Cisco PIX 525 Dokumentacja Pobierz pdf (Strona 199)

5-23

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 5 Configuring Application Inspection (Fixup)

Voice Over IP

Using SCCP with Cisco CallManager on a Higher Security Interface

Cisco IP Phones require access to a TFTP server to download the configuration information they need

to connect to the Cisco

CallManager server.

When the Cisco IP Phones are on a lower security interface compared to the TFTP server, you must use

an access list to connect to the protected TFTP server on UDP port 69. While you do need a static entry

for the TFTP server, this does not have to be an "identity" static entry. When using NAT, an identity static

entry maps to the same IP address. When using PAT, it maps to the same IP address and port.

However, if the Cisco IP Phones are on a lower security interface compared to the Cisco CallManager,

we recommend that you do create an identity static entry to allow the Cisco CallManager on the higher

security interface to accept registrations from the Cisco IP Phones.

When the Cisco IP Phones are on a higher security interface compared to the TFTP server and

Cisco

CallManager, no access list or static entry is required to allow the Cisco IP Phones to initiate the

connection.

Note Normal traffic between the Cisco CallManager and Cisco IP Phones uses SCCP and is handled by SCCP

inspection without any special configuration.

Problems Occur with Fragmented SCCP Packets

At this time, PIX Firewall is not able to correctly handle fragmented SCCP packets. For instance, when

using a voice conference bridge, SCCP packets may become fragmented and are then dropped by the

PIX

Firewall. This happens because the SCCP inspection checks each packet and drops what appear to

be bad packets. When a single SCCP packet is fragmented into multiple TCP packets, the SCCP

inspection function finds that the internal checksums within the SCCP packet fragments are not accurate

and so it drops the packet.

Viewing SCCP Information

To view information about the SCCP sessions established across the PIX Firewall, enter the following

command:

show skinny

For further information about using this command to troubleshoot SCCP application inspection issues,

refer to the show skinny command in the Cisco PIX Firewall Command Reference.

SIP

Session Initiation Protocol (SIP), as defined by the Internet Engineering Task Force (IETF), enables call

handling sessions, particularly two-party audio conferences, or “calls.” This section describes how

application inspection works with SIP. It includes the following topics:

• Overview, page 5-24

• Allowing Outside Phones to Place an Inside Phone on Hold, page 5-24

• Instant Messaging (IM), page 5-26

• Viewing SIP Information, page 5-26

• Technical Background, page 5-26

1 2 ... 194 195 196 197 198 199 200 201 202 203 204 ... 465 466

Komentarze do niniejszej Instrukcji

Brak uwag

Cisco PIX 525 Dokumentacja Strona 199

Komentarze do niniejszej Instrukcji

Powiązane produkty i podręczniki dla Systemy kontroli dostępu bezpieczeństwa Cisco PIX 525