Sun RPC ALG Support for Firewalls and NAT

The Sun RPC ALG Support for Firewalls and NAT feature adds support for the Sun Microsystems remote-procedure call (RPC) application-level gateway (ALG) on the firewall and Network Address Translation (NAT). Sun RPC is an application layer protocol that enables client programs to call functions in a remote server program. This module describes how to configure the Sun RPC ALG.

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/​go/​cfn. An account on Cisco.com is not required.

Restrictions for Sun RPC ALG Support for Firewalls and NAT

  • Depending on your release, the following configuration will not work on Cisco ASR 1000 Aggregation Services Routers. If you configure the inspect action for Layer 4 or Layer 7 class maps, packets that match the Port Mapper Protocol well-known port (111) pass through the firewall without the Layer 7 inspection. Without the Layer 7 inspection, firewall pinholes are not open for traffic flow, and the Sun remote-procedure call (RPC) is blocked by the firewall. As a workaround, configure the match program-number command for Sun RPC program numbers.

  • Only Port Mapper Protocol Version 2 is supported; none of the other versions are supported.

  • Only RPC Version 2 is supported.

Information About Sun RPC ALG Support for Firewalls and NAT

Application-Level Gateways

An application-level gateway (ALG), also known as an application-layer gateway, is an application that translates the IP address information inside the payload of an application packet. An ALG is used to interpret the application-layer protocol and perform firewall and Network Address Translation (NAT) actions. These actions can be one or more of the following depending on your configuration of the firewall and NAT:

  • Allow client applications to use dynamic TCP or UDP ports to communicate with the server application.

  • Recognize application-specific commands and offer granular security control over them.

  • Synchronize multiple streams or sessions of data between two hosts that are exchanging data.

  • Translate the network-layer address information that is available in the application payload.

The firewall opens a pinhole, and NAT performs translation service on any TCP or UDP traffic that does not carry the source and destination IP addresses in the application-layer data stream. Specific protocols or applications that embed IP address information require the support of an ALG.

Sun RPC

The Sun remote-procedure call (RPC) application-level gateway (ALG) performs a deep packet inspection of the Sun RPC protocol. The Sun RPC ALG works with a provisioning system that allows network administrators to configure match filters. Each match filter define a match criterion that is searched in a Sun RPC packet, thereby permitting only packets that match the criterion.

In an RPC, a client program calls procedures in a server program. The RPC library packages the procedure arguments into a network message and sends the message to the server. The server, in turn, uses the RPC library and takes the procedure arguments from the network message and calls the specified server procedure. When the server procedure returns to the RPC, return values are packaged into a network message and sent back to the client.

For a detailed description of the Sun RPC protocol, see RFC 1057, RPC: Remote Procedure Call Protocol Specification Version 2.

Sun RPC ALG Support for Firewalls

You can configure the Sun RPC ALG by using the zone-based firewall that is created by using policies and class maps. A Layer 7 class map allows network administrators to configure match filters. The filters specify the program numbers to be searched for in Sun RPC packets. The Sun RPC Layer 7 policy map is configured as a child policy of the Layer 4 policy map with the service-policy command.

When you configure a Sun RPC Layer 4 class map without configuring a Layer 7 firewall policy, the traffic returned by the Sun RPC passes through the firewall, but sessions are not inspected at Layer 7. Because sessions are not inspected, the subsequent RPC call is blocked by the firewall. Configuring a Sun RPC Layer 4 class map and a Layer 7 policy allows Layer 7 inspection. You can configure an empty Layer 7 firewall policy, that is, a policy without any match filters.

Sun RPC ALG Support for NAT

By default, the Sun RPC ALG is automatically enabled when Network Address Translation (NAT) is enabled. You can use the no ip nat service alg command to disable the Sun RPC ALG on NAT.

How to Configure Sun RPC ALG Support for Firewalls and NAT

For Sun RPC to work when the firewall and NAT are enabled, the ALG must inspect Sun RPC packets. The ALG also handles Sun RPC-specific issues such as establishing dynamic firewall sessions and fixing the packet content after NAT translation.

Configuring the Firewall for the Sun RPC ALG

You must configure a Layer 7 Sun remote-procedure call (RPC) policy map if you have configured the inspect action for the Sun RPC protocol (that is, if you have specified the match protocol sunrpc command in a Layer 4 class map).

We recommend that you do not configure both security zones and inspect rules on the same interface because this configuration may not work.

Perform the following tasks to configure a firewall for the Sun RPC ALG:

Configuring a Layer 4 Class Map for a Firewall Policy

Perform this task to configure a Layer 4 class map for classifying network traffic. When you specify the match-all keyword with the class-map type inspect command, the Sun RPC traffic matches all Sun remote-procedure call (RPC) Layer 7 filters (specified as program numbers) in the class map. When you specify the match-any keyword with the class-map type inspect , the Sun RPC traffic must match at least one of the Sun RPC Layer 7 filters (specified as program numbers) in the class map.

To configure a Layer 4 class map, use the class-map type inspect {match-any | match-all} classm-map-name command.

SUMMARY STEPS

    1.    enable

    2.    configure terminal

    3.    class-map type inspect {match-any | match-all} class-map-name

    4.    match protocol protocol-name

    5.    end


DETAILED STEPS
     Command or ActionPurpose
    Step 1 enable


    Example:
    Device> enable
     

    Enables privileged EXEC mode.

    • Enter your password if prompted.

     
    Step 2 configure terminal


    Example:
    Device# configure terminal
     

    Enters global configuration mode.

     
    Step 3 class-map type inspect {match-any | match-all} class-map-name


    Example:
    Device(config)# class-map type inspect match-any sunrpc-l4-cmap
     

    Creates a Layer 4 inspect type class map and enters QoS class-map configuration mode.

     
    Step 4 match protocol protocol-name


    Example:
    Device(config-cmap)# match protocol sunrpc
     

    Configures a match criterion for a class map on the basis of the specified protocol.

     
    Step 5 end


    Example:
    Device(config-cmap)# end
     

    Exits QoS class-map configuration mode and enters privileged EXEC mode.

     

    Configuring a Layer 7 Class Map for a Firewall Policy

    Perform this task to configure a Layer 7 class map for classifying network traffic. This configuration enables programs such as mount (100005) and Network File System (NFS) (100003) that use Sun RPC. 100005 and 100003 are Sun RPC program numbers. By default, the Sun RPC ALG blocks all programs.

    For more information about Sun RPC programs and program numbers, see RFC 1057, RPC: Remote Procedure Call Protocol Specification Version 2.

    Use the class-map type inspect protocol-name command to configure a Layer 7 class map.

    SUMMARY STEPS

      1.    enable

      2.    configure terminal

      3.    class-map type inspect protocol-name {match-any | match-all} class-map-name

      4.    match program-number program-number

      5.    end


    DETAILED STEPS
       Command or ActionPurpose
      Step 1 enable


      Example:
      Device> enable
       

      Enables privileged EXEC mode.

      • Enter your password if prompted.

       
      Step 2 configure terminal


      Example:
      Device# configure terminal
       

      Enters global configuration mode.

       
      Step 3 class-map type inspect protocol-name {match-any | match-all} class-map-name


      Example:
      Device(config)# class-map type inspect sunrpc match-any sunrpc-l7-cmap
       

      Creates a Layer 7 (application-specific) inspect type class map and enters QoS class-map configuration mode.

       
      Step 4 match program-number program-number


      Example:
      Device(config-cmap)# match program-number 100005
       

      Specifies the allowed RPC protocol program number as a match criterion.

       
      Step 5 end


      Example:
      Device(config-cmap)# end
       

      Exits QoS class-map configuration mode and enters privileged EXEC mode.

       

      Configuring a Sun RPC Firewall Policy Map

      Perform this task to configure a Sun remote-procedure call (RPC) firewall policy map. Use a policy map to allow packet transfer for each Sun RPC Layer 7 class that is defined in a class map for a Layer 7 firewall policy.

      SUMMARY STEPS

        1.    enable

        2.    configure terminal

        3.    policy-map type inspect protocol-name policy-map-name

        4.    class type inspect protocol-name class-map-name

        5.    allow

        6.    end


      DETAILED STEPS
         Command or ActionPurpose
        Step 1 enable


        Example:
        Device> enable
         

        Enables privileged EXEC mode.

        • Enter your password if prompted.

         
        Step 2 configure terminal


        Example:
        Device# configure terminal
         

        Enters global configuration mode.

         
        Step 3 policy-map type inspect protocol-name policy-map-name


        Example:
        Device(config)# policy-map type inspect sunrpc sunrpc-l7-pmap
         

        Creates a Layer 7 (protocol-specific) inspect type policy map and enters QoS policy-map configuration mode.

         
        Step 4 class type inspect protocol-name class-map-name


        Example:
        Device(config-pmap)# class type inspect sunrpc sunrpc-l7-cmap
         

        Specifies the traffic class on which an action is to be performed and enters QoS policy-map class configuration mode.

         
        Step 5 allow


        Example:
        Device(config-pmap-c)# allow
         

        Allows packet transfer.

         
        Step 6 end


        Example:
        Device(config-pmap-c)# end
         

        Exits QoS policy-map class configuration mode and returns to privileged EXEC mode.

         

        Attaching a Layer 7 Policy Map to a Layer 4 Policy Map

        SUMMARY STEPS

          1.    enable

          2.    configure terminal

          3.    policy-map type inspect policy-map-name

          4.    class {class-map-name | class-default}

          5.    inspect [parameter-map-name]

          6.    service-policy protocol-name policy-map-name

          7.    exit

          8.    class class-default

          9.    drop

          10.    end


        DETAILED STEPS
           Command or ActionPurpose
          Step 1 enable


          Example:
          Device> enable
           

          Enables privileged EXEC mode.

          • Enter your password if prompted.

           
          Step 2 configure terminal


          Example:
          Device# configure terminal
           

          Enters global configuration mode.

           
          Step 3 policy-map type inspect policy-map-name


          Example:
          Device(config)# policy-map type inspect sunrpc-l4-pmap
           

          Creates a Layer 4 inspect type policy map and enters QoS policy-map configuration mode.

           
          Step 4 class {class-map-name | class-default}


          Example:
          Device(config-pmap)# class sunrpc-l4-cmap
           

          Associates (class) on which an action is to be performed and enters QoS policy-map class configuration mode.

           
          Step 5 inspect [parameter-map-name]


          Example:
          Device(config-pmap-c)# inspect
           

          Enables stateful packet inspection.

           
          Step 6 service-policy protocol-name policy-map-name


          Example:
          Device(config-pmap-c)# service-policy sunrpc sunrpc-l7-pmap
           

          Attaches the Layer 7 policy map to a top-level Layer 4 policy map.

           
          Step 7 exit


          Example:
          Device(config-pmap-c)# exit
           

          Exits QoS policy-map class configuration mode and returns to QoS policy-map configuration mode.

           
          Step 8 class class-default


          Example:
          Device(config-pmap)# class class-default
           

          Specifies the default class (commonly known as the class-default class) before you configure its policy and enters QoS policy-map class configuration mode.

           
          Step 9 drop


          Example:
          Device(config-pmap-c)# drop
           

          Configures a traffic class to discard packets belonging to a specific class.

           
          Step 10 end


          Example:
          Device(config-pmap-c)# end
           

          Exits QoS policy-map class configuration mode and returns to privileged EXEC mode.

           

          Creating Security Zones and Zone Pairs and Attaching a Policy Map to a Zone Pair

          You need two security zones to create a zone pair. However, you can create only one security zone and the second one can be the system-defined security zone. To create the system-defined security zone or self zone, configure the zone-pair security command with the self keyword.


          Note

          If you select a self zone, you cannot configure the inspect action.

          In this task, you will do the following:

          • Create security zones.

          • Define zone pairs.

          • Assign interfaces to security zones.

          • Attach a policy map to a zone pair.

          SUMMARY STEPS

            1.    enable

            2.    configure terminal

            3.    zone security {zone-name | default}

            4.    exit

            5.    zone security {zone-name | default}

            6.    exit

            7.    zone-pair security zone-pair-name source source-zone-name destination destination-zone-name

            8.    service-policy type inspect policy-map-name

            9.    exit

            10.    interface type number

            11.    ip address ip-address mask [secondary [vrf vrf-name]]

            12.    zone-member security zone-name

            13.    exit

            14.    interface type number

            15.    ip address ip-address mask [secondary [vrf vrf-name]]

            16.    zone-member security zone-name

            17.    end


          DETAILED STEPS
             Command or ActionPurpose
            Step 1 enable


            Example:
            Device> enable
             

            Enables privileged EXEC mode.

            • Enter your password if prompted.

             
            Step 2 configure terminal


            Example:
            Device# configure terminal
             

            Enters global configuration mode.

             
            Step 3 zone security {zone-name | default}


            Example:
            Device(config)# zone security z-client
             
            Creates a security zone and enters security zone configuration mode.

            • Your configuration must have two security zones to create a zone pair: a source zone and a destination zone.

            • In a zone pair, you can use the default zone or self zone as either the source or destination zone.

             
            Step 4 exit


            Example:
            Device(config-sec-zone)# exit
             

            Exits security zone configuration mode and returns to global configuration mode.

             
            Step 5 zone security {zone-name | default}


            Example:
            Device(config)# zone security z-server
             
            Creates a security zone and enters security zone configuration mode.

            • Your configuration must have two security zones to create a zone pair: a source zone and a destination zone.

            • In a zone pair, you can use the default zone as either the source or destination zone.

             
            Step 6 exit


            Example:
            Device(config-sec-zone)# exit
             

            Exits security zone configuration mode and returns to global configuration mode.

             
            Step 7 zone-pair security zone-pair-name source source-zone-name destination destination-zone-name


            Example:
            Device(config)# zone-pair security clt2srv source z-client destination z-server
             

            Creates a zone pair and enters security zone-pair configuration mode.

             
            Step 8 service-policy type inspect policy-map-name


            Example:
            Device(config-sec-zone-pair)# service-policy type inspect sunrpc-l4-pmap
             

            Attaches a firewall policy map to a zone pair.

             
            Step 9 exit


            Example:
            Device(config-sec-zone-pair)# exit
             

            Exits security zone-pair configuration mode and returns to global configuration mode.

             
            Step 10 interface type number


            Example:
            Device(config)# interface gigabitethernet 2/0/0
             

            Configures an interface type and enters interface configuration mode.

             
            Step 11 ip address ip-address mask [secondary [vrf vrf-name]]


            Example:
            Device(config-if)# ip address 192.168.6.5 255.255.255.0
             

            Sets a primary or secondary IP address for an interface.

             
            Step 12 zone-member security zone-name


            Example:
            Device(config-if)# zone-member security z-client
             

            Attaches an interface to a security zone.

             
            Step 13 exit


            Example:
            Device(config-if)# exit
             

            Exits interface configuration mode and returns to global configuration mode.

             
            Step 14 interface type number


            Example:
            Device(config)# interface gigabitethernet 2/1/1
             

            Configures an interface type and enters interface configuration mode.

             
            Step 15 ip address ip-address mask [secondary [vrf vrf-name]]


            Example:
            Device(config-if)# ip address 192.168.6.1 255.255.255.0
             

            Sets a primary or secondary IP address for an interface.

             
            Step 16 zone-member security zone-name


            Example:
            Device(config-if)# zone-member security z-server
             

            Attaches an interface to a security zone.

             
            Step 17 end


            Example:
            Device(config-if)# end
             

            Exits interface configuration mode and returns to privileged EXEC mode.

             

            Configuration Examples for Sun RPC ALG Support for Firewall and NAT

            Example: Configuring a Layer 4 Class Map for a Firewall Policy

            Device# configure terminal
Device(config)# class-map type inspect match-any sunrpc-l4-cmap
Device(config-cmap)# match protocol sunrpc
Device(config-cmap)# end

            Example: Configuring a Layer 7 Class Map for a Firewall Policy

            Device# configure terminal
Device(config)# class-map type inspect sunrpc match-any sunrpc-l7-cmap
Device(config-cmap)# match program-number 100005
Device(config-cmap)# end

            Example: Configuring a Sun RPC Firewall Policy Map

            Device# configure terminal
Device(config)# policy-map type inspect sunrpc sunrpc-l7-pmap 
Device(config-pmap)# class type inspect sunrpc sunrpc-l7-cmap
Device(config-pmap-c)# allow
Device(config-pmap-c)# end

            Example: Attaching a Layer 7 Policy Map to a Layer 4 Policy Map

            Device# configure terminal
Device(config)# policy-map type inspect sunrpcl4-pmap
Device(config-pmap)# class sunrpcl4-cmap
Device(config-pmap-c)# inspect
Device(config-pmap-c)# service-policy sunrpc sunrpc-l7-pmap
Device(config-pmap-c)# exit
Device(config-pmap)# class class-default
Device(config-pmap-c)# drop
Device(config-pmap-c)# end

            Example: Creating Security Zones and Zone Pairs and Attaching a Policy Map to a Zone Pair

            Device# configure terminal
Device(config)# zone security z-client
Device(config-sec-zone)# exit
Device(config)# zone security z-server
Device(config-sec-zone)# exit
Device(config)# zone-pair security clt2srv source z-client destination z-server
Device(config-sec-zone-pair)# service-policy type inspect sunrpc-l4-pmap
Device(config-sec-zone-pair)# exit
Device(config)# interface gigabitethernet 2/0/0
Device(config-if)# ip address 192.168.6.5 255.255.255.0
Device(config-if)# zone-member security z-client
Device(config-if)# exit
Device(config)# interface gigabitethernet 2/1/1
Device(config-if)# ip address 192.168.6.1 255.255.255.0
Device(config-if)# zone-member security z-server
Device(config-if)# end

            Example: Configuring the Firewall for the Sun RPC ALG

            The following is a sample firewall configuration for the Sun remote-procedure call (RPC) application-level gateway (ALG) support: 

            class-map type inspect sunrpc match-any sunrpc-l7-cmap
 match program-number 100005
!
class-map type inspect match-any sunrpc-l4-cmap
 match protocol sunrpc
!
!
policy-map type inspect sunrpc sunrpc-l7-pmap
 class type inspect sunrpc sunrpc-l7-cmap
  allow
!
!
policy-map type inspect sunrpc-l4-pmap
 class type inspect sunrpc-l4-cmap
  inspect
  service-policy sunrpc sunrpc-l7-pmap
!
 class class-default
  drop
!
!
zone security z-client
!
zone security z-server
!
zone-pair security clt2srv source z-client destination z-server
 service-policy type inspect sunrpc-l4-pmap
!
interface GigabitEthernet 2/0/0
 ip address 192.168.10.1 255.255.255.0
 zone-member security z-client
!
interface GigabitEthernet 2/1/1
 ip address 192.168.23.1 255.255.255.0
 zone-member security z-server
!

            Additional References for Sun RPC ALG Support for Firewall and NAT

            Related Documents

            Related Topic

            Document Title

            Cisco IOS commands

            Master Command List, All Releases

            IP Addressing commands

            IP Addressing Services Command Reference

            Security commands

            Standards and RFCs

            Standard/RFC

            Title

            RFC 1057

            RPC: Remote Procedure Call Protocol Specification Version 2

            Technical Assistance

            Description

            Link

            The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.

            http:/​/​www.cisco.com/​cisco/​web/​support/​index.html

            Feature Information for Sun RPC ALG Support for Firewalls and NAT

            The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

            Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/​go/​cfn. An account on Cisco.com is not required.
            Table 1 Feature Information for Sun RPC ALG Support for Firewalls and NAT

            Feature Name

            Releases

            Feature Information

            Sun RPC ALG Support for Firewalls and NAT

            Cisco IOS XE Release 3.2S

            The Sun RPC ALG Support for Firewalls and NAT feature adds support for the Sun RPC ALG on the firewall and NAT.

            The following command was introduced or modified: match protocol.