348
As the figure shows, to protect the internal network, an ACL is usually required on the router to permit
internal hosts to access external networks while prohibiting hosts on external networks from accessing
the internal network. However, the ACL also filters out the return packets to internal users, thus failing the
connection setup attempts.
ASPF implements the application layer protocol detection function in cooperation with the session
management and ALG features. After detecting the first packet of a session, ASPF matches the packet
with the configured policy and sends the result to the session management feature, which is responsible
for session information database establishment and session status maintenance. Then, the ASPF
processes subsequent packets of the session based on session status information returned by the session
management feature.
For details about session management, see "
Configuring session management
Transport layer protocol detection
The transport layer protocol detection here refers to general TCP/UDP detection. Different from
application layer protocol detection, general TCP/UDP detection is specific to the transport layer
information in the packets, such as source and destination addresses and port number. General
TCP/UDP detection requires a full match between the packets returned to the external interface of the
ASPF and the packets previously sent out from the external interface of ASPF, namely, a perfect match of
the source and destination address and port number. Otherwise, the return packets are blocked.
Therefore, for multi-channel application layer protocols like FTP and H.323, the deployment of TCP
detection without application layer detection leads to failure to establish a data connection.
Configuring a packet filtering firewall
Configuration task list
Task Remarks
Enabling the firewall function
Required
Configuring the firewall default filtering action
Optional
Configuring packet filtering on an interface
Required
Enabling the firewall function
Enabling the IPv4 firewall function
To do…
Command…
Remarks
1.
Enter system view.
system-view
—
2.
Enable the IPv4 firewall
function on a centralized
router.
firewall
enable
Required
Disabled by default
3.
Enable the IPv4 firewall
function on a distributed
router.
firewall
enable
{
all
|
slot
slot-
number
}
Required
Disabled by default
