The firewall opens a pinhole, and NAT performs translation service on any TCP or UDP traffic that does not carry the source and destination IP addresses in the application-layer data stream. Specific protocols or applications that embed IP address information require the support of an ALG.

Zone-based policy firewalls support Layer 7 protocol inspection along with application-level gateways (ALG) and application inspection and control (AIC). Layer 7 protocol inspection is automatically enabled along with the ALG/AIC configuration.

Layer 7 application protocol inspection is a technique that interprets or understands application-layer protocols and performs appropriate firewall or Network Address Translation (NAT) action. Certain applications require special handling of the data portion of a packet when the packet passes through the security module on a device. Layer 7 application protocol inspection helps to verify the protocol behavior and identify unwanted or malicious traffic that passes through the security module. Based on the configured traffic policy, the security module accepts or rejects packets to ensure the secure use of applications and services.

Sometimes, application inspection implementation issues can cause application packet drop and make networks unstable. Prior to the introduction of the Enabling ALGs and AICs in Zone-Based Policy Firewall feature, to disable application inspection you had to define an access control list (ACL) with the target Layer 7 protocol port define a class map that matches this ACL and matches either the TCP or UDP protocol to bypass the inspection for a specific Layer 7 protocol.

With the introduction of the Enabling ALGs and AICs in Zone-Based Policy Firewall feature, you can enable or disable Layer 7 protocol inspection for a specific protocol or for all supported Layer 7 protocols with the application-inspect command. Any configuration changes to a parameter map applies only to new sessions. For example, when you disable FTP Layer 7 inspection, the newly created sessions skip FTP Layer 7 inspection, while existing sessions before the configuration change will perform FTP Layer 7 inspection. For all sessions to perform the configuration change, you must delete all sessions and re-create them.

You can enable Layer 7 application protocol inspection for an individual parameter map or for a global firewall.

1.    enable


2.    configure terminal


3.    Do one of the following:

• parameter-map type inspect parameter-map-name
• parameter-map type inspect-global

4.    application-inspect {all | protocol-name}


5.    exit


6.    class-map type inspect {match-all | match-any} class-map-name


7.    match protocol protocol-name


8.    exit


9.    policy-map type inspect policy-map-name


10.    class type inspect {class-map-name | class-default}


11.    inspect parameter-map-name


12.    exit


13.    class {class-map-name | class-default}


14.    end

Device> enable

Device# configure terminal

Device(config)# parameter-map type inspect pmap-fw

Device(config)# parameter-map type inspect-global

Device(config-profile)# application-inspect msrpc

Device(config-profile)# exit

Device(config)# class-map type inspect match-any internet-traffic-class

Device(config-cmap)# match protocol msrpc

Device(config-cmap)# exit

Device(config)# policy-map type inspect private-internet-policy

Device(config-pmap)# class type inspect internet-traffic-class

Device(config-pmap-c)# inspect pmap-fw

Device(config-pmap-c)# exit

Device(config-pmap)# class class-default

Device(config-pmap)# end

1.    enable


2.    configure terminal


3.    zone security {default | security-zone}


4.    exit


5.    zone security {default | security-zone}


6.    exit


7.    zone-pair security zone-pair source source-zone destination destination-zone


8.    service-policy type inspect policy-map-name


9.    exit


10.    interface type number


11.    zone-member security security-zone


12.    exit


13.    interface type number


14.    zone-member security security-zone


15.    end

Device> enable

Device# configure terminal

Device(config)# zone security private

Device(config-sec-zone)# exit

Device(config)# zone security internet

Device(config-sec-zone)# exit

Device(config)# zone-pair security private-internet source private destination internet

Device(config-sec-zone-pair)# service-policy type inspect private-internet-policy

Device(config-sec-zone-pair)# exit

Device(config)# interface gigabitethernet 0/0/0

Device(config-if)# zone-member security private 

Device(config-if)# exit

Device(config)# interface gigabitethernet 0/2/2

Device(config-if)# zone-member security internet 

Device(config-if)# end