The Sun remote-procedure call (RPC) application-level gateway (ALG) performs a deep packet inspection of the Sun RPC protocol.
The Sun RPC ALG works with a provisioning system that allows network administrators to configure match filters. Each match
filter define a match criterion that is searched in a Sun RPC packet, thereby permitting only packets that match the criterion.
In an RPC, a client program calls procedures in a server program. The RPC library packages the procedure arguments into a
network message and sends the message to the server. The server, in turn, uses the RPC library and takes the procedure arguments
from the network message and calls the specified server procedure. When the server procedure returns to the RPC, return values
are packaged into a network message and sent back to the client.
For a detailed description of the Sun RPC protocol, see RFC 1057,
RPC: Remote Procedure Call Protocol Specification Version 2.
Sun RPC ALG Support for Firewalls
You can configure the Sun RPC ALG by using the zone-based firewall that is created by using policies and class maps. A Layer
7 class map allows network administrators to configure match filters. The filters specify the program numbers to be searched
for in Sun RPC packets. The Sun RPC Layer 7 policy map is configured as a child policy of the Layer 4 policy map with the
When you configure a Sun RPC Layer 4 class map without configuring a Layer 7 firewall policy, the traffic returned by the
Sun RPC passes through the firewall, but sessions are not inspected at Layer 7. Because sessions are not inspected, the subsequent
RPC call is blocked by the firewall. Configuring a Sun RPC Layer 4 class map and a Layer 7 policy allows Layer 7 inspection.
You can configure an empty Layer 7 firewall policy, that is, a policy without any match filters.
Sun RPC ALG Support for NAT
By default, the Sun RPC ALG is automatically enabled when Network Address Translation (NAT) is enabled. You can use the
no ip nat service alg command to disable the Sun RPC ALG on NAT.