技术学习资料分享腾科.ppt

Need for Advanced Protocol Handling Some popular protocols or applications behave as follows: They negotiate connections to dynamically assigned source and destination ports and IP addresses. They embed source and destination port and IP address information above the network layer. A good security appliance has to inspect packets above the network layer and do the following as required by the protocol or application: Securely open and close negotiated ports and IP addresses for legitimate client-server connections through the security appliance Use NAT-relevant instances of IP addresses inside a packet Use PAT-relevant instances of ports inside a packet Inspect packets for signs of malicious application misuse inspect Command Default Traffic Inspection and Port Numbers Default Protocol Inspection Policy Delete Inspection for a Protocol Disables ctiqbe protocol inspection Add a Protocol Inspection Port Number Adds port 8080 HTTP protocol inspection to a default policy map Defines a class map to match the traffic flow identified by a port number, for example 8080 Uses the policy map to associate the traffic flow, 8080, with a protocol inspection, inspect HTTP FTP Inspection FTP uses two channels: Command connection (TCP) Data connection (TCP) FTP inspection Address translation in the message Dynamic creation of openings for FTP data connections Stateful tracking of request and response messages (Optional) FTP strict, which prevents web browsers from sending embedded commands in FTP requests FTP deep packet inspection: Is added to strict inspection functionality Enables command filtering Active Mode FTP Inspection Active mode FTP uses two channels: Client-initiated command connection (TCP) Server-initiated data connection (TCP) For outbound connections, the security appliance handles active mode FTP by opening a temporary inbound channel for the data. For inbound connections, if an FTP ACL exists, the security appliance handles active mode FTP as follows: If outb