tftp inspect on ACE v.3.2a

[axfalk]

Does anyone happen to know if ACE 3.2a has the tftp inspect?

Thanks...

[amacuz · Accepted solution]

Hi axfalk,

you can refer to this document

http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/ace/vA2_3_0/configuration/security/guide/appinsp.html

where is said that the ACE does not support TFTP fixup.

Hope this helps,

Alessandro

[axfalk]

Thanks for your response. Is that because TFTP creates a separate data flow?

Thanks again...

[Surya ARBY]

make a persistance on source ip and enable the source NAT for servers through the VIP address. The default gateway has to be the ACE.

[axfalk]

Thanks for your response. We're running in a brideg mode, so  the servers' default gateway is the upstream switch..Would it still be possible?

Thanks again..

[amacuz]

Hi axfalk,

if the inspection of the protocol is not required here but just loadblancing the TFTP requests, you can refer to this document then where the TFTP load-balancing is explained:

https://supportforums.cisco.com/docs/DOC-13771

Also based on the topic of a community you may also have a look at the Documents section to see if the topic of your interested has been already discussed.

I hope you'll find it useful :-).

Give it a try and feel free to post your questions.

Alessandro

[axfalk]

Allesandro, thanks for pointing me to the doc - it's helpful. The question that I have is why it would not work in bridge mode?

Thanks again...

_ Greg

[amacuz]

Hi Greg,

the translation of the source address in a flow is something that normally is required in a bridge-mode environment and this what the document I have sent to you says.

I think you have to src NAT also the flow from the client to the server. Could you post here your configuration relevant for this issue?

Alessandro