Define Inspection Rules

TCP and UDP Inspection

Configuring TCP and UDP inspection will permit any TCP and UDP packets to enter the internal network through the firewall, even if the application-layer protocol isn’t configured to be inspected. TCP and UDP inspection doesn’t recognize application-specific commands or processes and might not permit all returning packets for that application. Any returning application packets with port numbers different than the exiting packet will be blocked.

Generic TCP and UDP inspection is much like reflexive ACLs, in that the packets entering the network must exactly match an existing session. This match is based on having the same source/destination addresses and source/destination port numbers as the existing packet, except reversed. Otherwise, the inbound packets are blocked at the interface.

The following example causes the software to inspect TCP sessions and UDP sessions, and to specifically allow FTP and Real Audio traffic back through the firewall for existing sessions only. UDP traffic has the audit-trail feature on, while the FTP timeout is changed to three minutes.

Rtr1(config)#ip inspect name letusin tcp
Rtr1(config)#ip inspect name letusin udp audit-trail on
Rtr1(config)#ip inspect name letusin ftp timeout 180
Rtr1(config)#ip inspect name letusin realaudio-video

HTTP Inspection (Java Blocking)

With the proliferation of Java applets available on the Internet, protecting networks from malicious applets has become a major concern to network managers. The Java blocking feature can be configured either to filter or to completely deny access to Java applets.

Java inspection enables Java applet filtering at the firewall. Java applet filtering distinguishes between trusted and untrusted applets by relying on a list of external sites you designate as “friendly.” If an applet is from a friendly site, the firewall allows the applet through. If the applet isn’t from a friendly site, the applet is blocked. Alternatively, you could permit applets from all sites, except sites specifically designated as “hostile.”

Java blocking uses only numbered standard access lists to define friendly and hostile external sites. ACL “permit” statements define traffic from friendly sites, while ACL “deny statements” define traffic from hostile sites. If Java blocking is defined using an ACL number and no matching ACL exists, all Java applets will be blocked.

Use the no form of the command to remove Java blocking from the inspection set. The syntax is

Rtr1(config)#ip inspect name inspection-name [http [java-list acl#]] [alert {on | off}]
[audit-trail {on | off}] [timeout seconds]

Rtr1(config)#no ip inspect name inspection-name http

The next example would add blocking of all Java applets to the inspection set.

Rtr1(config)#ip inspect name letusin http

If the next example was used instead, all Java applets would be blocked except those originating from the server 192.168.0.10.

Rtr1(config)#access-list 15 permit 192.168.0.10
Rtr1(config)#ip inspect name letusin http java-list 15

Fragment Inspection (DoS Attacks)

Using fragmentation inspection, the CBAC maintains an interfragment state for IP traffic. Noninitial fragments are discarded unless the corresponding initial fragment has already been permitted to pass through the firewall. Noninitial fragments received before the corresponding initial fragments are discarded. Because many circumstances exist that can cause out-of-order delivery of legitimate fragments, fragmentation inspection can have a severe performance implications. For this reason, fragment inspection is off by default.

Use the no form of the command to remove fragment inspection from the inspection set. The syntax is

Rtr1(config)#ip inspect name inspection-name fragment [max number timeout seconds]

Rtr1(config)#no ip inspect name inspection-name fragment

Even if the system is under heavy attack from fragmented packets, legitimate fragmented traffic, if any, will still get some fraction of the firewall’s fragment state resources and, more important, regular unfragmented traffic can pass through the firewall unimpeded.

The following example adds fragment checking to that software inspection set. The firewall will allocate 100 state structures, meaning 100 initial fragments for 100 different packets sent through the router can be stored before new ones must be discarded. The timeout value for dropping unassembled packets is set to four seconds.

Rtr1(config)#ip inspect name letusin fragment max 100 timeout 4

SMTP Inspection

Use the no form of the command to remove fragment inspection from the inspection set. The syntax is

Rtr1(config)#ip inspect name inspection-name smtp [alert {on | off}] [audit-trail {on | off}] [timeout seconds]
Rtr1(config)#no ip inspect name inspection-name smtp

The following example adds SMTP inspection with default audit-trail and alert setting.

Rtr1(config)#ip inspect name letusin smtp