Cisco 7604 Configuration Guide - Page 447

Chapter 22 Applying Application Layer Protocol Inspection FTP Inspection If the strict option is enabled, each ftp command and response sequence is tracked for the following anomalous activity: • Truncated command-Number of commas in the PORT and PASV reply command is checked to see if it is five. If it is not five, then the PORT command is assumed to be truncated and the TCP connection is closed. • Incorrect command-Checks the ftp command to see if it ends with characters, as required by the RFC. If it does not, the connection is closed. • Size of RETR and STOR commands-These are checked against a fixed constant. If the size is greater, then an error message is logged and the connection is closed. • Command spoofing-The PORT command should always be sent from the client. The TCP connection is denied if a PORT command is sent from the server. • Reply spoofing-PASV reply command (227) should always be sent from the server. The TCP connection is denied if a PASV reply command is sent from the client. This prevents the security hole when the user executes "227 xxxxx a1, a2, a3, a4, p1, p2." • TCP stream editing-The FWSM closes the connection if it detects TCP stream editing. • Invalid port negotiation-The negotiated dynamic port value is checked to see if it is less than 1024. As port numbers in the range from 1 to 1024 are reserved for well-known connections, if the negotiated port falls in this range, then the TCP connection is freed. • Command pipelining-The number of characters present after the port numbers in the PORT and PASV reply command is cross checked with a constant value of 8. If it is more than 8, then the TCP connection is closed. • The FWSM replaces the FTP server response to the SYST command with a series of Xs to prevent the server from revealing its system type to FTP clients. To override this default behavior, use the no mask-syst-reply command in FTP map configuration mode. The request-command deny Command The request-command deny command lets you control which FTP commands the FWSM allows for FTP traffic through the FWSM. This command is available in FTP map configuration mode; therefore, to make use of it, you must create an FTP map and use that map when you enable FTP inspection, per "Configuring FTP Inspection" section on page 22-32. Table 22-3 lists the FTP commands that you can disallow by using the request-command deny command. . Table 22-3 FTP Map request-command deny Options request-command deny Option appe cdup dele get help mkd put Purpose Disallows the command that appends to a file. Disallows the command that changes to the parent directory of the current working directory. Disallows the command that deletes a file on the server. Disallows the client command for retrieving a file from the server. Disallows the command that provides help information. Disallows the command that makes a directory on the server. Disallows the client command for sending a file to the server. OL-20748-01 Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM 22-31