Such applications include the File Transfer Protocol (FTP) and various IP telephony protocols.

Although there are other ScreenOS features, such as deep inspection, in which the gateway inspects traffic at the application layer, ALGs are typically employed to support applications that use the application layer payload to communicate the dynamic Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) ports on which the applications open data connections. ALG solves this problem at the application layer by replacing the internal IP with the address of the NAT interface.An application layer gateway (ALG) is a feature on ScreenOS gateways that enables the gateway to parse application layer payloads and take decisions on them. FTP port commands use IP addresses that are configured on endpoint interfaces, which in the case of a host behind a NAT firewall is usually unreachable from the Internet. In this case, the endpoints do not always realize that their addresses are being translated midstream. Once the session is complete, the gateway closes immediately.įTP ALG also handles the special case when an FTP session passes through a NAT interface. ALG dynamically opens a specific combination of source and destination IP ports in the firewall policy that allows a session to be established.

Because these data channels can connect to any port, it is almost impossible to create a static firewall policy that allows these data channels and still provide adequate protection.įTP ALG automatically solves this problem by monitoring the FTP command channel, looking for FTP port commands that indicate which source and destination ports are being requested.

Alg application layer gateway