Juniper JUNOS OS 10.4 - RELEASE NOTES - Page 90

File Transfer Protocol (FTP) is the part of the ALG that handles FTP traffic. The
PORT/PASV requests and corresponding 200/227 responses in FTP are used to
announce the TCP port, which the host listens to for the FTP data connection.
EPRT/EPSV/229 commands are used for these requests and responses. FTP ALG
supports EPRT/EPSV/229 already, but only for IPv4 addresses.
In Junos OS Release 10.4, EPRT/EPSV/229 commands are updated to support both
IPv4 and IPv6 addresses.
[Junos OS CLI Reference, Junos OS Security Configuration Guide]
•
ICMP ALG for routing, NAT, and NAT-PT — This feature is supported on all SRX Series
and J Series devices. ALGs support Internet Control Message Protocol version 6
(ICMPv6) an integral part of IPv6 that must be fully implemented by every IPv6 node.
The ICMP ALG handles ICMP traffic by monitoring all ICMP messages and then
performing the following actions:
•
Closes the session
•
Modifies the payload
In routing mode, the ICMP ALG closes a session if it receives one of the following
message types:
•
Echo reply (type 129) message
•
Destination unreachable (type 1) error message
In Network Address Translation (NAT mode), the ICMP ALG performs the following
actions:
•
Closes the session if it receives an echo reply (type 129) message or a destination
unreachable (type 1) error message
•
Modifies the identifier or sequence number of the echo request
•
Retains the original identifier and sequence number for the echo reply
•
Translates the embedded IPv6 packet for the ICMPv6 error message
In a Network Address Translation-Protocol Translation (NAT-PT) environment, the
ALG performs the following actions:
•
Closes the session if it receives an echo reply (type 129) message or a destination
unreachable (type 1) error message
•
Translates an ICMPv4 ping message to an ICMPv6 ping message
•
Translates an ICMPv6 ping message to an ICMPv4 ping message
•
Translates an ICMPv4 error message to an ICMPv6 error message and translates its
embedded IPv4 packet to an IPv6 packet
•
Translates an ICMPv6 error message to an ICMPv4 error message and translates its
embedded IPv6 packet to an IPv4 packet
Copyright © 2010, Juniper Networks, Inc.90
JUNOS OS 10.4 Release Notes