Cisco 7604 Configuration Guide - Page 516

Sun RPC Inspection Chapter 22 Applying Application Layer Protocol Inspection • Verifying and Monitoring Sun RPC Inspection, page 22-102 Sun RPC Inspection Overview To enable Sun RPC application inspection or to change the ports to which the FWSM listens, use the inspect sunrpc command in policy map class configuration mode, which is accessible by using the class command within policy map configuration mode. To remove the configuration, use the no form of this command. The inspect sunrpc command enables or disables application inspection for the Sun RPC protocol. Sun RPC is used by NFS and NIS. Sun RPC services can run on any port. When a client attempts to access an Sun RPC service on a server, it must learn the port that service is running on. It does this by querying the port mapper process, usually rpcbind, on the well-known port of 111. The client sends the Sun RPC program number of the service and the port mapper process responds with the port number of the service. The client sends its Sun RPC queries to the server, specifying the port identified by the port mapper process. When the server replies, the FWSM intercepts this packet and opens both embryonic TCP and UDP connections on that port. Note NAT or PAT of Sun RPC payload information is not supported. Enabling and Configuring Sun RPC Inspection Sun RPC inspection is enabled by default. Note To enable or configure Sun RPC inspection over UDP, you do not have to define a separate traffic class or a new policy map. You simply add the inspect sunrpc command into a policy map whose traffic class is defined by the default traffic class. An example of this configuration is shown in Example 22-16 on page 22-102. To enable Sun RPC inspection or change the default port used for receiving Sun RPC traffic using TCP, perform the following steps: Step 1 Step 2 Step 3 Determine the port or ports that the port mapper process listens to. While this is most often port 111, it can differ between operating systems and implementations. Create a class map or modify an existing class map to identify Sun RPC traffic. Use the class-map command to do so, as follows: hostname(config)# class-map class_map_name hostname(config-cmap)# where class_map_name is the name of the traffic class. When you enter the class-map command, the CLI enters class map configuration mode. Use a match command to identify traffic sent to the port or ports that you determined in Step 1. If the port mapper process listens to a single port, you can use the match port command to identify traffic sent to that port, as follows: hostname(config-cmap)# match port tcp eq port_number 22-100 Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM OL-20748-01