Cisco PIX 525 Dokumentacja Pobierz pdf (Strona 376)

100

101

21-50

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 21 Applying Application Layer Protocol Inspection

Managing SMTP and Extended SMTP Inspection

You enable the SCCP inspection engine as shown in Example 21-9, which creates a class map to match

SCCP traffic on the default port (2000). The service policy is then applied to the outside interface.

Example 21-9 Enabling SCCP Application Inspection

hostname(config)# class-map sccp_port

hostname(config-cmap)# match port tcp eq 2000

hostname(config-cmap)# exit

hostname(config)# policy-map inbound_policy

hostname(config-pmap)# class sccp_port

hostname(config-pmap-c)# inspect skinny

hostname(config-pmap-c)# exit

hostname(config)# service-policy inbound_policy interface outside

Verifying and Monitoring SCCP Inspection

The show skinny command assists in troubleshooting SCCP (Skinny) inspection engine issues. The

following is sample output from the show skinny command under the following conditions. There are

two active Skinny sessions set up across the security appliance. The first one is established between an

internal Cisco IP Phone at local address 10.0.0.11 and an external Cisco CallManager at 172.18.1.33.

TCP port 2000 is the CallManager. The second one is established between another internal Cisco IP

Phone at local address 10.0.0.22 and the same Cisco CallManager.

hostname# show skinny

LOCAL FOREIGN STATE

---------------------------------------------------------------

1 10.0.0.11/52238 172.18.1.33/2000 1

MEDIA 10.0.0.11/22948 172.18.1.22/20798

2 10.0.0.22/52232 172.18.1.33/2000 1

MEDIA 10.0.0.22/20798 172.18.1.11/22948

The output indicates that a call has been established between two internal Cisco IP Phones. The RTP

listening ports of the first and second phones are UDP 22948 and 20798 respectively.

The following is sample output from the show xlate debug command for these Skinny connections:

hostname# show xlate debug

2 in use, 2 most used

Flags: D - DNS, d - dump, I - identity, i - inside, n - no random,

r - portmap, s - static

NAT from inside:10.0.0.11 to outside:172.18.1.11 flags si idle 0:00:16 timeout 0:05:00

NAT from inside:10.0.0.22 to outside:172.18.1.22 flags si idle 0:00:14 timeout 0:05:00

Managing SMTP and Extended SMTP Inspection

This section describes how to enable SMTP and ESMTP application inspection and change the default

port configuration. This section includes the following topics:

• SMTP and Extended SMTP Inspection Overview, page 21-51

• Enabling and Configuring SMTP and Extended SMTP Application Inspection, page 21-52

1 2 ... 371 372 373 374 375 376 377 378 379 380 381 ... 603 604

Komentarze do niniejszej Instrukcji

Brak uwag

Cisco PIX 525 Dokumentacja Strona 376

Komentarze do niniejszej Instrukcji