Cisco Systems ASA 5585-X Manual De Usuario

ciscoasa(config)# policy-map netbios_policy

ciscoasa(config-pmap)# class inspection_default

ciscoasa(config-pmap-c)# inspect netbios netbios_map

PPTP is a protocol for tunneling PPP traffic. A PPTP session is composed of one TCP channel and 
usually two PPTP GRE tunnels. The TCP channel is the control channel used for negotiating and 
managing the PPTP GRE tunnels. The GRE tunnels carries PPP sessions between the two hosts.

When enabled, PPTP application inspection inspects PPTP protocol packets and dynamically creates the 
GRE connections and xlates necessary to permit PPTP traffic. Only Version 1, as defined in RFC 2637, 
is supported. 

PAT is only performed for the modified version of GRE [RFC 2637] when negotiated over the PPTP TCP 
control channel. Port Address Translation is not performed for the unmodified version of GRE [RFC 
1701, RFC 1702].

Specifically, the ASA inspects the PPTP version announcements and the outgoing call request/response 
sequence. Only PPTP Version 1, as defined in RFC 2637, is inspected. Further inspection on the TCP 
control channel is disabled if the version announced by either side is not Version 1. In addition, the 
outgoing-call request and reply sequence are tracked. Connections and xlates are dynamic allocated as 
necessary to permit subsequent secondary GRE data traffic.

The PPTP inspection engine must be enabled for PPTP traffic to be translated by PAT. Additionally, PAT 
is only performed for a modified version of GRE (RFC2637) and only if it is negotiated over the PPTP 
TCP control channel. PAT is not performed for the unmodified version of GRE (RFC 1701 and 
RFC 1702).

As described in RFC 2637, the PPTP protocol is mainly used for the tunneling of PPP sessions initiated 
from a modem bank PAC (PPTP Access Concentrator) to the headend PNS (PPTP Network Server). 
When used this way, the PAC is the remote client and the PNS is the server.

However, when used for VPN by Windows, the interaction is inverted. The PNS is a remote single-user 
PC that initiates connection to the head-end PAC to gain access to a central network.

This section describes the IM inspection engine. This section includes the following topics:

ESMTP application inspection provides improved protection against SMTP-based attacks by restricting 
the types of SMTP commands that can pass through the ASA and by adding monitoring capabilities. 

ESMTP is an enhancement to the SMTP protocol and is similar is most respects to SMTP. For 
convenience, the term SMTP is used in this document to refer to both SMTP and ESMTP. The 
application inspection process for extended SMTP is similar to SMTP application inspection and