Chapter 22 Applying Application Layer Protocol Inspection - Cisco 7604 Configuration Manual

Applying Application Layer Protocol Inspection
This chapter describes how to configure application layer protocol inspection. Inspection engines are
required for services that embed IP addressing information in the user data packet or that open secondary
channels on dynamically assigned ports. These protocols require the FWSM to perform a deep packet
inspection instead of passing the packet through the accelerated path (see the
Overview" section on page 1-8
engines can affect overall throughput.
Several common inspection engines are enabled on the FWSM by default, but you might need to enable
others depending on your network. This chapter includes the following sections:
Inspection Engine Overview, page 22-2
•
–
–
–
–
• Configuring Application Inspection, page 22-6
CTIQBE Inspection, page 22-10
•
DCERPC Inspection, page 22-16
•
DNS Inspection, page 22-18
•
ESMTP Inspection, page 22-26
•
FTP Inspection, page 22-30
•
GTP Inspection, page 22-35
•
H.323 Inspection, page 22-47
•
HTTP Inspection, page 22-60
•
ICMP Inspection, page 22-64
•
• ILS Inspection, page 22-64
• MGCP Inspection, page 22-65
• NetBIOS Inspection, page 22-72
PPTP Inspection, page 22-73
•
RSH Inspection, page 22-73
•
RTSP Inspection, page 22-73
•
SIP Inspection, page 22-76
•
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM
OL-20748-01
for more information about the accelerated path). As a result, inspection
When to Use Application Protocol Inspection, page 22-2
How Inspection Engines Work, page 22-2
Inspection Limitations, page 22-3
Default Inspection Policy, page 22-4
22
C H A P T E R
"Stateful Inspection
22-1