| 12.1 |  | Advanced Protocols |
| 12.1.1 |  | Need for advanced protocol handling |

| This section discusses the configuration and handling of the File Transfer Protocol (FTP), remote shell (rsh), and Structured Query Language (SQL) protocols. In recent years, corporate business transactions conducted over the Internet have increased tremendously. However, with this new method of conducting business, new threats have also emerged. As this course has shown, firewalls are one of the primary methods used to prevent these threats. Firewalls allow corporations to keep their internal networks secure from potential threats, without compromising on-line business transactions.

While firewalls help protect many internal networks of a corporation from external threats, firewalls have also had some historical limitations. One of the primary limitations of traditional firewalls was that they did not pass traffic using protocols that utilized dynamically assigned source and destination ports or dynamically assigned IP addresses. Many of these protocols, such as FTP, Hypertext Transfer Protocol (HTTP), H.323, and SQL*Net, are common protocols that businesses regularly need for communication.

Modern firewalls, such as the PIX, have been designed to work with protocols and applications that use dynamically assigned ports and IP addresses. To do this, they inspect packets above the network layer and perform the following tasks as required by the protocol or application:

- Securely open and close negotiated ports or IP addresses for legitimate client server connections through the firewall
- Use Network Address Translation (NAT) to find relevant instances of IP addresses inside a packet
- Use Port Address Translation (PAT) to find relevant instances of ports inside a packet
- Inspect packets for signs of malicious application misuse

In the upcoming sections of this module, students will examine how to configure the PIX Security Appliance to allow required protocols or applications through, even if the protocols or applications use dynamically assigned ports and IP addresses.