O'Reilly logo

ScreenOS Cookbook by Sunil Wadhwa, Joe Kelly, Ken Draper, David Delcourt, Vik Davar, Stefan Brunner

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

11.10. View the Dynamic Port(s) Associated with a Sun-RPC Session

Problem

You want to view the dynamic TCP/UDP port associated with a Sun-RPC firewall session.

Solution

Figure 11-4 shows a topology whereby a host on the Trust zone of the Inside_FW firewall mounts an exported filesystem from an NFS server running on the Unix Server located on the DMZ zone.

Viewing Sun-RPC ALG sessions

Figure 11-4. Viewing Sun-RPC ALG sessions

The following policies, using the Sun-RPC-Mounted and Sun-RPC-NFS services that rely on the Sun-RPC ALG, permit this connection:

	Inside_FW-> set policy id 86 from Trust to DMZ NFS_Client Unix_Server
	SUN-RPC-MOUNTD permit log
	Inside_FW->set policy id 87 from Trust to DMZ NFS_Client Unix_Server
	SUN-RPC-NFS permit log

The TCP/UDP ports associated with the NFS Mount session are seen here:

	Inside_FW-> get session src-ip 192.168.99.212 dst-ip 172.30.0.46

Discussion

As discussed in Recipe 7.16, services on Unix hosts that rely on Sun-RPC use a well-known but unique program number as an identifier and register the dynamic TCP/UDP port they are listening on with the portmapper service on that host. The portmapper service runs on TCP/UDP 111.

Hence, a client application that needs to connect to a Sun-RPC service, such as the NFS daemon, first contacts the portmapper service on the server with the particular program number. The portmapper service returns the TCP/UDP port associated with the program number. Then, ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required