Udp/Icmp Security; Upper Layer Protocols - Nortel BSR252 Configuration - Basics

UDP/ICMP security

UDP and ICMP do not contain any connection information (such as sequence
numbers). However, at the very minimum, they contain an IP address pair (source
and destination). UDP also contains port pairs, and ICMP has type and code
information. All of this data can be analyzed in order to build virtual connections
in the cache.
For instance, any UDP packet that originates on the LAN creates a cache entry. Its
IP address and port pairs are stored. For a short period of time, UDP packets from
the WAN that have matching IP and UDP information are allowed back in
through the firewall.
A similar situation exists for ICMP, except that the Business Secure Router is
even more restrictive. Specifically, only outgoing echoes allow incoming echo
replies, outgoing address mask requests allow incoming address mask replies, and
outgoing timestamp requests allow incoming timestamp replies. No other ICMP
packets are allowed in through the firewall, simply because they are too
dangerous and contain too little tracking information. For instance, ICMP redirect
packets are never allowed in, since they can be used to reroute traffic through
attacking machines.

Upper layer protocols

Some higher layer protocols (such as FTP and RealAudio) utilize multiple
network connections simultaneously. In general terms, they usually have a control
connection, which is used for sending commands between endpoints, and then
data connections, which are used for transmitting bulk information.
Consider the FTP protocol. A user on the LAN opens a control connection to a
server on the Internet and requests a file. At this point, the remote server opens a
data connection from the Internet. For FTP to work properly, this connection must
be allowed to pass through even though a connection from the Internet is normally
rejected.
In order to achieve the above scenario, the Business Secure Router inspects the
application level FTP data. Specifically, it searches for outgoing PORT
commands, and when it sees these; it adds a cache entry for the anticipated data
connection. This can be done safely, since the PORT command contains address
and port information, which can be used to uniquely identify the connection.
Nortel Business Secure Router 252 Configuration — Basics
Chapter 10 Firewalls 165