Cisco PIX 525 Dokumentacja Pobierz pdf (Strona 364)

100

101

21-38

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 21 Applying Application Layer Protocol Inspection

Managing MGCP Inspection

The following command applies the inbound_policy to the all the security appliance interfaces:

hostname(config)# service-policy inbound_policy global

Example 21-6 shows how to identify MGCP traffic, define a MGCP map, define a policy, and apply the

policy to the outside interface. This creates a class map to match MGCP traffic on the default ports (2427

and 2727). The service policy is then applied to the outside interface.

Example 21-6 Enabling and Configuring MGCP Inspection

hostname(config)# access-list mgcp_acl permit udp any any eq 2427

hostname(config)# access-list mgcp_acl permit udp any any eq 2727

hostname(config)# class-map mgcp-traffic

hostname(config-cmap)# match access-list mgcp_acl

hostname(config-cmap)# exit

hostname(config)# mgcp-map inbound_mgcp

hostname(config-mgcp-map)# call-agent 10.10.11.5 101

hostname(config-mgcp-map)# call-agent 10.10.11.6 101

hostname(config-mgcp-map)# call-agent 10.10.11.7 102

hostname(config-mgcp-map)# call-agent 10.10.11.8 102

hostname(config-mgcp-map)# gateway 10.10.10.115 101

hostname(config-mgcp-map)# gateway 10.10.10.116 102

hostname(config-mgcp-map)# gateway 10.10.10.117 102

hostname(config-mgcp-map)# command-queue 150

hostname(config-mgcp-map)# exit

hostname(config)# policy-map inbound_policy

hostname(config-pmap)# class mgcp_port

hostname(config-pmap-c)# inspect mgcp inbound_mgcp

hostname(config-pmap-c)# exit

hostname(config)# service-policy inbound_policy interface outside

This configuration allows call agents 10.10.11.5 and 10.10.11.6 to control gateway 10.10.10.115, and

allows call agents 10.10.11.7 and 10.10.11.8 to control both gateways 10.10.10.116 and 10.10.10.117.

The maximum number of MGCP commands that can be queued is 150.

To enable MGCP inspection for all interfaces, enter the global parameter in place of interface outside.

Configuring MGCP Timeout Values

The timeout mgcp command lets you set the interval for inactivity after which an MGCP media

connection is closed. The default is 5 minutes.

The timeout mgcp-pat command lets you set the timeout for PAT xlates. Because MGCP does not have

a keepalive mechanism, if you use non-Cisco MGCP gateways (call agents), the PAT xlates are torn

down after the default timeout interval, which is 30 seconds.

1 2 ... 359 360 361 362 363 364 365 366 367 368 369 ... 603 604

Komentarze do niniejszej Instrukcji

Brak uwag

Cisco PIX 525 Dokumentacja Strona 364

Komentarze do niniejszej Instrukcji