WHITE PAPER
Most organizations view instant messaging and peer-to-peer file sharing (P2P) applications as frivolous consumers of expensive resources-employee time and network bandwidth. Furthermore, some P2P networks can act as a conduit for malicious software such as worms, offering an easy path around firewalls into an organization to compromise desktop computing resources.
Cisco IOS® Software Release 12.3(14)T introduced application inspection engines and granular inspection, two critical new features that allow Cisco IOS Firewall to control instant messaging and P2P applications on networks. This document offers some sample configurations to use these features to monitor and block instant messaging and P2P file sharing traffic.
BACKGROUND
P2P and instant messaging traffic generally offer two modes of operation-a native mode, where the application runs on a uniquely defined set of Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) ports, and "HTTP cloaked" mode, in which the application masquerades as HTTP (TCP Port 80) traffic in order to gain passage through firewalls and other network policy controls. Some of the more advanced P2P and instant messaging applications implement sufficient RFC 2616 dialogue to appear as a legitimate conversation between a Web browser and a Web server.
Prior to Release 12.3(14)T, Cisco IOS Software was bound by two major restrictions in the control of P2P and instant messaging applications-a limited list of applications that were supported in Cisco IOS Firewall Stateful Inspection (formerly known as Context-Based Access Control (CBAC)), and some lack of application inspection capability.
Cisco IOS Firewall Stateful Inspection is the fundamental basis of the Cisco IOS Firewall feature set. If a specific application was not built into Cisco IOS Firewall (see the list of original supported protocols in Appendix 1), the inspect tcp or inspect udp commands were used to watch for any outbound connection activity through a firewall, and anticipated return traffic was subsequently allowed through firewall blocking policies with access control list (ACL) bypass capability. Unfortunately, these commands allow all traffic that is not specifically filtered out to make a connection with the appropriate server through a firewall, and return traffic is allowed back in. This mode of operation offers little granularity in allowing or disallowing specific protocols.
From an application inspection standpoint, HTTP inspection was one of the more thorough protocol inspections that Cisco IOS Firewall offered. However, even if an extremely restrictive Cisco IOS Firewall policy allowing only "HTTP out" was applied, users might still be able to use P2P and instant messaging applications that offered HTTP cloaking.
Cisco IOS Software Release 12.3(14)T introduced application inspection and granular inspection capabilities to address both of these shortcomings.
EXAMPLE NETWORK
We can examine a simple network to build an example of an effective inspection policy that will prohibit P2P and instant messaging traffic, and that will offer control over cloaked applications that try to exploit TCP Port 80 to gain access though the firewall (Figure 1). This network consists of one or more client PCs in a private network, connected to the public Internet through a Cisco IOS router running Cisco IOS Software Release 12.3(14)T.
Figure 1. Example Network
This sample network needs standard services, such as Web access (HTTP and Secure HTTP [HTTPS]), Internet e-mail (Simple Mail Transport Protocol [SMTP], POP3, and Internet Message Access Protocol [IMAP]), packet voice (H.323), Domain Name System (DNS) lookup, File Transfer Protocol (FTP), Network Time Protocol (NTP), and Internet Control Message Protocol (ICMP). Furthermore, the network users employ VNC, an open-source remote console application that runs by default on TCP 5900, and they need HTTP access on atypical ports (TCP Port 81 and 8080) for connectivity to vendor or customer e-commerce Webpages.
BACKGROUND
Cisco IOS Firewall uses Cisco IOS Firewall Stateful Inspection to restrict a public network's access to protected networks, while maintaining the private network's ability to access resources located in the public network (Figure 2).
Figure 2. Cisco IOS Firewall Stateful Inspection
Cisco IOS Firewall Stateful Inspection protects networks with two basic components. ACLs restrict inbound connections, and stateful inspection examines activity traversing the Cisco IOS Firewall from the protected network to the public network and anticipates the return traffic. Stateful inspection is a mechanism that observes the initiation, maintenance, and closure of network data connections.
Cisco IOS Firewall Stateful Inspection with granular inspection supports several of the specific application protocols listed in Appendix 1. Some of these protocols are common, simple protocols such as HTTP and Telnet, which only use one connection between client and server (or peers) to request and return application data. More complex supported protocols, such as FTP and H.323, employ a control channel to establish communications and a secondary data channel to transmit application data.
Some common protocols are not specifically predefined in IP inspection. Prior to Cisco IOS Software Release 12.3(14)T, ip inspect tcp and ip inspect udp were used as universal options for any services not covered by specific inspection services to inspect outgoing traffic and allow return traffic through a Cisco IOS Firewall's inbound permission ACL. Unfortunately, the inspect tcp option's capability to allow any return traffic is problematic in circumstances where specific protocols must be disallowed, particularly when a complex application such as instant messaging or P2P employs unpredictable port numbers and other mechanisms that make the traffic difficult to detect and block as it leaves the network. Undesired complex applications can be blocked by denying all return traffic except the traffic allowed by specific inspection services.
CONTROLLING P2P AND INSTANT MESSAGING APPLICATIONS
Cisco IOS Software Release 12.3(14)T introduced granular protocol inspection, which offers the capability to use Port-Application Mapping (PAM) protocol definitions with Cisco IOS Firewall inspection. PAM offers users the capability to define specific, named protocols. This significantly changes the older paradigm of employing specific inspection statements for advanced protocols that required comprehensive inspection to allow return access back through a firewall (commonly called "fixup" on Cisco PIX® products), then using inspect tcp to cover simpler protocols that don't require close scrutiny to allow additional data connections. Granular inspection uses PAM with Cisco IOS Firewall Stateful Inspection to associate user-defined application labels to traffic on specific ports, in order to define the list of desired traffic to be inspected so the return traffic "pinholes" are allowed in the inbound ACL; this protects the private network from unwanted access from the public network. Since the complete list of desired traffic can be specified, there is no need for inspect tcp to offer blanket coverage for previously unrecognized application traffic.
Granular inspection is an effective solution for blocking applications using port-hopping techniques that defy ACLs attempting to block the traffic, because the only traffic that is allowed to return through the firewall is running on the specific desired ports that the user allows with existing, predefined inspection capabilities, as well as user-specific, PAM-defined granular inspection policies. inspect tcp did not offer this application-specific mechanism to permit traffic-it simply anticipates all traffic running over TCP.
APPLICATION INSPECTION
Granular inspection leaves some openings that advanced P2P and instant messaging applications may exploit. Most networks allow HTTP traffic through their firewalls, as it is the standard transport of many business applications, including ordinary Web traffic. Many instant messaging and P2P applications have developed mechanisms to disguise their traffic within TCP Port 80 (HTTP) traffic, thus offering their application an additional mechanism to work around restrictive firewalls. To address this issue, Cisco IOS Software Release 12.3(14)T introduced application inspection. The HTTP Application Inspection Engine offers the port-misuse option to scan traffic for specific known applications that disguise their undesired traffic as legitimate HTTP traffic. Presently, HTTP inspection can recognize Yahoo! Messenger traffic, Gnutella and KaZaA file sharing activity, and some applications that can tunnel other traffic through TCP Port 80 to avoid an otherwise restrictive firewall.
By combining granular inspection with the HTTP Application Inspection Engine, network engineers can allow desired protocols' traffic to return to their networks through access lists that protect the private network from unwanted public-net traffic. Application inspection can control specific unwanted application traffic that has been concealed inside legitimate HTTP traffic.
CONFIGURING CISCO IOS FIREWALL
Consider a simple network consisting of a Cisco IOS router with two Fast Ethernet ports. Port 0/0 is connected to the public Internet through a broadband connection, and Port 0/1 is connected to an Ethernet switch in the private network (Figure 3).
Figure 3. Example Network
The first configuration step restricts hosts on the public Internet from reaching the protected network with an ACL blocking all traffic from the public Internet, and applying the list to an interface:
access-list 101 deny ip any any
interface Fastethernet 0/0
ip access-group 101 in
interface Fastethernet 0/0
ip access-group 101 in
In the next step, specific inspection statements are configured based on the acceptable traffic that the router will allow out through the firewall, and on the expected return traffic:
ip inspect name my-ios-fw http
ip inspect name my-ios-fw https
ip inspect name my-ios-fw esmtp
ip inspect name my-ios-fw pop3
ip inspect name my-ios-fw imap3
ip inspect name my-ios-fw dns
ip inspect name my-ios-fw ftp
ip inspect name my-ios-fw ntp
ip inspect name my-ios-fw icmp
ip inspect name my-ios-fw https
ip inspect name my-ios-fw esmtp
ip inspect name my-ios-fw pop3
ip inspect name my-ios-fw imap3
ip inspect name my-ios-fw dns
ip inspect name my-ios-fw ftp
ip inspect name my-ios-fw ntp
ip inspect name my-ios-fw icmp
Cisco IOS Software supports the most popular Internet protocols, as well as several protocols that require additional effort to accommodate secondary data connections (listed in Appendix 1). This example requires support for VNC, which is not supported by default IP inspection capability; VNC runs on TCP 5900 by default. Granular protocol inspection provides the capability to configure inspection for specific protocols that are not natively supported by IP inspection. Configure inspection for VNC by defining the PAM entry for the protocol. Note: User-defined protocol labels must begin with "user-":
ip port-map user-vnc port tcp 5900
Next, apply the new protocol to the stateful inspection set:
ip inspect name my-ios-fw user-vnc
Now that the IP inspection set is complete, apply the inspection policy to the outbound traffic. Since this example protects traffic sourced on the private side of the router, ip inspect in is applied to the private interface. The router will inspect traffic passing from the private network to the public Internet, and the appropriate ACL bypass entries will be entered on the public side of the router to allow desired return traffic from the public Internet to pass back to the private network.
interface fastethernet 0/1
ip inspect my-ios-fw in
ip inspect my-ios-fw in
The Cisco IOS Firewall Stateful Inspection configuration that you have defined blocks unwanted connections from the public Internet and allows return traffic for desired applications. Some P2P and instant messaging applications may be able to carry their traffic over TCP Port 80, so we'll use the HTTP Application Inspection Engine to inspect further into TCP Port 80 packets, and look for indications of the unwanted P2P and instant messaging traffic.
First, define the application inspection policy name, then configure HTTP inspection. Next, set up the policy. This policy will only inspect TCP Port 80 traffic for misuse by non-HTTP traffic; you may wish to define other application inspection features. Check the configuration reference list at the end of this document for details on using other features in HTTP application inspection:
appfw policy-name abuse-control
application http
port-misuse default action reset alarm
application http
port-misuse default action reset alarm
Apply the application inspection policy to the existing inspection set:
ip inspect name my-ios-fw appfw abuse-control
This completes the configuration for Cisco IOS Firewall with granular inspection and application inspection.
VERIFYING CISCO IOS FIREWALL CAPABILITY
You can check the Cisco IOS Firewall configuration and activity with several show commands:
show ip inspect config
Displays protocol timeouts and limits for Cisco IOS Firewall session activity.
show ip inspect interfaces
Displays interfaces with Cisco IOS Firewall rules applied.
show ip inspect name
Displays configuration of specific Cisco IOS Firewall rules.
show ip inspect sessions
Displays active sessions, including source and destination host addresses and port numbers.
show ip inspect statistics
Displays statistics for current active sessions, total sessions reset, session creation rate, number of sessions since Cisco IOS Firewall was configured or the router was rebooted, and other Cisco IOS Firewall statistics.
show ip inspect all
Displays all Cisco IOS Firewall information in the previous five commands.
REFERENCES
Configuring Cisco IOS Firewall Stateful Inspection: http://www.cisco.com/en/US/products/sw/iosswrel/ps1835/products_configuration_guide_chapter09186a00800ca7c5.html
Configuring HTTP application inspection: http://www.cisco.com/en/US/products/sw/iosswrel/ps5207/products_feature_guide09186a0080420260.html
Configuring granular protocol inspection: http://www.cisco.com/en/US/products/sw/iosswrel/ps5207/products_feature_guide09186a008040afd7.html
Configuring PAM: http://www.cisco.com/en/US/products/sw/iosswrel/ps1831/products_configuration_guide_chapter09186a00800d981c.html
APPENDIX 1: CISCO IOS FIREWALL STATEFUL INSPECTION PROTOCOL SUPPORT
