7.7 Partial Retirement of Protocol Inspector
Prev | Chapter 7 Traffic Policy | Next

## 7.7 Partial Retirement of Protocol Inspector

Under certain circumstances, appliance of a protocol inspector to a particular communication might be undesirable. To disable specific protocol inspection, define corresponding source and destination IP addresses and a traffic rule for this service that will define explicitly that no protocol inspector will be used.

### Example

A banking application (client) communicates with the bank's server through its proper protocol which uses TCP protocol at the port `2000`. Supposing the banking application is run on a host with IP address `192.168.1.15` and it connects to the server `server.bank.com`.

This port is used by the Cisco SCCP protocol. The protocol inspector of the SCCP would be applied to the traffic of the banking client under normal circumstances. However, this might affect functionality of the application or endanger its security.

A special traffic rule, as follows, will be defined for all traffic of the banking application:

1. In the Configuration → Definitions → Services section, define a service called Internet Banking: this service will use TCP protocol at the port `2000` and no protocol inspector is used by this communication.

   Figure 7.37. Service definition without inspector protocol

2. In the Configuration → Traffic Policy section, create a rule which will permit this service traffic between the local network and the bank's server. Specify that no protocol inspector will be applied.

   Figure 7.38. This traffic rule allows accessing service without protocol inspection

   Note: In the default configuration of the Traffic rules section, the Protocol inspector column is hidden. To show it, modify settings through the Modify columns dialog (see chapter 3.2 Administration Console - view preferences).

### Warning

To disable a protocol inspector, it is not sufficient to define a service that would not use the inspector! Protocol inspectors are applied to all traffic performed by corresponding protocols by default. To disable a protocol inspector, special traffic rules must be defined.

Prev | Up | Next
7.6 User accounts and groups in traffic rules | Contents | 7.8 Use of Full cone NAT