ASA SunRPC inspection

Unanswered Question
Jun 8th, 2010
User Badges:

I would like to understand what configuration pieces need to be in place for SunRPC inspection to work properly. I have the following scenario: NFS server is on higher security interface, and NFS clients are on lower security interface. I have default sunrpc inspection enabled on UDP port 111. Also, I added TCP port 111 inspection because I saw from capture information that SUSE system were using TCP instead of UDP for port mapper process.

class-map SUNRPC-TCP
match port tcp eq sunrpc
class-map inspection_default
match default-inspection-traffic
policy-map global_policy
class inspection_default
  inspect sunrpc
  inspect sunrpc
service-policy global_policy global

Clinets that use UDP are can mount file shares, but SUSE systems, which use TCP can not until I added the following command.

sunrpc-server High_Interface service 100005 protocol TCP port 111 timeout 0:01:00

Inspecting global service policy counters confims that SUNRPC-TCP class-map does not register any hit counts.

Global policy:
  Service-policy: global_policy
    Class-map: inspection_default
      Inspect: sunrpc, packet 208, drop 0, reset-drop 0
    Class-map: SUNRPC-TCP
      Inspect: sunrpc, packet 0, drop 0, reset-drop 0

rpcinfo command on NFS server produces the following output (I removed /* Style Definitions */ table.MsoNormalTable {mso-style-name:"Table Normal"; mso-tstyle-rowband-size:0; mso-tstyle-colband-size:0; mso-style-noshow:yes; mso-style-priority:99; mso-style-qformat:yes; mso-style-parent:""; mso-padding-alt:0in 5.4pt 0in 5.4pt; mso-para-margin-top:0in; mso-para-margin-right:0in; mso-para-margin-bottom:10.0pt; mso-para-margin-left:0in; line-height:115%; mso-pagination:widow-orphan; font-size:11.0pt; font-family:"Calibri","sans-serif"; mso-ascii-font-family:Calibri; mso-ascii-theme-font:minor-latin; mso-fareast-font-family:"Times New Roman"; mso-fareast-theme-font:minor-fareast; mso-hansi-font-family:Calibri; mso-hansi-theme-font:minor-latin;} irrelevant program numbers for this discussions):

nbmaster ## rpcinfo -p
   program vers proto   port  service
    100003    2   udp   2049  nfs
    100003    3   udp   2049  nfs
    100003    2   tcp   2049  nfs
    100003    3   tcp   2049  nfs
    100005    3   tcp   1234  mountd
    100005    2   tcp   1234  mountd
    100005    1   tcp   1234  mountd
    100005    3   udp   1234  mountd
    100005    2   udp   1234  mountd
    100005    1   udp   1234  mountd
    100000    2   udp    111  rpcbind
    100000    2   tcp    111  rpcbind

I would appreciate if someone who really understands how sunrpc inspection works explains to me the follwoing questions:

1) What is exactly the purpose of sunrpc-server commands, and how are they different from service policy inspect commands?

2) Why my "SUNRPC-TCP" class-map does not seem to work, but "sunrpc-server" command seems to do the trick for systems that use TCP for port mapper process?

Thank you in advance,

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
sam mackenzie Wed, 03/07/2012 - 05:56
User Badges:

Hi there, this is kind of a bump since I'm also looking at an issue with SUNRPC, which doesn't work under inspection but we have to use 1-1 NAT so suspect there's no way around this unfortunately.

Was hoping if someone who might be able to answer frame6500's questions might also be able to advise if this will ever work, and if not - why not?

I can provide specific info if required to my issue however the basic config is that two sets of servers communicate using SUNRPC and the return traffic is denied, however all we've done for configuration is to allow in the default inspection traffic SUNRPC inspection. NAT is configured also. 




This Discussion