Table of Contents
Advertisement
Command Reference Guide
ipv6 firewall check ftp-bounce
Use the ipv6 firewall check ftp-bounce command enable the File Transfer Protocol (FTP) bounce attack
check for the Internet Protocol version 6 (IPv6) firewall. Use the no form of this command to disable the
FTP bounce attack check. Variations of this command include:
ipv6 firewall check ftp-bounce
ipv6 firewall vrf <name> check ftp-bounce
Syntax Description
vrf <name>
Default Values
By default, FTP bounce attack check is enabled on the IPv6 firewall.
Command History
Release R10.1.0
Functional Notes
In addition to allowing the flow of IPv6 FTP traffic through the IPv6 firewall, the IPv6 FTP application-level
gateway (ALG) can be used to protect against FTP bounce attacks. An FTP bounce attack is a network
attack where malicious hosts using proxy FTP can target a specific well-known service on one server
(Server A) by instructing another FTP server (Server B) to send a file to Server A that contains commands
relevant to the service being attacked. For example, this can allow a malicious host to forge mail on Server
A without making a direct connection. The lack of a direct file transfer between the attacker and the target
server makes the identity of the attacker difficult to determine.
The IPv6 FTP ALG, however, can be used to protect against such an attack. When this feature is enabled,
the IPv6 FTP ALG recognizes as an attack any extended port command (EPRT) sent by the FTP client that
has a TCP port number less than 1024, and the ALG closes the connection. The ALG performs this action
because TCP port numbers in the range from 0 to 1023 are used by well-known services.
Although the IPv6 FTP ALG can perform bounce attack checks when ports less than 1024
are specified in an EPRT, services running on ports greater than 1023 are still vulnerable
to FTP bounce attacks.
Usage Examples
The following example enables the FTP bounce attack check on the nondefault VRF instance RED1:
(config)#ipv6 firewall vrf RED1 check ftp-bounce
60000CRG0-35E
Optional. Specifies a nondefault (named) Virtual Routing and Forwarding
(VRF) instance on which the enable the bounce attack check. If no VRF
instance is specified, the action is performed on the default VRF instance.
Command was introduced.
Copyright © 2012 ADTRAN, Inc.
Global Configuration Mode Command Set
1198
Advertisement
Table of Contents
