Cisco PIX 525 Dokumentacja Pobierz pdf (Strona 366)

21-40

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 21 Applying Application Layer Protocol Inspection

Managing RTSP Inspection

RTSP Inspection Overview

To enable RTSP application inspection or to change the ports to which the security appliance listens,

enter the inspect rtsp command in policy map class configuration mode, which is accessible by entering

the class command within policy map configuration mode. To remove the configuration, enter the no

form of the command. This command is disabled by default.

The inspect rtsp command lets the security appliance pass RTSP packets. RTSP is used by RealAudio,

RealNetworks, Apple QuickTime 4, RealPlayer, and Cisco IP/TV connections.

Note For Cisco IP/TV, use RTSP TCP port 554 and TCP 8554.

RTSP applications use the well-known port 554 with TCP (rarely UDP) as a control channel. The

security appliance only supports TCP, in conformity with RFC 2326. This TCP control channel is used

to negotiate the data channels that is used to transmit audio/video traffic, depending on the transport

mode that is configured on the client.

The supported RDT transports are: rtp/avp, rtp/avp/udp, x-real-rdt, x-real-rdt/udp, and x-pn-tng/udp.

The security appliance parses Setup response messages with a status code of 200. If the response

message is travelling inbound, the server is outside relative to the security appliance and dynamic

channels need to be opened for connections coming inbound from the server. If the response message is

outbound, then the security appliance does not need to open dynamic channels.

Because RFC 2326 does not require that the client and server ports must be in the SETUP response

message, the security appliance keeps state and remembers the client ports in the SETUP message.

QuickTime places the client ports in the SETUP message and then the server responds with only the

server ports.

RTSP inspection does not support PAT or dual-NAT. Also, the security appliance cannot recognize HTTP

cloaking where RTSP messages are hidden in the HTTP messages.

Using RealPlayer

When using RealPlayer, it is important to properly configure transport mode. For the security appliance,

add an access-list command from the server to the client or vice versa. For RealPlayer, change transport

mode by clicking Options>Preferences>Transport>RTSP Settings.

If using TCP mode on the RealPlayer, select the Use TCP to Connect to Server and Attempt to use

TCP for all content check boxes. On the security appliance, there is no need to configure the inspection

engine.

If using UDP mode on the RealPlayer, select the Use TCP to Connect to Server and Attempt to use

UDP for static content check boxes, and for live content not available via Multicast. On the security

appliance, add an inspect rtsp port command.

1 2 ... 361 362 363 364 365 366 367 368 369 370 371 ... 603 604

Brak uwag

Cisco PIX 525 Dokumentacja Strona 366