-ins-http-c)# exitfirewall/Admin(config-pmap-ins-http)# exitfirewall/Admin(config)#Configure Layer 3 and Layer 4 class map to classify network traffic for HTTP deep packet inspection
firewall/Admin(config)# class-map match-all HTTP_INSPECT_L4CLASSfirewall/Admin(config-cmap)# description HTTP protocol deep inspection of incoming trafficfirewall/Admin(config-cmap)# match port tcp eq 80firewall/Admin(config-cmap)# exitfirewall/Admin(config)#Create a Layer 3 and Layer 4 policy map and associate the Layer 7 HTTP deep packet inspection policy map
firewall/Admin(config)# policy-map multi-match HTTP_INSPECT_L4POLICYfirewall/Admin(config-pmap)# class HTTP_INSPECT_L4CLASSfirewall/Admin(config-pmap-c)# inspect http policy HTTP_INSPECT_L7POLICYfirewall/Admin(config-pmap-c)# exitfirewall/Admin(config-pmap)# exitfirewall/Admin(config)#Attach the Layer 3 and Layer 4 traffic policy to an interface
firewall/Adminhost1/Admin(config)# interface interface_namefirewall/Admin(config-if)# service-policy input HTTP_INSPECT_L4POLICYLayer 7 FTP Inspection Policy Configuration: Example
The following example illustrates how to configure Layer 7 FTP inspection:
Create a Layer 7 class map for the inspection of FTP request commands
firewall/Admin# configurefirewall/Admin(config)# class-map type ftp inspect match-any FTP_INSPECT_L7CLASSfirewall/Admin(config-cmap-ftp-insp)# match request-method mkdirfirewall/Admin(config-cmap-ftp-insp)# exitfirewall/Admin(config)#Create and configure a Layer 7 policy map that enables FTP command inspection
firewall/Admin(config)# policy-map type inspect ftp first-match FTP_INSPECT_L7POLICYfirewall/Admin(config-pmap-ftp-ins)# class FTP_INSPECT_L7CLASSfirewall/Admin(config-pmap-ftp-ins-c)# denyfirewall/Admin(config-pmap-ftp-ins-c)# exitfirewall/Admin(config)#Create a Layer 3 and Layer 4 class map to classify network traffic passing through the VFW application for FTP command inspection
firewall/Admin(config)# class-map match-all FTP_INSPECT_L4CLASSfirewall/Admin(config-cmap)# description FTP command inspection of incoming trafficfirewall/Admin(config-cmap)# match port tcp eq 21firewall/Admin(config-cmap)# exitfirewall/Admin(config)#Create a Layer 3 and Layer 4 policy map and associate the Layer 7 FTP command inspection policy map
firewall/Admin(config)# policy-map multi-match FTP_STRICT_INSPECT_L4POLICYfirewall/Admin(config-pmap)# class FTP_INSPECT_L4CLASSfirewall/Admin(config-pmap-c) inspect ftp strict policy FTP_INSPECT_L7POLICYfirewall/Admin(config-pmap-c) #exitfirewall/Admin(config) #Attach the Layer 3 and Layer 4 traffic policy to an interface
firewall/Admin(config)# interface interface_namefirewall/Admin(config-if)# service-policy input FTP_INSPECT_L4POLICYAdditional References
The following sections provide references related to application protocol inspection.
Related Documents
Standards
No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature.
—
MIBs
—
To locate and download MIBs using Cisco IOS XR software, use the Cisco MIB Locator found at the following URL and choose a platform under the Cisco Access Products menu: http://cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml
RFCs
No new or modified RFCs are supported by this feature, and support for existing RFCs has not been modified by this feature.
—
Technical Assistance
