| 12.1 |  | Advanced Protocols |
| 12.1.2 |  | fixup command |

| The fixup command enables administrators to change, enable, or disable the use of a service or protocol throughout the PIX Security Appliance. The PIX Security Appliance allows administrators to specify the ports that it monitors for each service. The port number can be changed for each service except rsh.

Some applications such as FTP require that the PIX Security Appliance understand special properties of the application so that connections that are legitimately part of the application are permitted. During an FTP transfer, the PIX Security Appliance needs to be aware of the second data channel that is opened from the server to the initiating workstation. The PIX Security Appliance identifies applications by the TCP or UDP port number contained in the IP packets. For example, the PIX Security Appliance recognizes FTP by port number 21, SMTP by port number 25, and HTTP by port number 80.

For the most part, there is no reason to change these port numbers. But in special circumstances a service may listen on a non-standard port number. For example, an HTTP server may listen on port 5000, but the PIX Security Appliance would not recognize that port 5000 is being used for HTTP and will block the returned HTTP data connection from the server. This problem could be resolved by adding port 5000 to the fixup protocol command. In this instance, the command would look like

> fixup protocol http 5000

This command enables the PIX Security Appliance to recognize that connections to port 5000 should be treated in the same manner as connections to port 80.

The PIX Security Appliance security features are based on checking and changing, or fixing up, information in packets sent over a network. Different network protocols, such as SMTP for mail transfer, include protocol- specific information in the packets. The protocol fix up for SMTP packets includes changing addresses embedded in the payload of packets, checking for supported commands, and replacing bad characters.

By default, the PIX Security Appliance is configured to fix up the protocols listed in Figure . Each of these protocols and the corresponding fixup protocol command will now be examined in greater detail.