[Contents] [Prev] [Next] [Index] [Report an Error]

Configuring Application Protocol Conditions

You can define application protocols for the stateful firewall and NAT services to use in match condition rules. An application protocol defines application parameters by using information from network layer 3 and above. Examples of such applications are FTP and H.323.

Use the following configuration statements to add application protocol conditions to a classify-traffic condition:



policies group  name  list  name  rule  name  traffic-condition  name  application-protocol-condition  name  {
protocol  protocol ; 
application-protocol  application-protocol ; 
idle-timeout  idle-timeout ; 
dce-rpc-uuid  dce-rpc-uuid ; 
rpc-program-number  rpc-program-number ; 
snmp-command  snmp-command ; 
ttl-threshold  ttl-threshold ; 
}
policies group  name  list  name  rule  name  traffic-condition  name  application-protocol-condition  name  proto-attr {
icmp-type  icmp-type ; 
icmp-code  icmp-code ; 
}
policies group  name  list  name  rule  name  traffic-condition  name  application-protocol-condition  name  proto-attr destination-port port
{
from-port  from-port ; 
}
policies group  name  list  name  rule  name  traffic-condition  name  application-protocol-condition  name  proto-attr source-port port {
from-port  from-port ; 
}

To add application protocol conditions to a classify-traffic condition:

From configuration mode, enter the application protocol configuration. In this procedure, apc is the name of the application protocol condition. For example:
(Optional) Configure the network protocol to match.
(Optional) Configure the application protocol to match.
(Optional) Configure the length of time the application is inactive before it times out.
(Optional) For the DCE RPC application protocol, configure the universal unique identifier (UUID).
(Optional) For the remote procedure call (RPC) application protocol, configure an RPC program number.
(Optional) Configure the SNMP command for packet matching.
(Optional) For the traceroute application protocol, configure the traceroute time-to-live (TTL) threshold value. This value sets the acceptable level of network penetration for trace routing.
(Optional) Enter configuration mode for the protocol attribute.
(Optional) For the ICMP protocol, configure the ICMP packet type.
(Optional) For the ICMP protocol, configure the ICMP code.
(Optional) Enter the destination port configuration.
(Optional) Configure the TCP or UDP destination port.
(Optional) Enter the source port configuration.
(Optional) Configure the TCP or UDP source port.

(Optional) Verify the application protocol condition configuration.

[edit policies group junos list staticnat rule nat traffic-condition ctc application-protocol-condition apc]
user@host# show 
protocol ip;
application-protocol dce_rpc;
idle-timeout 900;
dce-rpc-uuid dce_rpc;
snmp-command get;
ttl-threshold 25;
proto-attr {
  icmp-type icmpType;
  icmp-code icmpCode;
  destination-port {
    port {
      from-port 11..655;
    }
  }
  source-port {
    port {
      from-port service_port;
    }
  }
}

Configuring Application Protocol Conditions

Related Topics