© 2005 Cisco Systems, Inc. All rights reserved.
Important notices, privacy statements, and trademarks of Cisco Systems, Inc. can be found on cisco.com.
Page 7 of 20
FEATURES AND BENEFITS OF CISCO ASA SOFTWARE VERSION 7.0
Cisco ASA Software Version 7.0 for Cisco ASA 5500 Series adaptive security appliances provides a wealth of features, including those detailed in
Table 1. A complete list of features is available in the release notes.
Table 1.
Features and Benefits of Cisco ASA Software Version 7.0
Feature
Benefit
Application Security Services
Advanced Application
Inspection and Control
Services
•
Integrates 30 specialized inspection engines that provide rich application control and security services for
protocols such as Hypertext Transfer Protocol (HTTP), File Transfer Protocol (FTP), Extended Simple Mail
Transfer Protocol (ESMTP), Domain Name System (DNS), Simple Network Management Protocol (SNMP),
Internet Control Message Protocol (ICMP), SQL*Net, Network File System (NFS), H.323 Versions 1–4, Session
Initiation Protocol (SIP), Cisco Skinny Client Control Protocol (SCCP), Media Gateway Control Protocol (MGCP),
Real-Time Streaming Protocol (RTSP), Telephony Application Programming Interface (TAPI) and Java Telephony
Application Programming Interface (JTAPI) over Computer Telephony Interface Quick Buffer Encoding (CTIQBE)
protocol, GPRS Tunneling Protocol (GTP), Lightweight Directory Access Protocol (LDAP), Internet Locator Service
(ILS), Sun Remote Procedure Call (RPC), and many more
Advanced Web Security
Services
•
Enables deep inspection services for Web traffic, which provide granular control over HTTP sessions for improved
protection from a wide range of Web-based attacks
•
Gives businesses precise control over what HTTP commands or methods can be used on a per-flow basis
(different policy for traffic coming from Internet vs. traffic coming from a staging Web server to production Web
server, for example), thus protecting businesses from a variety of Web-based attacks, including unauthorized
deletion or modification of Web content
•
Delivers a wide range of additional powerful HTTP security services, including RFC compliance enforcement,
protocol anomaly detection, protocol state tracking, response validation, Multipurpose Internet Mail Extensions
(MIME) type validation and content control, Uniform Resource Identifier (URI) length enforcement, and more
Tunneling Application
Control
•
Provides advanced inspection services to detect and optionally block instant messaging, peer-to-peer file sharing,
and other applications tunneling through Web application ports
•
Blocks popular instant messaging applications such as AOL Instant Messenger, Microsoft Messenger, and Yahoo
Messenger
•
Stops peer-to-peer file sharing applications such as KaZaA and Gnutella
•
Thwarts tunneling applications such as GoToMyPC
FTP Security Services
•
Delivers advanced FTP inspection services, including protocol anomaly detection, protocol state tracking, Network
Address Translation (NAT) and Port Address Translation (PAT) support, and dynamic port opening and closing
•
Gives administrators greater control over the use of numerous FTP commands, allowing them to have the security
appliance enforce what operations users and groups can perform within FTP sessions (such as FTP gets and
puts)
•
Provides server obfuscation techniques and additional attack signatures to further protect FTP servers from attack
ESMTP E-Mail Security
Services
•
Supports ESMTP security inspection services including protocol anomaly detection, protocol state tracking, and
support for the following new commands introduced in ESTMP protocol: AUTH, DATA, EHLO, ETRN, HELO,
HELP, MAIL, NOOP, QUIT, RCPT, RSET, SAML, SEND, SOML, and VRFY
•
Protects businesses from malicious SMTP and ESTMP commands with automatic command filtering
SNMP Security Services
•
Delivers SNMP filtering services allowing administrators to maintain a consistent version of the SNMP protocol
flowing through their networks
•
Provides version filtering for all SNMP traffic attempting to flow through a Cisco ASA 5500 Series appliance,
supporting filtering of SNMP versions 1, 2, 2c, and 3
ICMP Security Services
•
Enables secure usage of ICMP for troubleshooting and improved network performance by providing state tracking
services for ICMP connections, as well as providing additional controls for ICMP error messages
Sun RPC and Network
Information Service Plus
•
Includes support for port-hopping UNIX applications through stateful inspection and NAT services for Sun RPC
and NIS+ sessions transactions that use Portmapper v2 or RPCBind v3 or v4
