vTCP for ALG Support
First Published: July 23, 2010
First Published: July 23, 2010
Virtual Transport Control Protocol (vTCP) functionality provides a framework for various Application Layer Gateway (ALG) protocols to appropriately handle the Transport Control Protocol (TCP) segmentation and parse the segments in the Cisco firewall, Network Address Translation (NAT) and other applications.
Finding Feature Information
Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the "Feature Information for vTCP for ALG Support" section.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Contents
•Prerequisites for vTCP for ALG Support
•Restrictions for vTCP for ALG Support
•Information About vTCP for ALG Support
•How to Configure vTCP for ALG Support
•Configuration Examples for vTCP for ALG Support
•Additional References
•Feature Information for vTCP for ALG Support
Prerequisites for vTCP for ALG Support
Your system must be running Cisco IOS XE Release 3.1 or a later Cisco IOS XE software release. The latest version of NAT or firewall ALG should be configured.
Restrictions for vTCP for ALG Support
vTCP does not support data channel traffic. To protect system resources vTCP does not support reassembled messages larger than 8K.
vTCP does not support Hardware Availability (HA) functionality. HA mainly relies on the firewall or NAT to sync session information to the standby forwarding engine.
Supported ALGs
vTCP currently supports Real Time Streaming Protocol (RTSP) and Domain Name System (DNS) protocols. vTCP support for Session Initiation Protocol (SIP), H323, and Skinny protocols will be added in future releases.
Information About vTCP for ALG Support
•vTCP for ALG Support Overview
•vTCP Relation with NAT/Firewall and ALG
vTCP for ALG Support Overview
When a Layer 7 protocol uses TCP for transportation, the payload can be segmented due to various reasons, such as Maximum Segment Size (MSS), application design, TCP window size, and so forth. Proper recognition of these TCP segments is required to perform the parsing. Therefore, a generic framework called vTCP is used by various ALGs to tackle TCP segmentation.
Some applications like SIP and NAT require the entire payload to rewrite the embedded data. In addition to this, current ALGs are not developed to take into account the data splitting between the packets that are required for the firewall. Therefore, vTCP is also required for the firewall without any changes to the current ALGs. NAT and the firewall ALG configuration activates the vTCP functionality.
TCP Acknowledgment and Reliable Transmission
Because vTCP resides between two TCP hosts, buffer space is required to store TCP segments temporarily, before they are sent to the other hosts. During this process vTCP ensures that data transmission occurs properly between the hosts. To achieve this, vTCP uses the TCP acknowledgment (ACK) to the sending host if it requires more data. On the other side of the process, vTCP keeps track of the ACKs sent by the receiving host from the beginning of the TCP flow to closely monitor the acknowledged data.
vTCP reassembles the TCP segments. The IP and the TCP header information of the incoming segments are saved in the vTCP buffer for reliable transmission.
There can be minor changes in the length of the outgoing segments for NAT-enabled applications. vTCP can either squeeze the additional length of data to the last segment or create a new segment to carry the extra data. The IP or TCP header content of the newly created segment is derived from the original incoming segment. The total length of the IP header and the TCP header sequence number are adjusted accordingly.
vTCP Relation with NAT/Firewall and ALG
ALG is a subcomponent of NAT and the firewall. Both NAT and the firewall have a framework to dynamically couple their ALGs. When the firewall performs the L7 inspection or NAT performs the L7 fix-up, the parser function registered by ALG is called and the ALG takes over packet inspection. vTCP is interposed between NAT or the firewall and the ALGs that use these applications. In other words, the packets are first processed by vTCP and then passed on to the ALGs. vTCP reassembles the TCP segments in both directions within a TCP connection.
How to Configure vTCP for ALG Support
The RTSP, DNS, NAT, and the firewall configurations enable vTCP functionality by default. Therefore no new configuration is required to enable vTCP functionality.
•Enabling RTSP on Cisco ASR 1000 Series Routers to Activate vTCP
Enabling RTSP on Cisco ASR 1000 Series Routers to Activate vTCP
Perform this task to enable RTSP packet inspection.
SUMMARY STEPS
1. enable
2. configure terminal
3. class-map type inspect match-any class-map-name
4. match protocol protocol-name
5. exit
6. policy-map type inspect policy-map-name
7. class type inspect class-map-name
8. inspect
9. class class-default
10. exit
11. exit
12. zone security zone-name1
13. exit
14. zone security zone-name2
15. exit
16. zone-pair security zone-pair-name source source-zone-name destination destination-zone-name
17. service-policy type inspect policy-map-name
18. exit
19. interface type number
20. zone-member security zone-name1
21. exit
22. interface type number
23. zone-member security zone-name2
24. end
DETAILED STEPS
|
|
|
Step 1 |
enable
Router> enable |
Enables privileged EXEC mode. •Enter your password if prompted. |
Step 2 |
configure terminal
Router# configure terminal |
Enters global configuration mode. |
Step 3 |
class-map type inspect match-any class-map-name
Router(config)# class-map type inspect match-any rtsp_class1 |
Creates an inspect type class map and enters class-map configuration mode. |
Step 4 |
match protocol protocol-name
Router(config-cmap)# match protocol rtsp |
Configures the match criteria for a class map on the basis of the named protocol. •Use DNS in place of RTSP to configure DNS as the match protocol. |
Step 5 |
exit
Router(config-cmap)# exit |
Returns to global configuration mode. |
Step 6 |
policy-map type inspect policy-map-name
Router(config)# policy-map type inspect rtsp_policy |
Creates an inspect type policy map and enters policy-map configuration mode. |
Step 7 |
class type inspect class-map-name
Router(config-pmap)# class type inspect rtsp_class1 |
Specifies the class on which the action is performed and enters policy-map-class configuration mode. |
Step 8 |
inspect
Router(config-pmap-c)# inspect |
Enables stateful packet inspection. |
Step 9 |
class class-default
Router(config-pmap-c)# class class-default |
Specifies that these policy map settings apply to the predefined default class. If traffic does not match any of the match criteria in the configured class maps, it is directed to the predefined default class. |
Step 10 |
exit
Router(config-pmap-c)# exit |
Returns to policy-map configuration mode. |
Step 11 |
exit
Router(config-pmap)# exit |
Returns to global configuration mode. |
Step 12 |
Router(config)# zone security private |
Creates a security zone to which interfaces can be assigned and enters security-zone configuration mode. |
Step 13 |
exit
Router(config-sec-zone)# exit |
Returns to global configuration mode. |
Step 14 |
Router(config)# zone security public |
Creates a security zone to which interfaces can be assigned and enters security-zone configuration mode. |
Step 15 |
exit
Router(config-sec-zone)# exit |
Returns to global configuration mode. |
Step 16 |
zone-pair security zone-pair-name source
source-zone-name destination destination-zone-name
Router(config)# zone-pair security pair-two source private destination public |
Creates a pair of security zones and enters security-zone-pair configuration mode. •To apply a policy, you must configure a zone pair. |
Step 17 |
service-policy type inspect policy-map-name
Router(config-sec-zone-pair)# service-policy rtsp_policy |
Attaches a firewall policy map to the destination zone pair. •If a policy is not configured between a pair of zones, traffic is dropped by default. |
Step 18 |
exit
Router(config-sec-zone-pair)# exit |
Returns to global configuration mode. |
Step 19 |
Router(config)# GigabitEthernet0/1/0 |
Specifies an interface for configuration. •Enters interface configuration mode. |
Step 20 |
zone-member security zone-name1
Router(config-if)# zone-member security private |
Assigns an interface to a specified security zone. •When you make an interface a member of a security zone, all traffic into and out of that interface (except traffic bound for the router or initiated by the router) is dropped by default. To let traffic through the interface, you must make the zone part of a zone pair to which you apply a policy. If the policy permits traffic, traffic can flow through that interface. |
Step 21 |
exit
Router(config-if)# exit |
Returns to global configuration mode. |
Step 22 |
Router(config)# GigabitEthernet0/1/0 |
Specifies an interface for configuration. •Enters interface configuration mode. |
Step 23 |
zone-member security zone-name
Router(config-if)# zone-member security public |
Assigns an interface to a specified security zone. •When you make an interface a member of a security zone, all traffic into and out of that interface (except traffic bound for the router or initiated by the router) is dropped by default. To let traffic through the interface, you must make the zone part of a zone pair to which you apply a policy. If the policy permits traffic, traffic can flow through that interface. |
Step 24 |
end
Router(config-if)# end |
Returns to privileged EXEC mode. |
Troubleshooting Tips
The following commands can be used to troubleshoot your RTSP-enabled configuration:
•clear zone-pair
•show policy-map type inspect zone-pair
•show zone-pair security
Configuration Examples for vTCP for ALG Support
•Example: RTSP Configuration on Cisco ASR 1000 Series Routers
Example: RTSP Configuration on Cisco ASR 1000 Series Routers
The following example shows how to configure the Cisco ASR 1000 Series Routers to enable RTSP inspection:
class-map type inspect match-any rtsp_class1
match protocol rtsp
policy-map type inspect rtsp_policy
class type inspect rtsp_class1
zone-pair security pair-two source private destination public
service-policy type inspect rtsp_policy
interface GigabitEthernet0/1/0
ip address 10.0.0.1 255.0.0.0
zone-member security private
interface GigabitEthernet0/1/1
ip address 10.0.1.1 255.0.0.0
zone-member security public
Additional References
Related Documents
MIBs
|
|
None |
To locate and download MIBs for selected platforms, Cisco software releases, and feature sets, use Cisco MIB Locator found at the following URL: http://www.cisco.com/go/mibs |
RFCs
|
|
RFC 793 |
Transport Control Protocol |
RFC 813 |
Window and Acknowledge Strategy in TCP |
Technical Assistance
|
|
The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password. |
http://www.cisco.com/cisco/web/support/index.html |
Feature Information for vTCP for ALG Support
Table 1 lists the features in this module and provides links to specific configuration information.
Use Cisco Feature Navigator to find information about platform support and software image support. Cisco Feature Navigator enables you to determine which software images support a specific software release, feature set, or platform. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Note Table 1 lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.
Table 1 Feature Information for vTCP for ALG Support
|
|
|
vTCP for ALG Support |
Cisco IOS XE Release 3.1S |
This functionality provides an enhancement to handle the TCP segmentation and reassembling for the firewall and NAT ALGs, in Cisco IOS XE software on the Cisco ASR 1000 Series Routers. |
Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1005R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.
© 2010 Cisco Systems, Inc. All rights reserved.