The firewall opens a pinhole, and NAT performs translation service on any TCP or UDP traffic that does not carry the source and destination IP addresses in the application-layer data stream. Specific protocols or applications that embed IP address information require the support of an ALG.

MSRPC is a framework that developers use to publish a set of applications and services for servers and enterprises. RPC is an interprocess communication technique that allows the client and server software to communicate over the network. MSRPC is an application-layer protocol that is used by a wide array of Microsoft applications. MSRPC supports both connection-oriented (CO) and connectionless (CL) Distributed Computing Environment (DCE) RPC modes over a wide variety of transport protocols. All services of MSRPC establish an initial session that is referred to as the primary connection. A secondary session over a port range between 1024 to 65535 as the destination port is established by some services of MSRPC.

For MSRPC to work when firewall and NAT are enabled, in addition to inspecting MSRPC packets, the ALG is required to handle MSRPC specific issues like establishing dynamic firewall sessions and fixing the packet content after the NAT.

By applying MSRPC protocol inspection, most MSRPC services are supported, eliminating the need for Layer 7 policy filters.

When NAT receives an MSRPC packet, it invokes the MSRPC ALG that parses the packet payload and forms a token to translate any embedded IP addresses. This token is passed to NAT, which translates addresses or ports as per your NAT configuration. The translated addresses are then written back into the packet payload by the MSRPC ALG.

If you have configured both the firewall and NAT, NAT calls the ALG first.

The MSRPC state machine or the parser is the brain of the MSRPC ALG. The MSRPC stateful parser keeps all stateful information within the firewall or NAT depending on which feature invokes the parser first. The parser provides DPI of MSRPC protocol packets. It checks for protocol conformance and detects out-of-sequence commands and malformed packets. As the packet is parsed, the state machine records various data and fills in the correct token information for NAT and firewall inspection.

1.    enable


2.    configure terminal


3.    class-map type inspect match-any class-map-name


4.    match protocol protocol-name


5.    exit


6.    policy-map type inspect policy-map-name


7.    class type inspect class-map-name


8.    inspect


9.    end

Router> enable
          

Router# configure terminal
          

Router(config)# class-map type inspect match-any msrpc-cmap
          

Router(config-cmap)# match protocol msrpc
          

Router(config-cmap)# exit
          

Router(config)# policy-map type inspect msrpc-pmap
          

Router(config-pmap)# class type inspect msrpc-class-map
          

Router(config-pmap-c)# inspect
          

Router(config-pmap-c)# end
          

1.    enable


2.    configure terminal


3.    zone security security-zone-name


4.    exit


5.    zone security security-zone-name


6.    exit


7.    zone-pair security zone-pair-name [source source-zone destination [destination-zone]]


8.    service-policy type inspect policy-map-name


9.    end

Router> enable
          

Rotuer# configure terminal
          

Router(config)# zone security in-zone
          

Router(config-sec-zone)# exit
          

Router(config)# zone security out-zone
          

Router(config-sec-zone)# exit
          

Router(config)# zone-pair security in-out source in-zone destination out-zone
          

Router(config-sec-zone-pair)# service-policy type inspect msrpc-pmap
          

Router(config-sec-zone-pair)# end
          

1.    enable


2.    configure terminal


3.    alg vtcp service msrpc


4.    exit


5.    set platform hardware qfp active feature alg msrpc tolerance on

Router> enable
          

Router# configure terminal
          

Rotuer(config)# alg vtcp service msrpc
          

Rotuer(config)# exit
          

Rotuer# set platform hardware qfp active feature alg msrpc tolerance on
          

1.    enable


2.    configure terminal


3.    no alg vtcp service msrpc


4.    end

Router> enable
          

Router# configure terminal
          

Rotuer(config)# no alg vtcp service msrpc
          

Rotuer(config)# end