MSRPC ALG Support for Firewall and NAT

Last Updated: November 29, 2012

The MSRPC ALG Support for Firewall and NAT feature provides support for the Microsoft (MS) Remote Procedure Call (RPC) application-level gateway (ALG) on the firewall and Network Address Translation (NAT). The MSRPC ALG provides deep packet inspection (DPI) of the MSRPC protocol. The MSRPC ALG works in conjunction with a provisioning system to allow the network administrator to configure match filters to define match criteria that can be searched in an MSRPC packet.

Prerequisites for MSRPC ALG Support for Firewall and NAT

  • You must enable the Cisco IOS XE firewall and NAT before applying the MSRPC ALG on packets.

Restrictions for MSRPC AIC Support for Firewall and NAT

  • Only TCP-based MSRPC is supported.

  • You cannot configure the allow and reset commands together.

  • You must configure the match protocol msrpc command for DPI.

Information About MSRPC ALG Support for Firewall and NAT

Application-Level Gateways

An application-level gateway (ALG), also known as an application-layer gateway, is an application that translates the IP address information inside the payload of an application packet. An ALG is used to interpret the application-layer protocol and perform firewall and Network Address Translation (NAT) actions. These actions can be one or more of the following depending on your configuration of the firewall and NAT:
  • Allow client applications to use dynamic TCP or UDP ports to communicate with the server application.
  • Recognize application-specific commands and offer granular security control over them.
  • Synchronize multiple streams or sessions of data between two hosts that are exchanging data.
  • Translate the network-layer address information that is available in the application payload.

The firewall opens a pinhole, and NAT performs translation service on any TCP or UDP traffic that does not carry the source and destination IP addresses in the application-layer data stream. Specific protocols or applications that embed IP address information require the support of an ALG.

MSRPC

MSRPC is a framework that developers use to publish a set of applications and services for servers and enterprises. RPC is an interprocess communication technique that allows the client and server software to communicate over the network. MSRPC is an application-layer protocol that is used by a wide array of Microsoft applications. MSRPC supports both connection-oriented (CO) and connectionless (CL) Distributed Computing Environment (DCE) RPC modes over a wide variety of transport protocols. All services of MSRPC establish an initial session that is referred to as the primary connection. A secondary session over a port range between 1024 to 65535 as the destination port is established by some services of MSRPC.

For MSRPC to work when firewall and NAT are enabled, in addition to inspecting MSRPC packets, the ALG is required to handle MSRPC specific issues like establishing dynamic firewall sessions and fixing the packet content after the NAT.

By applying MSRPC protocol inspection, most MSRPC services are supported, eliminating the need for Layer 7 policy filters.

MSRPC ALG on Firewall

After you configure the firewall to inspect the MSRPC protocol, the MSRPC ALG starts parsing MSRPC messages. The following table describes the types of Protocol Data Units (PDU) supported by the MSRPC ALG Support on Firewall and NAT feature:
Table 1 Supported PDU Types

PDU

Number

Type

Description

REQUEST

0

call

Initiates a call request.

RESPONSE

2

call

Responds to a call request.

FAULT

3

call

Indicates an RPC runtime, RPC stub, or RPC-specific exception.

BIND

11

association

Initiates the presentation negotiation for the body data.

BIND_ACK

12

association

Accepts a bind request.

BIND_NAK

13

association

Rejects an association request.

ALTER_CONTEXT

14

association

Requests additional presentation negotiation for another interface and/or version, or to negotiate a new security context, or both.

ALTER_CONTEXT_RESP

15

association

Responds to the ALTER_CONTEXT PDU. Valid values are accept or deny.

SHUTDOWN

17

call

Requests a client to terminate the connection and free the related resources.

CO_CANCEL

18

call

Cancels or orphans a connection. This message is sent when a client encounters a cancel fault.

ORPHANED

19

call

Aborts a request that in progress and that has not been entirely transmitted yet, or aborts a (possibly lengthy) response that is in progress.

MSRPC ALG on NAT

When NAT receives an MSRPC packet, it invokes the MSRPC ALG that parses the packet payload and forms a token to translate any embedded IP addresses. This token is passed to NAT, which translates addresses or ports as per your NAT configuration. The translated addresses are then written back into the packet payload by the MSRPC ALG.

If you have configured both the firewall and NAT, NAT calls the ALG first.

MSRPC Stateful Parser

The MSRPC state machine or the parser is the brain of the MSRPC ALG. The MSRPC stateful parser keeps all stateful information within the firewall or NAT depending on which feature invokes the parser first. The parser provides DPI of MSRPC protocol packets. It checks for protocol conformance and detects out-of-sequence commands and malformed packets. As the packet is parsed, the state machine records various data and fills in the correct token information for NAT and firewall inspection.

How to Configure MSRPC ALG Support for Firewall and NAT


Note
By default, MSRPC ALG is automatically enabled when NAT is enabled. There is no need to explicitly enable MSRPC ALG in the NAT-only configuration. You can use the no ip nat service msrpc command to disable MSRPC ALG on NAT.

Configuring a Layer 4 MSRPC Class Map and Policy Map

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    class-map type inspect match-any class-map-name

4.    match protocol protocol-name

5.    exit

6.    policy-map type inspect policy-map-name

7.    class type inspect class-map-name

8.    inspect

9.    end


DETAILED STEPS
  Command or Action Purpose
Step 1
enable


Example:

Router> enable

 
Enables privileged EXEC mode.
  • Enter your password if prompted.
 
Step 2
configure terminal


Example:

Router# configure terminal

 

Enters global configuration mode.

 
Step 3
class-map type inspect match-any class-map-name


Example:

Router(config)# class-map type inspect match-any msrpc-cmap

 

Creates an inspect type class map for the traffic class and enters QoS class-map configuration mode.

 
Step 4
match protocol protocol-name


Example:

Router(config-cmap)# match protocol msrpc

 
Configures the match criteria for a class map on the basis of a specified protocol.
  • Only Cisco IOS XE stateful packet inspection-supported protocols can be used as match criteria in inspect type class maps.
 
Step 5
exit


Example:

Router(config-cmap)# exit

 

Exits QoS class-map configuration mode and enters global configuration mode.

 
Step 6
policy-map type inspect policy-map-name


Example:

Router(config)# policy-map type inspect msrpc-pmap

 

Creates a Layer 3 or Layer 4 inspect type policy map and enters QoS policy-map configuration mode.

 
Step 7
class type inspect class-map-name


Example:

Router(config-pmap)# class type inspect msrpc-class-map

 

Specifies the traffic (class) on which an action is to be performed and enters QoS policy-map class configuration mode.

 
Step 8
inspect


Example:

Router(config-pmap-c)# inspect

 

Enables Cisco IOS XE stateful packet inspection.

 
Step 9
end


Example:

Router(config-pmap-c)# end

 

Exits QoS policy-map class configuration mode and enters privileged EXEC mode.

 

Configuring a Zone Pair and Attaching an MSRPC Policy Map

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    zone security security-zone-name

4.    exit

5.    zone security security-zone-name

6.    exit

7.    zone-pair security zone-pair-name [source source-zone destination [destination-zone]]

8.    service-policy type inspect policy-map-name

9.    end


DETAILED STEPS
  Command or Action Purpose
Step 1
enable


Example:

Router> enable

 
Enables privileged EXEC mode.
  • Enter your password if prompted.
 
Step 2
configure terminal


Example:

Rotuer# configure terminal

 

Enters global configuration mode.

 
Step 3
zone security security-zone-name


Example:

Router(config)# zone security in-zone

 

Creates a security zone to which interfaces can be assigned and enters security zone configuration mode.

 
Step 4
exit


Example:

Router(config-sec-zone)# exit

 

Exits security zone configuration mode and enters global configuration mode.

 
Step 5
zone security security-zone-name


Example:

Router(config)# zone security out-zone

 

Creates a security zone to which interfaces can be assigned and enters security zone configuration mode.

 
Step 6
exit


Example:

Router(config-sec-zone)# exit

 

Exits security zone configuration mode and enters global configuration mode.

 
Step 7
zone-pair security zone-pair-name [source source-zone destination [destination-zone]]


Example:

Router(config)# zone-pair security in-out source in-zone destination out-zone

 
Creates a zone pair and enters security zone pair configuration mode.
Note    To apply a policy, you must configure a zone pair.
 
Step 8
service-policy type inspect policy-map-name


Example:

Router(config-sec-zone-pair)# service-policy type inspect msrpc-pmap

 
Attaches a firewall policy map to the destination zone pair.
Note    If a policy is not configured between a pair of zones, traffic is dropped by default.
 
Step 9
end


Example:

Router(config-sec-zone-pair)# end

 

Exits security zone pair configuration mode and enters privileged EXEC mode.

 

Configuration Examples for MSRPC ALG Support for Firewall and NAT

Example: Configuring a Layer 4 MSRPC Class Map and Policy Map

Router# configure terminal
Router(config)# class-map type inspect match-any msrpc-cmap
Router(config-cmap)# match protocol msrpc
Router(config-cmap)# exit
Router(config)# policy-map type inspect msrpc-pmap
Router(config-pmap)# class type inspect msrpc-cmap
Router(config-pmap-c)# inspect
Router(config-pmap-c)# end

Example: Configuring a Zone Pair and Attaching an MSRPC Policy Map

Router# configure terminal
Router(config)# zone security in-zone
Router(config-sec-zone)# exit
Router(config)# zone security out-zone
Router(config-sec-zone)# exit
Router(config)# zone-pair security in-out source in-zone destination out-zone
Router(config-sec-zone-pair)# service-policy type inspect msrpc-pmap
Router(config-sec-zone-pair)# end

Additional References

Related Documents

Related Topic Document Title

Cisco IOS commands

Cisco IOS Master Commands List, All Releases

NAT commands

Cisco IOS IP Addressing Services Command Reference

Security commands

NAT ALGs

"Using Application-Level Gateways with NAT" module

ALG support

NAT and Firewall ALG Support on Cisco ASR 1000 Series Routers

Standards and RFCs

Standard/RFC Title

No new or modified standards or RFCs are supported by this feature, and support for existing standards has not been modified by this feature.

--

MIBs

MIB MIBs Link

No new or modified MIBs are supported by this feature, and support for existing MIBs has not been modified by this feature.

To locate and download MIBs for selected platforms, Cisco software releases, and feature sets, use Cisco MIB Locator found at the following URL:

http://www.cisco.com/go/mibs

Technical Assistance

Description Link

The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.

http://www.cisco.com/cisco/web/support/index.html

Feature Information for MSRPC ALG Support for Firewall and NAT

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.

Table 2 Feature Information for MSRPC ALG Support for Firewall and NAT
Feature Name Releases Feature Information

MSRPC ALG Support for Firewall and NAT

Cisco IOS XE Release 3.5S

The MSRPC ALG Support for Firewall and NAT feature provides support for the MSRPC ALG on the firewall and NAT. The MSRPC ALG provides deep packet inspection of the MSRPC protocol. The MSRPC ALG works in conjunction with a provisioning system to allow the network administrator to configure match filters that define match criteria that can be searched in an MSRPC packet.

The following commands were introduced or modified: ip nat service msrpc, match protocol msrpc.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.

© 2012 Cisco Systems, Inc. All rights reserved.