The PIX Firewall ASA performs stateful application
inspection to provide secure use of external applications and services. In some
cases, this involves monitoring for and defending against threatening traffic
patterns or activity. In other cases, application inspection is used to
facilitate outside connections for specific protocols.
Establishing and maintaining outside connections is easy enough
with many applications because all address and port information is established
by the inside client in its initial transmission to the outside host. But some
sessions require special attention from the PIX Firewall application inspection
function. Specifically, those applications and protocols that embed IP address
information in the data portion of the packet or those that open additional
channels on dynamically assigned ports create impossible problems for standard
access list filtering.
Because the application inspection feature can look at the upper
layer portions of the packet, it can work with NAT to identify embedded address
information. NAT can then translate those embedded addresses and, equally
important, update any checksum or other fields affected by the translation.
Without this attention to detail, the packets could easily be rejected by the
destination host or the firewall.
Note, like CBAC in Chapter 6, this application-inspection function is
meticulously programmed for a limited number of common programs or protocols.
Application inspection uses upper-level field information and a knowledge of the
application/protocols processes to make “informed” decisions about what’s
expected and what returning traffic should be allowed.
This application-aware capability allows application
inspection to monitor and permit dynamic port number usage by those supported
protocols that open additional TCP or UDP ports to improve performance. These
applications use the initial session well-known port numbers to negotiate
additional dynamically assigned port numbers, which are then opened by the PIX
for only the life of the session. The alternative would be the permanent opening
of ranges of port numbers and the inherent vulnerability associated with
that.
Sections
Comments (0 posted)
Syndication
