What does the Fixup protocol essentially do?

[gman10]

Hi guys,

I have a general idea but can someone walk my thru this protocol and whats it's nature is... would the pix work without implementing it at all..

thanks

GT

 

[irregular]

gman10,

PIX fixup is related to advance protocol handling. This helps certain protocol that have problems operating with the basic idea of the PIX's Adaptive Security Algorithm (i.e. Allow all outbound connections unless explicitly denied and deny all inbound connections unless explicitly allowed).

Essentially port communication that is negotiated at the application layer, can allow a "fixed up" protocol to dynamically bypass the ASA. This means that dynamically assigned ports used in FTP and Multimedia applications can work correctly through the PIX.

Fixup also knows the correct use of protocols, and can protect against known exploits or "badly behaving" hosts.

A better explanation can be found at:

http://www.cisco.com/en/US/products...figuration_guide_chapter09186a008017278b.html

I hope this helps,

Irregular