ALF: Application Layer Fixup
I was talking about “application-layer gateways” on firewalls and NAT boxes with a fellow engineer, and we came to an interesting conclusion: in most cases they are not gateways; they don’t add any significant functionality apart for payload fixups for those broken applications that think carrying network endpoint information in application packets is a good idea (I’m looking at you, SIP and FTP). These things should thus be called Application Layer Fixups or ALFs ;)
Thanks a million!
Much later, after what should have been an uneventful update on some windows servers, no one could access email (MAPI) over the vpn. Turns out the update changed a default rpc port or something causing the ASA to think the traffic was malformed skinny packets, and drop it.
There is also the legendary esmtp inspection which effectively destroys the protocol. More like esmtp f**kup