Cisco ASA RPC inspection

[PinkoCommie]

First off, let me explain that I hate PIX and ASA with a passion. I'm a Checkpoint guy.

We have a client who wants to open port 135 to one of his internal servers from the internet for Certificate Services.

Yes I know it's a bad idea to open RPC to the internet, but its what they want and they won't listen to me, so to make it secure I want to lock it down with some RPC inspection for the particular UUID.

The firewall is an ASA5520 running 7.0(7)

I can't seem to find any reference either way as to whether I can inspect RPC traffic for a particular UUID and allow/disallow the traffic based on this.

I know you can do it on a Juniper or a Checkpoint, so I don't see why you wouldn't be able to do it on an ASA.

Also, anyone know what the UUID for CertSvc actually is?

 

[Phill1978]

cli or asdm?

 

[PinkoCommie]

cli or asdm?

Preferably CLI. (As asdm sucks balls)

 

[PinkoCommie]

I reckon I need something like this:

policy-map type inspect dcerpc CertSvc_map
description Inspection for RPC CertSvc
parameters
endpoint-mapper [service-only] [lookup-operation[timeout hh:mm:ss]]

Not quite sure what values I can use in the endpoint-mapper bit though. (or even if it will take UUID's to filter on. from what I can figure, it can't)