| 3.6 |  | Task 4: Define Inspection Rules |
| 3.6.2 |  | Inspection rules for applications |

| Application protocols To define a set of inspection rules, use the ip inspect name command in global configuration mode. Use the no form of this command to remove the inspection rule for a protocol or to remove the entire set of inspection rules. The syntax for the ip inspect name command is shown in Figures and .

To view additional syntax and information regarding the Inspection Rules for Application Protocols please see the Online Command Reference.

Java applications
Before looking at how and why Java inspection is necessary, it is necessary to have a basic understanding of the protocol. Java is a general purpose programming language with a number of features that make the language well suited for use on the World Wide Web. Applets are small Java applications which can be downloaded from a Web server and run with a Java-compatible Web browser.

Java inspection enables Java applet filtering at the firewall. Java applet filtering distinguishes between trusted and untrusted applets by relying on a list of external sites that are designated as friendly. If an applet is from a friendly site, the firewall allows the applet through. If the applet is not from a friendly site, the applet will be blocked. Alternately, it is possible to permit applets from all sites except for sites specifically designated as hostile.

The syntax for the ip inspect name command for Java applet filtering inspection is shown in Figure .

To view additional syntax and information regarding the Inspection Rules for Java please see the Online Command Reference.

RPC applications
Before looking at how and why Remote Procedure Call (RPC) Application Inspection is necessary, it is necessary to have a basic understanding of the protocol. RPC is an independent set of functions used for accessing remote nodes on a network. Using RPC network services, applications can be created in much the same way a programmer writes software for a single computer using local procedure calls. The RPC protocols extend the concept of local procedure calls across the network, which means that administrators can develop distributed applications for transparent execution across a network.

RPC inspection enables the specification of various program numbers. It is possible to define multiple program numbers by creating multiple entries for RPC inspection, each with a different program number. If a program number is specified, all traffic for that program number will be permitted. If a program number is not specified, all traffic for that program number will be blocked. For example, if an RPC entry is created with the NFS program number, all NFS traffic will be allowed through the firewall.

The syntax of the ip inspect name command for RPC applications is shown in Figures and .

SMTP applications
Before looking at how and why SMTP inspection is necessary, it is necessary to have a basic understanding of the protocol. The SMTP is a common mechanism for transporting e-mail among different hosts within IP.

Under SMTP, a user SMTP process opens a TCP connection to a server SMTP process on a remote host and attempts to send mail across the connection. The server SMTP listens for a TCP connection on port 25, a well-known port, and the user SMTP process initiates a connection on that port. When the TCP connection is successful, the two processes execute a simple request/response dialogue, defined by the SMTP protocol, in which the user process transmits the mail addresses of the originator and the recipient(s) of a message. When the server process accepts these mail addresses, the user process transmits the message. The message must contain a message header and message text formatted in accordance with RFC 822.

SMTP inspection causes SMTP commands to be inspected for illegal commands. Any packets with illegal commands are dropped, and the SMTP session hangs and eventually times out. An illegal command is any command except for the legal commands DATA, EXPN, HELO, HELP, MAIL, NOOP, QUIT, RCPT, RSET, SAML, SEND, SOML, and VRFY.

| Lab Activity e-Lab Activity: Inspection Rules and ACLs Applied to Router Interfaces In this activity students will configure the router to allow all general TCP, UDP, and ICMP traffic initiated on the inside from the 10.0.0.0 network.