Got a little bit confused about ALGs. Could somebody clarify?
1) What is the difference between <alg> and <application-protocol> in configuration?
ch@test# set applications application test term 1 alg ?
Possible completions:
dns Domain Name Service
ftp File Transfer Protocol
http Hypertext Transfer Protocol
https Hypertext Transfer Protocol
...
ch@test# set applications application test application-protocol ?
Possible completions:
dns Domain Name Service
ftp File Transfer Protocol
http Hypertext Transfer Protocol
https Hypertext Transfer Protocol
...
2) What for do I need <term> under application configuration? Why under application configuration I can refer only to <application-protocol> and under application->term to <alg>?
3) Do I need to explicitly refer to an application in a policy? Or using <application any> is enough?
It is not a pure ALG question, but not sure if I refer to <application any> in the policy what a system will do?
It will check traffic against all default applications? And if some application implies ALG, and traffic hits this application, ALG will take action?
Or the system will check traffic against this peice of configurations:
ch@test> show configuration groups junos-defaults applications application any
term t1 protocol 0;
(have no idea what <protocol 0> means; HOPOPT or just any ip protocol?)
And I will not see any ALGs in action?
4) What does that mean:
ch@test# run show security alg status
ALG Status :
DNS : Enabled
FTP : Enabled
H323 : Enabled
MGCP : Enabled
MSRPC : Enabled
PPTP : Enabled
RSH : Enabled
RTSP : Enabled
SCCP : Enabled
SIP : Enabled
SQL : Enabled
SUNRPC : Enabled
TALK : Enabled
TFTP : Enabled
IKE-ESP : Disabled
For example, I don't have any configured applications. So, that means that system already has predefined applications that use these ALGs. Or that just means that the system is eligible to use ALGs with status <Enabled> regardless whether they exist in configuration or not?
If yes and If ALG is <Disabled>, system is not eligeble to use this ALG even if some application refers to it?
5) Why some some ALGs/application protocols are not shown here:
ch@test# run show security alg status
ALG Status :
DNS : Enabled
FTP : Enabled
H323 : Enabled
MGCP : Enabled
MSRPC : Enabled
PPTP : Enabled
RSH : Enabled
RTSP : Enabled
SCCP : Enabled
SIP : Enabled
SQL : Enabled
SUNRPC : Enabled
TALK : Enabled
TFTP : Enabled
IKE-ESP : Disabled
For example, http/https.
6) ALGs monitor packets's payload, since they need to check the application level?
So they work in the same manner as AppID?
Edited: I don't mean that ALGs use the same algorithm as AppID. But the same approach. They wait for packets with payload, look inside and take some action after.