9.4.10 Lab Configure and Test Advanced Protocol Handling on the Cisco PIX Security Appliance
Objective
In this lab exercise, the students will complete the following tasks: Display the Inspection protocol configurations Change the Inspection protocol configurations Test the outbound FTP Inspection protocol Perform FTP deep packet inspection
Scenario
Some applications embed addressing information into the application data stream and negotiate randomly picked Transport Control Protocol (TCP) or User Datagram Protocol (UDP) port numbers or IP addresses. In these cases application aware inspection must be performed.
Topology
This figure illustrates the lab network environment.
1 - 10
Network Security 1 v.20 Lab 9.4.10
Copyright 2005, Cisco Systems, Inc.
Preparation
Begin with the standard lab topology and verify the starting configuration on the pod PIX Security Appliance. Access the PIX Security Appliance console port using the terminal emulator on the student PC. If desired, save the PIX Security Appliance configuration to a text file for later analysis.
Tools and resources
In order to complete the lab, the following is required: Standard PIX Security Appliance lab topology Console cable HyperTerminal
Command list
In this lab exercise, the following commands will be used. Refer to this list if assistance or help is needed during the lab exercise. Command clear configure fixup Description To clear the fixup configuration, use the clear configure fixup command in global configuration mode. To identify a specific map for defining the parameters for strict FTP inspection, use the ftpmap command in global configuration mode. To configure a policy, use the policy-map command in global configuration mode. To display all the policy-map configurations or the default policy-map configuration, use the show running-config policy-map command in privileged EXEC mode. To display all currently running service policy configurations, use the show runnig-config service-policy command in global configuration mode.
ftp-map map_name
policy-map name
show running-config policy-map
show running-config servicepolicy
Step 1 List the Fixup Protocols
Complete the following steps and enter the commands as directed to view the current configurations of the PIX Security Appliance: a. Show the default modular policy class-map running on the PIX security appliance: pixP# show run class-map class-map inspection_default match default-inspection-traffic 1. What is the default class-map name?
__________________________________________________________________________
2 - 10
Network Security 1 v.20 Lab 9.4.10
Copyright 2005, Cisco Systems, Inc.
b. Show the default modular policy-map running on the PIX security appliance: pixP# show running-config policy-map ! policy-map global_policy class inspection_default inspect dns maximum-length 512 inspect ftp inspect h323 h225 inspect h323 ras inspect netbios inspect rsh inspect rtsp inspect skinny inspect esmtp inspect sqlnet inspect sunrpc inspect tftp inspect sip inspect xdmcp 1. What is the default policy-map name?
__________________________________________________________________________
2. What is the class for this policy?
__________________________________________________________________________
3. By default, which protocols are inspected by the PIX Security Appliance? Check each protocol that applies:
dns ftp h323 ras rsh sip skinny sunrpc xdmcp netbios
mgcp tftp snmp rtsp icmp h323 h225 esmtp sqlnet http
3 - 10
Network Security 1 v.20 Lab 9.4.10
Copyright 2005, Cisco Systems, Inc.
c.
List the default modular policy service-policy running on the PIX Security Appliance: PixP# show running-config service-policy service-policy global_policy global 1. What is the default service-policy name?
__________________________________________________________________________
2. Where is the default service-policy applied?
__________________________________________________________________________ Step 2 Change the Protocol Inspection Configuration
Complete the following steps and enter the commands as directed to change some of the current configurations of the PIX security appliance: a. Disable the following Inspection protocols in the default policy-map: PixP# configure terminal PixP(config)# policy-map global_policy PixP(config-pmap)# class inspection_default PixP(config-pmap-c)# no inspect sunrpc PixP(config-pmap-c)# no inspect h323 ras PixP(config-pmap-c)# no inspect sqlnet PixP(config-pmap-c)# exit PixP(config-pmap)# exit PixP(config)# (where P = pod number) b. Show the changes to the default modular policy-map running on the PIX Security Appliance: PixP# show running-config policy-map 1. After the policy-map change, which protocols are inspected by the PIX Security Appliance? dns ftp h323 ras rsh sip skinny sunrpc xdmcp netbios mgcp tftp snmp rtsp icmp h323 h225 esmtp sqlnet http
4 - 10
Network Security 1 v.20 Lab 9.4.10
Copyright 2005, Cisco Systems, Inc.
Step 3 Test Outbound FTP Protocol Inspection
Complete the following steps and enter the commands as directed to test the outbound FTP Protocol Inspection: a. FTP to the backbone server from the student PC using the Windows FTP client: C:\> ftp 172.26.26.50 User (172.26.26.50:(none)): ftpuser 331 Password required for ftpuser. Password: ftppass 1. Was it possible to log into the server? Why or why not?
__________________________________________________________________________
b. Do a directory listing at the FTP prompt: ftp> dir 1. Was it possible to see a file listing? Why or why not?
__________________________________________________________________________
c. Quit the FTP session: ftp> quit d. Turn off the FTP Inspection protocol on the PIX Security Appliance: PixP(config)# policy-map global_policy PixP(config-pmap)# class inspection_default PixP(config-pmap-c)# no inspect ftp PixP(config-pmap-c)# exit PixP(config-pmap)# exit PixP(config)# (where P = pod number) Again, e. ftp to the backbone server from the student PC using the Windows FTP client: C:\> ftp 172.26.26.50 User (172.26.26.50:(none)): ftpuser 331 Password required for ftpuser. Password: ftppass 1. Was it possible to log into the server? Why or why not?
__________________________________________________________________________
2. Do a directory listing at the FTP prompt: ftp> dir 3. Was it possible to see a file listing? Why or why not?
__________________________________________________________________________
f. Quit the FTP session: ftp> quit
5 - 10
Network Security 1 v.20 Lab 9.4.10
Copyright 2005, Cisco Systems, Inc.
Note
If the FTP client is hung, press Ctrl+C until the C:\ prompt returns, or close the command prompt window.
g. Open a browser. Set the browser for passive FTP. In Internet Explorer, this can be done through navigation to Tools > Internet Options > Advanced and select Use Passive FTP. It should be possible to make an FTP connection to the backbone server from the student PC. h. Enter the following in the URL field: ftp://172.26.26.50 1. Was the connection successful? Why or why not?
__________________________________________________________________________
2. Was it possible to see a file listing? Why or why not?
__________________________________________________________________________
i. Disable passive FTP on the browser. Close the web browser.
Step 4 Perform FTP Deep Packet Inspection
Complete the following steps to perform FTP deep packet inspection: a. Set all protocol inspection to the factory defaults: PixP(config)# clear configure fixup (where P = pod number) b. Define an FTP-map to disallow the FTP get command: PixP(config)# ftp-map no_get PixP(config-ftp-map)# deny-request-cmd retr PixP(config-ftp-map)# exit PixP(config)# c. FTP to the backbone server from the student PC using a web browser. It should be possible to open a file because the restrictions that were configured in the previous step have not been applied. To test default FTP inspection, enter the following in the URL field: ftp://172.26.26.50 1. Was the connection successful? Why or why not?
__________________________________________________________________________
2. Was it possible to see a file listing? Why or why not?
__________________________________________________________________________
3. Was it possible to open one of the listed files? Why or why not?
__________________________________________________________________________
d. Close the browser e. Apply the FTP-map restriction to the default policy-map: PixP(config)# policy-map global_policy PixP(config-pmap)# class inspection_default PixP(config-pmap-c)# inspect ftp strict no_get PixP(config-pmap-c)# exit PixP(config-pmap)# exit
6 - 10 Network Security 1 v.20 Lab 9.4.10 Copyright 2005, Cisco Systems, Inc.
PixP(config)# f. FTP to the backbone server from the student PC using a web browser. It should not be possible to open, or retrieve, a file. To do this, enter the following in the URL field: ftp://172.26.26.50 1. Was the connection successful? Why or why not?
__________________________________________________________________________
2. Was it possible to see a file listing? Why or why not?
__________________________________________________________________________
3. Was it possible to open one of the listed files? Why or why not?
__________________________________________________________________________
g. Close the browser. h. Verify the change to the default policy-map settings: PixP(config)# show run policy-map policy-map global_p...