ASA and Dynamic Opening of MS-RPC Ports

fahim_mohd · ‎06-18-2009

Hi team

can anyone shed light on whether Cisco ASA 8.0 and higher can support MS-RPC dynamic port assignment. Instead of opening High Ports 1025-65535 for MS-RPC Services, does ASA has an Application inspection and Predefined Service for MS-RPC-ANY, whereby it intelligently allows Client-Server connection using pin-holes and closes dynamically.

Kureli Sankar · ‎06-18-2009

Yes it does. Pls. read here:

http://www.cisco.com/en/US/docs/security/asa/asa80/command/reference/i2.html#wp1725357

Sample config is there in the above link as well.

mravibhavi · ‎08-08-2019

the link which you have shared is not working

Kirupairajah Satheeskumar · ‎04-24-2014

Since RPC use Random ports above 1024, need to be pin holed. RPC Endpoint Mapper (EPM) running on TCP135 will be queried for random ports. So that tcp 135 should be allowed in ACL and the below policy map will be configured to allow RPC under global_policy map.

policy-map type inspect dcerpc dcerpc_map
parameters
timeout pinhole 0:10:00

class-map dcerpc
match port tcp eq 135

policy-map global_policy
class dcerpc
inspect dcerpc dcerpc_map

verify the above using #show run policy map

Satheesh CCIE# 38651 R&S