Software Features
Application Layer Gateways (ALGs)
■
DNS ALG
—This feature is supported on SRX3400, SRX3600, SRX5600, and
SRX5800 devices in addition to existing support on SRX100, SRX210, SRX240,
SRX650. JUNOS Software for SRX Series devices provides Domain Name System
(DNS) support. The DNS ALG monitors DNS query and reply packets and closes
the session if the DNS flag indicates that the packet is a reply message. To
configure the DNS ALG, use the
edit security alg dns
statement at the
[edit security
alg]
hierarchy level.
[
JUNOS Software Security Configuration Guide
]
■
DNS doctoring support
—This feature is supported on all SRX Series and J Series
devices.
Domain Name System (DNS) ALG functionality has been extended to support
static NAT. You should configure static NAT for the DNS server first. Then if the
DNS ALG is enabled, public-to-private and private-to-public static address
translation can occur for A-records in DNS replies.
The DNS ALG also now includes a maximum-message-length command option
with a value range of 512 to 8192 bytes and a default value of 512 bytes. The
DNS ALG will now drop traffic if the DNS message length exceeds the configured
maximum, if the domain name is more than 255 bytes, or if the label length is
more than 63 bytes. The ALG will also decompress domain name compression
pointers and retrieve their related full domain names, and check for the existence
of compression pointer loops and drop the traffic if one exists.
Note that the DNS ALG can translate the first 32 A-records in a single DNS reply.
A-records after the first 32 will not be handled. Also note that the DNS ALG
supports only IPv4 addresses and does not support VPN tunnels.
[
JUNOS Software Security Configuration Guide
]
■
MS RPC ALG
—This feature is now supported on SRX3400, SRX3600, SRX5600,
and SRX5800 devices in addition to existing support on SRX100, SRX210,
SRX240, SRX650, and J Series devices.
The Microsoft RPC (MS RPC) provides a way for a program running on one host
to call procedures in a program running on another host. Because of the large
number of RPC services and the need to broadcast, the transport address of an
RPC service is dynamically negotiated based on the service program's Universal
Unique IDentifier (UUID). The specific UUID is mapped to a transport address.
JUNOS Software supports MS RPC as a predefined service to allow and deny
traffic based on a policy you configure. The MS RPC ALG provides the functionality
for all supported devices to handle the dynamic transport address negotiation
mechanism of the MS RPC and to ensure UUID-based security policy enforcement.
You can define a security policy to permit or deny all RPC requests or to permit
or deny by specific UUID number. The ALG also supports route and NAT mode
for incoming and outgoing requests.
[
JUNOS Software Security Configuration Guide
]
New Features in JUNOS Release 10.1 for SRX Series Services Gateways and J Series Services Routers
■
99
New Features in JUNOS Release 10.1 for SRX Series Services Gateways and J Series Services Routers
