Cisco 4700M Configuration Manual page 135

Chapter 3 Configuring Application Protocol Inspection
•
Note
Cisco 4700 Series Application Control Engine Appliance Security Configuration Guide
OL-16202-01
Tracks the FTP command-response sequence. The ACE performs the
following FTP command checks listed below.
Truncated command—Checks the number of commas in the PORT and
–
PASV reply command against a fixed value of five. If the value is not
five, the ACE assumes that the PORT command is truncated, issues a
warning message, and closes the TCP connection.
Incorrect command—Checks the FTP command to verify if it ends with
–
<CR><LF> characters, as required by RFC 959. If the FTP command
does not end with those characters, the ACE closes the connection.
Invalid port negotiation—Checks the negotiated dynamic port value to
–
verify that it is greater than 1024 (port numbers from 2 to 1024 are
reserved for well-known connections). If the negotiated port falls in this
range, the ACE closes the TCP connection.
Command pipelining—Checks the number of characters present after the
–
port numbers in the PORT and PASV reply command against a constant
value of 8. If the number of characters is greater than 8, the ACE closes
the TCP connection.
In addition to these FTP command checks, if you specify the strict keyword
with the inspect ftp command in a Layer 3 and Layer 4 policy map, the ACE
tracks each FTP command and response sequence for the anomalous activity
outlined below. The strict keyword can be used with a Layer 7 FTP policy
map (nested within the Layer 3 and Layer 4 policy map) to deny certain FTP
commands or to mask the server reply for the SYST command.
Using the strict keyword may affect FTP clients that do not comply with
the RFC standards.
Size of RETR and STOR commands—Checks the size of the RETR and
–
STOR commands against a fixed constant of 256. If the size is greater,
the ACE logs an error message and closes the connection.
Command spoofing—Verifies that the PORT command is always sent
–
from the client. If a PORT command is sent from the server, the ACE
denies the TCP connection.
Application Protocol Inspection Overview
3-11