Cisco 6500 - Catalyst Series 10 Gigabit EN Interface Module Expansion, Configuration Manual, Page: 419 / 742

22-3
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM
OL-20748-01
Chapter 22 Applying Application Layer Protocol Inspection
Inspection Engine Overview
Figure 22-1 How Inspection Engines Work
In Figure 22-2 , operations are numbered in the order they occur, and are described as follows:
1. A TCP SYN packet arrives at the FWSM to establish a new connection.
2.
The FWSM checks the access list database to determine if the connection is permitted.
3. The FWSM creates a new entry in the connection database (XLATE and CONN tables).
4.
The FWSM checks the Inspections database to determine if the connection requires
application-level inspection.
5. After the application inspection engine completes any required operations for the packet, the FWSM
forwards the packet to the destination system.
6.
The destination system responds to the initial request.
7. The FWSM receives the reply packet, looks up the connection in the connection database, and
forwards the packet because it belongs to an established session.
The default configuration of the FWSM includes a set of application inspection entries that associate
supported protocols with specific TCP or UDP port numbers and that identify any special handling
required.
Inspection Limitations
See the following limitations for application protocol inspection:
•
State information for multimedia sessions that require inspection are not passed over the state link
for stateful failover. The exception is GTP, which is replicated over the state link.
• Some inspection engines do not support PAT, NAT, outside NAT, or NAT between same security
interfaces. See
“Default Inspection Policy” for more information about NAT support.
132875
1
7
6
5
2
3 4
Client
ACL
XLATE
CONN
Inspection
Server
FWSM