Cisco PIX 525 Dokumentacja Pobierz pdf (Strona 193)

5-17

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 5 Configuring Application Inspection (Fixup)

Voice Over IP

Replace hh with the number of hours, mm with the minutes and ss with the seconds. The default is 1

hour. To keep the channel open without any timeout, set the timer to 0 by entering the following

command:

timeout h225 00:00:00

To disable the timer and close the TCP connection immediately after all calls are cleared, set the timeout

value to 1 second, as follows:

timeout h225 00:00:01

Viewing Connection Status

To display the status of H.225 connections, enter the following command:

show conn state h225

Technical Background

H.323 inspection supports static NAT or dynamic NAT. H.323 RAS is configurable using the fixup

command with PIX

Firewall Version 6.2 or higher. PAT support for H.323 is introduced with

PIX

Firewall Version 6.2.

The H.323 collection of protocols collectively may use up to two TCP connection and four to six UDP

connections. FastConnect uses only one TCP connection, and RAS uses a single UDP connection for

registration, admissions, and status.

An H.323 client may initially establish a TCP connection to an H.323 server using TCP port 1720 to

request Q.931 call setup. As part of the call setup process, the H.323 terminal supplies a port number to

the client to use for an H.245 TCP connection. In environments where H.323 gatekeeper is in use, the

initial packet is transmitted using UDP.

H.323 inspection monitors the Q.931 TCP connection to determine the H.245 port number. If the H.323

terminals are not using FastConnect, the PIX

Firewall dynamically allocates the H.245 connection based

on the inspection of the H.225 messages.

Within each H.245 message, the H.323 endpoints exchange port numbers that are used for subsequent

UDP data streams. H.323 inspection inspects the H.245 messages to identify these ports and dynamically

creates connections for the media exchange. Real-Time Transport Protocol (RTP) uses the negotiated

port number, while RTP Control Protocol (RTCP) uses the next higher port number.

The H.323 control channel handles H.225 and H.245 and H.323 RAS. H.323 inspection uses the

following ports.

• 1718—Gate Keeper Discovery UDP port

• 1719—RAS UDP port

• 1720—TCP Control Port

The two major functions of H.323 inspection are as follows:

• NAT the necessary embedded IPv4 addresses in the H.225 and H.245 messages. Because H.323

messages are encoded in PER encoding format, PIX

Firewall uses an ASN.1 decoder to decode the

H.323 messages.

• Dynamically allocate the negotiated H.245 and RTP/RTCP connections.

1 2 ... 188 189 190 191 192 193 194 195 196 197 198 ... 465 466

Komentarze do niniejszej Instrukcji

Brak uwag

Cisco PIX 525 Dokumentacja Strona 193

Komentarze do niniejszej Instrukcji

Powiązane produkty i podręczniki dla Systemy kontroli dostępu bezpieczeństwa Cisco PIX 525