TFTP ALG
The Trivial File Transfer Protocol (TFTP) ALG processes TFTP packets that initiate the request to UDP destination port 69 and opens a gate to allow return packets from the reverse direction to the port that sends the request. Support of stateful firewall and NAT services requires that you configure the TFTP ALG for UDP destination port 69.
Understanding the TFTP ALG
- Overview
- TFTP Packets
- TFTP Session
- Understanding TFTP ALG Conversation
- Understanding IPv6 Support for the TFTP ALG
Overview
Trivial File Transfer Protocol (TFTP) is a simple protocol used for files transfer (RFC 1350). TFTP is implemented on top of UDP, with destination port 69 as the well-known port. The TFTP Application Layer Gateway (ALG) processes TFTP packets that initiate the request and creates pinholes to allow return packets from the reverse direction.
In flow processing there are two sessions for one TFTP conversation, one is the TFTP control session created by a read request (RRQ) or write request (WRQ) packet; the other one is the TFTP data session created by a DATA packet (for RRQ) or acknowledgment (ACK) packet (for WRQ).
In a Junos OS firewall, the TFTP control session is permitted through the junos-tftp application policy. The data session is permitted through the TFTP ALG open pinhole from any port of the server to the TID (port) of the client when the control session packet is received. No NAT translation is required, because the NAT translation has already been performed and the information is available from the session data structure.
On SRX210, SRX240, SRX320, SRX340, or SRX380 devices, broadcast TFTP is not supported when flow is enabled on the device. (Platform support depends on the Junos OS release in your installation.)
TFTP Packets
Any transfer begins with a request to read or write a file. A data packet of less than 512 bytes signals termination of a transfer.
TFTP supports five types of packets:
Read request (RRQ)
Write request (WRQ)
Data (DATA)
Acknowledgment (ACK)
Error (ERROR)
TFTP Session
The TFTP ALG is based on UDP, which is a stateless transport protocol. In a firewall, the TFTP ALG acts as a UDP session with timeout. If there is no packet refresh session, the session is terminated after timeout. Although the TFTP client and server determine the termination of a TFTP conversation, they are sometimes unaware of the session in Fireware. Therefore, the client and server could request a new TFTP conversation in this scenario.
The TFTP ALG session can proceed in any of the following ways:
When the TFTP control session reaches timeout, the session is not terminated if the data session is still alive.
A TFTP session might terminate or get corrupted by the
clear security flow session allor theclear specific sessionCLI commands regardless of whether the data session is ongoing or not.If a new TFTP session request arrives and reaches the existing session, the TFTP ALG will open the pinhole again for the new request.
If the pinhole already exists, the TFTP ALG will not open the pinhole again and there will be no packet drop.
The TFTP ALG will not drop any packet.
Understanding TFTP ALG Conversation
By default TFTP servers listen for incoming requests from TFTP clients on port 69. A TFTP client chooses its source tunnel identifier (TID) port and sends its initial request to the server. In response, the server uses the TID chosen as the source port and sends a response to the client’s TID as the destination port. The two TIDs ports are then used for the rest of the data transfer.
Read file conversation steps:
Host A (client) sends an RRQ packet to host B (server) with A’s TID as source and port 69 as destination.
Host B (server) sends a DATA packet to host A (client) with B’s TID as source and A’s TID as destination.
Host A (client) sends an ACK packet to host B (server) with A’s TID as source and B’s TID as destination.
DATA and ACK packets conversation continues until file data transferring is complete.
Write file conversation steps:
Host A (client) sends a WRQ packet to host B (server) with A’s TID as source and port 69 as destination.
Host B (server) sends an ACK packet to host A (client) with B’s TID as source and A’s TID as destination.
Host A (client) sends a DATA packet to host B (server) with A’s TID as source and B’s TID as destination.
Host B (server) sends an ACK packet to host A (client) with B’s TID as source and A’s TID as destination.
Understanding IPv6 Support for the TFTP ALG
Trivial File Transfer Protocol (TFTP) Application Layer Gateway (ALG) has been enhanced to support IPv6 and IPv4 TFTP conversation, which has IPv6 and IPv4 addresses for both the source IP address and destination IP address.
TFTP ALG processes packets that initiate the routing request and create pinholes to allow return packets from the reverse direction to the port that sent the request.
The data session is set up by the first packet from the client to the server. TFTP ALG monitors the first packet and opens a pinhole from any port on the server to the client. This process helps the return packets from the server and subsequent data packets to pass through.
Example: Configuring the TFTP ALG
The TFTP ALG processes TFTP packets that initiate the request and opens a gate to allow return packets from the reverse direction to the port that sends the request.
This example shows how to configure the TFTP ALG to pass through TFTP traffic with a source NAT pool on Juniper Networks devices.
Requirements
Configure proxy ARP for all IP addresses in the source NAT pool.
Understand the basic concepts of TFTP ALG. See Understanding the TFTP ALG.
Overview
In this example, the TFTP ALG is configured to monitor and allow TFTP traffic, transferring files between the client and server located on opposite sides of a Juniper Networks device.
Configuration
Configuring a NAT Source Pool, Rule Set, and a Policy
CLI Quick Configuration
To quickly configure this section of the example,
copy the following commands, paste them into a text file, remove any
line breaks, change any details necessary to match your network configuration,
copy and paste the commands into the CLI at the [edit] hierarchy
level, and then enter commit from configuration mode.
set security nat source pool pool1 address 10.10.10.1/32 to 10.10.10.10/32 set security zones security-zone green address-book address sa1 1.1.1.0/24 set security zones security-zone red address-book address da1 2.2.2.0/24 set security nat source rule-set rs1 from zone green set security nat source rule-set rs1 to zone red set security nat source rule-set rs1 rule r1 match source-address 1.1.1.0/24 set security nat source rule-set rs1 rule r1 match destination-address 2.2.2.0/24 set security nat source rule-set rs1 rule r1 then source-nat pool pool1
set security policy from-zone green to-zone red policy pol1 match destination-address da1 set security policy from-zone green to-zone red policy pol1 match source-address sa1 set security policy from-zone green to-zone red policy pol1 match application junos-tftp set security policy from-zone green to-zone red policy pol1 then permit
If you are not sure of the TFTP client and server IP address, you can replace “da1” and “sa1” with “any”.
Step-by-Step Procedure
The following example requires you to navigate various levels in the configuration hierarchy. For instructions on how to do that, see Using the CLI Editor in Configuration Mode in the CLI User Guide.
To configure a source NAT pool:
Create a NAT source pool.
[edit security] user@host# set nat source pool pool1 address 10.10.10.1/32 to 10.10.10.10/32
Configure security zone address book entries.
[edit security zones security-zone] user@host# set green address-book address sa1 1.1.1.0/24 user@host# set red address-book address da1 2.2.2.0/24
Create a NAT source rule set.
[edit security nat source rule-set rs1] user@host# set from zone green user@host# set to zone red user@host# set rule r1 match source-address 1.1.1.0/24 user@host# set rule r1 match destination-address 2.2.2.0/24 user@host# set rule r1 then source-nat pool pool1
Configure a policy
[edit security policies from-zone green to-zone red policy pol1] user@host# set match source-address sa1 user@host# set match destination-address da1 user@host# set match application junos-tftp user@host# set then permit
Results
From configuration mode, confirm your configuration
by entering the show security nat and show security
policies commands. If the output does not display the intended
configuration, repeat the configuration instructions in this example
to correct it.
[edit]
user@host# show security nat
source {
pool pool1 {
address {
10.10.10.1/32 to 10.10.10.10/32;
}
}
rule-set rs1 {
from zone green;
to zone red;
rule r1 {
match {
source-address 1.1.1.0/24;
destination-address 2.2.2.0/24;
}
then {
source-nat {
pool {
pool1;
}
}
}
}
}
[edit]
user@host# show security policies
from-zone green to-zone red {policy pol1 {
policy pol1 {
match {
source-address sa1;
destination-address da1;
application [junos-tftp];
}
then {
permit;
}
}
}
default-policy {
permit-all;
}
If you are done configuring the device, enter commit from configuration mode.
Verification
Confirm that the configuration is working properly.
Verifying the NAT Source Pool and Rule Set
Purpose
Verify that the NAT source pool and rule set used to support the TFTP ALG are working properly.
Action
From operational mode, enter the show security
nat static rule r1 command.
Verifying TFTP ALG
Purpose
Verify that the TFTP ALG is enabled.
Action
From operational mode, enter the show security
alg status command.
user@host> show security alg status DNS : Enabled FTP : Enabled H323 : Enabled TFTP : Enabled
Meaning
The output shows the TFTP ALG status as follows:
Enabled—Shows the TFTP ALG is enabled.
Disabled—Shows the TFTP ALG is disabled.