25-26
Cisco Security Appliance Command Line Configuration Guide
OL-10088-01
Chapter 25 Configuring Application Layer Protocol Inspection
FTP Inspection
• Configuring an FTP Inspection Policy Map for Additional Inspection Control, page 25-27
• Verifying and Monitoring FTP Inspection, page 25-30
FTP Inspection Overview
The FTP application inspection inspects the FTP sessions and performs four tasks:
• Prepares dynamic secondary data connection
• Tracks the FTP command-response sequence
• Generates an audit trail
• Translates the embedded IP address
FTP application inspection prepares secondary channels for FTP data transfer. Ports for these channels
are negotiated through PORT or PASV commands. The channels are allocated in response to a file
upload, a file download, or a directory listing event.
Note If you disable FTP inspection engines with the no inspect ftp command, outbound users can start
connections only in passive mode, and all inbound FTP is disabled.
Using the strict Option
Using the strict option with the inspect ftp command increases the security of protected networks by
preventing web browsers from sending embedded commands in FTP requests.
Note To specify FTP commands that are not permitted to pass through the security appliance, create an FTP
map according to the “Configuring an FTP Inspection Policy Map for Additional Inspection Control”
section on page 25-27.
After you enable the strict option on an interface, FTP inspection enforces the following behavior:
• An FTP command must be acknowledged before the security appliance allows a new command.
• The security appliance drops connections that send embedded commands.
• The 227 and PORT commands are checked to ensure they do not appear in an error string.
Caution Using the strict option may cause the failure of FTP clients that are not strictly compliant with FTP
RFCs.
If the strict option is enabled, each FTP command and response sequence is tracked for the following
anomalous activity:
• Truncated command—Number of commas in the PORT and PASV reply command is checked to
see if it is five. If it is not five, then the PORT command is assumed to be truncated and the TCP
connection is closed.
• Incorrect command—Checks the FTP command to see if it ends with <CR><LF> characters, as
required by the RFC. If it does not, the connection is closed.
To Next Page
Loading...
