Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

TFTP ALG

 

The Trivial File Transfer Protocol (TFTP) ALG processes TFTP packets that initiate the request to UDP destination port 69 and opens a gate to allow return packets from the reverse direction to the port that sends the request. Support of stateful firewall and NAT services requires that you configure the TFTP ALG for UDP destination port 69.

Understanding the TFTP ALG

Overview

Trivial File Transfer Protocol (TFTP) is a simple protocol used for files transfer (RFC 1350). TFTP is implemented on top of UDP, with destination port 69 as the well-known port. The TFTP Application Layer Gateway (ALG) processes TFTP packets that initiate the request and creates pinholes to allow return packets from the reverse direction.

In flow processing there are two sessions for one TFTP conversation, one is the TFTP control session created by a read request (RRQ) or write request (WRQ) packet; the other one is the TFTP data session created by a DATA packet (for RRQ) or acknowledgment (ACK) packet (for WRQ).

In a Junos OS firewall, the TFTP control session is permitted through the junos-tftp application policy. The data session is permitted through the TFTP ALG open pinhole from any port of the server to the TID (port) of the client when the control session packet is received. No NAT translation is required, because the NAT translation has already been performed and the information is available from the session data structure.

On SRX210, SRX240, SRX320, SRX340, or SRX380 devices, broadcast TFTP is not supported when flow is enabled on the device. (Platform support depends on the Junos OS release in your installation.)

TFTP Packets

Any transfer begins with a request to read or write a file. A data packet of less than 512 bytes signals termination of a transfer.

TFTP supports five types of packets:

  • Read request (RRQ)

  • Write request (WRQ)

  • Data (DATA)

  • Acknowledgment (ACK)

  • Error (ERROR)

TFTP Session

The TFTP ALG is based on UDP, which is a stateless transport protocol. In a firewall, the TFTP ALG acts as a UDP session with timeout. If there is no packet refresh session, the session is terminated after timeout. Although the TFTP client and server determine the termination of a TFTP conversation, they are sometimes unaware of the session in Fireware. Therefore, the client and server could request a new TFTP conversation in this scenario.

The TFTP ALG session can proceed in any of the following ways:

  • When the TFTP control session reaches timeout, the session is not terminated if the data session is still alive.

  • A TFTP session might terminate or get corrupted by the clear security flow session all or the clear specific session CLI commands regardless of whether the data session is ongoing or not.

  • If a new TFTP session request arrives and reaches the existing session, the TFTP ALG will open the pinhole again for the new request.

  • If the pinhole already exists, the TFTP ALG will not open the pinhole again and there will be no packet drop.

  • The TFTP ALG will not drop any packet.

Understanding TFTP ALG Conversation

By default TFTP servers listen for incoming requests from TFTP clients on port 69. A TFTP client chooses its source tunnel identifier (TID) port and sends its initial request to the server. In response, the server uses the TID chosen as the source port and sends a response to the client’s TID as the destination port. The two TIDs ports are then used for the rest of the data transfer.

Read file conversation steps:

  1. Host A (client) sends an RRQ packet to host B (server) with A’s TID as source and port 69 as destination.
  2. Host B (server) sends a DATA packet to host A (client) with B’s TID as source and A’s TID as destination.
  3. Host A (client) sends an ACK packet to host B (server) with A’s TID as source and B’s TID as destination.
  4. DATA and ACK packets conversation continues until file data transferring is complete.

Write file conversation steps:

  1. Host A (client) sends a WRQ packet to host B (server) with A’s TID as source and port 69 as destination.
  2. Host B (server) sends an ACK packet to host A (client) with B’s TID as source and A’s TID as destination.
  3. Host A (client) sends a DATA packet to host B (server) with A’s TID as source and B’s TID as destination.
  4. Host B (server) sends an ACK packet to host A (client) with B’s TID as source and A’s TID as destination.

Understanding IPv6 Support for the TFTP ALG

Trivial File Transfer Protocol (TFTP) Application Layer Gateway (ALG) has been enhanced to support IPv6 and IPv4 TFTP conversation, which has IPv6 and IPv4 addresses for both the source IP address and destination IP address.

TFTP ALG processes packets that initiate the routing request and create pinholes to allow return packets from the reverse direction to the port that sent the request.

The data session is set up by the first packet from the client to the server. TFTP ALG monitors the first packet and opens a pinhole from any port on the server to the client. This process helps the return packets from the server and subsequent data packets to pass through.

Example: Configuring the TFTP ALG

The TFTP ALG processes TFTP packets that initiate the request and opens a gate to allow return packets from the reverse direction to the port that sends the request.

This example shows how to configure the TFTP ALG to pass through TFTP traffic with a source NAT pool on Juniper Networks devices.

Requirements

  • Configure proxy ARP for all IP addresses in the source NAT pool.

  • Understand the basic concepts of TFTP ALG. See Understanding the TFTP ALG.

Overview

In this example, the TFTP ALG is configured to monitor and allow TFTP traffic, transferring files between the client and server located on opposite sides of a Juniper Networks device.

Configuration

Configuring a NAT Source Pool, Rule Set, and a Policy

CLI Quick Configuration

To quickly configure this section of the example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, copy and paste the commands into the CLI at the [edit] hierarchy level, and then enter commit from configuration mode.

Note

If you are not sure of the TFTP client and server IP address, you can replace “da1” and “sa1” with “any”.

Step-by-Step Procedure

The following example requires you to navigate various levels in the configuration hierarchy. For instructions on how to do that, see Using the CLI Editor in Configuration Mode in the CLI User Guide.

To configure a source NAT pool:

  1. Create a NAT source pool.
  2. Configure security zone address book entries.
  3. Create a NAT source rule set.
  4. Configure a policy

Results

From configuration mode, confirm your configuration by entering the show security nat and show security policies commands. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

If you are done configuring the device, enter commit from configuration mode.

Verification

Confirm that the configuration is working properly.

Verifying the NAT Source Pool and Rule Set

Purpose

Verify that the NAT source pool and rule set used to support the TFTP ALG are working properly.

Action

From operational mode, enter the show security nat static rule r1 command.

Verifying TFTP ALG

Purpose

Verify that the TFTP ALG is enabled.

Action

From operational mode, enter the show security alg status command.

user@host> show security alg status

Meaning

The output shows the TFTP ALG status as follows:

  • Enabled—Shows the TFTP ALG is enabled.

  • Disabled—Shows the TFTP ALG is disabled.

Related Documentation