Cisco Systems OL-16647-01 Configuring Application Inspection

24-4
Cisco ASDM User Guide
OL-16647-01
Chapter 24 Configuring Application Layer Protocol Inspection
Configuring Application Inspection
Configuring Application Inspection
This feature uses Security Policy Rules. Service policies provide a consistent and flexible way to
configure security appliance features. For example, you can use a service policy to create a timeout
configuration that is specific to a particular TCP application, as opposed to one that applies to all TCP
applications. See Chapter 22, “Configuring Service Policy Rules,” for more information.
Inspection is enabled by default for some applications. See the “Default Inspection Policy” section for
more information. Use this section to modify your inspection policy.
NetBIOS Name
Server over IP
UDP/137,
138 (Source
ports)
— — NetBIOS is supported by performing
NAT of the packets for NBNS UDP port
137 and NBDS UDP port 138.
PPTP TCP/1723 — RFC 2637 —
RADIUS
Accounting
1646 — RFC 2865 —
RSH TCP/514 No PAT Berkeley UNIX —
RTSP TCP/554 No PAT.
No outside NAT.
RFC 2326, 2327,
1889
No handling for HTTP cloaking.
SIP TCP/5060
UDP/5060
No outside NAT.
No NAT on same security
interfaces.
RFC 2543 —
SKINNY
(SCCP)
TCP/2000 No outside NAT.
No NAT on same security
interfaces.
— Does not handle TFTP uploaded Cisco
IP Phone configurations under certain
circumstances.
SMTP and
ESMTP
TCP/25 — RFC 821, 1123 —
SNMP UDP/161,
162
No NAT or PAT. RFC 1155, 1157,
1212, 1213, 1215
v.2 RFC 1902-1908; v.3 RFC
2570-2580.
SQL*Net TCP/1521 — — v.1 and v.2.
Sun RPC over
UDP and TCP
UDP/111 No NAT or PAT. — The default rule includes UDP port 111;
if you want to enable Sun RPC
inspection for TCP port 111, you need
to create a new rule that matches TCP
port 111 and performs Sun RPC
inspection.
TFTP UDP/69 — RFC 1350 Payload IP addresses are not translated.
XDCMP UDP/177 No NAT or PAT. — —
1. Inspection engines that are enabled by default for the default port are in bold.
2. The security appliance is in compliance with these standards, but it does not enforce compliance on packets being inspected. For example, FTP commands
are supposed to be in a particular order, but the security appliance does not enforce the order.
Table 24-1 Supported Application Inspection Engines (continued)
Application1Default Port NAT Limitations Standards2Comments