Cisco ASA 5506-X Configuration Manual page 231

Inspection of Database and Directory Protocols
The following topics explain application inspection for database and directory protocols. For
information on why you need to use inspection for certain protocols, and the overall methods for
applying inspection, see
•
•
•
ILS Inspection
The ILS inspection engine provides NAT support for Microsoft NetMeeting, SiteServer, and Active
Directory products that use LDAP to exchange directory information with an ILS server.
The ASA supports NAT for ILS, which is used to register and locate endpoints in the ILS or SiteServer
Directory. PAT cannot be supported because only IP addresses are stored by an LDAP database.
For search responses, when the LDAP server is located outside, NAT should be considered to allow
internal peers to communicate locally while registered to external LDAP servers. For such search
responses, xlates are searched first, and then DNAT entries to obtain the correct address. If both of these
searches fail, then the address is not changed. For sites using NAT 0 (no NAT) and not expecting DNAT
interaction, we recommend that the inspection engine be turned off to provide better performance.
Additional configuration may be necessary when the ILS server is located inside the ASA border. This
would require a hole for outside clients to access the LDAP server on the specified port, typically TCP
389.
Because ILS traffic (H225 call signaling) only occurs on the secondary UDP channel, the TCP
Note
connection is disconnected after the TCP inactivity interval. By default, this interval is 60 minutes and
can be adjusted using the TCP timeout command. In ASDM, this is on the Configuration > Firewall >
Advanced > Global Timeouts pane.
ILS/LDAP follows a client/server model with sessions handled over a single TCP connection.
Depending on the client's actions, several of these sessions may be created.
During connection negotiation time, a BIND PDU is sent from the client to the server. Once a successful
BIND RESPONSE from the server is received, other operational messages may be exchanged (such as
ADD, DEL, SEARCH, or MODIFY) to perform operations on the ILS Directory. The ADD REQUEST
Getting Started with Application Layer Protocol Inspection, page
ILS Inspection, page 9-1
SQL*Net Inspection, page 9-2
Sun RPC Inspection, page 9-3
C H A P T E R
Cisco ASA Series Firewall CLI Configuration Guide
9
6-1.
9-1