Cisco Systems TFTP Inspection

10-35
Cisco ASA Series Firewall CLI Configuration Guide
Chapter10 Configuring Inspection of Basic Internet Protocols
TFTP Inspection
Step6 To configure parameters that affect the inspection engine, perform the following steps:
a. To enter parameters configuration mode, enter the following command:
ciscoasa(config-pmap)# parameters
ciscoasa(config-pmap-p)#
b. To configure a local domain name, enter the following command:
ciscoasa(config-pmap-p)# mail-relay domain-name action [drop-connection | log]]
Where the drop-connection action closes the connection. The log action sends a system log
message when this policy map matches traffic.
c. To enforce banner obfuscation, enter the following command:
ciscoasa(config-pmap-p)# mask-banner
The following example shows how to define an ESMTP inspection policy map.
ciscoasa(config)# regex user1 “user1@cisco.com”
ciscoasa(config)# regex user2 “user2@cisco.com”
ciscoasa(config)# regex user3 “user3@cisco.com”
ciscoasa(config)# class-map type regex senders_black_list
ciscoasa(config-cmap)# description “Regular expressions to filter out undesired senders”
ciscoasa(config-cmap)# match regex user1
ciscoasa(config-cmap)# match regex user2
ciscoasa(config-cmap)# match regex user3
ciscoasa(config)# policy-map type inspect esmtp advanced_esmtp_map
ciscoasa(config-pmap)# match sender-address regex class senders_black_list
ciscoasa(config-pmap-c)# drop-connection log
ciscoasa(config)# policy-map outside_policy
ciscoasa(config-pmap)# class inspection_default
ciscoasa(config-pmap-c)# inspect esmtp advanced_esmtp_map
ciscoasa(config)# service-policy outside_policy interface outside
TFTP Inspection
TFTP inspection is enabled by default.
TFTP, described in RFC 1350, is a simple protocol to read and write files between a TFTP server and
client.
The ASA inspects TFTP traffic and dynamically creates connections and translations, if necessary, to
permit file transfer between a TFTP client and server. Specifically, the inspection engine inspects TFTP
read request (RRQ), write request (WRQ), and error notification (ERROR).
A dynamic secondary channel and a PAT translation, if necessary, are allocated on a reception of a valid
read (RRQ) or write (WRQ) request. This secondary channel is subsequently used by TFTP for file
transfer or error notification.
Only the TFTP server can initiate traffic over the secondary channel, and at most one incomplete
secondary channel can exist between the TFTP client and server. An error notification from the server
closes the secondary channel.
TFTP inspection must be enabled if static PAT is used to redirect TFTP traffic.