Cisco PIX 525 Dokumentacja Pobierz pdf (Strona 203)

5-27

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 5 Configuring Application Inspection (Fixup)

Multimedia Applications

SIP inspection has a database with indices CALL_ID/FROM/TO from the SIP payload that identifies the

call, as well as the source and destination. Contained within this database are the media addresses and

media ports that were contained in the SDP media information fields and the media type. There can be

multiple media addresses and ports for a session. RTP/RTCP connections are opened between the two

endpoints using these media addresses/ports. The well-known port 5060 must be used on the initial call

setup (INVITE) message. However, subsequent messages may not have this port number. The SIP fixup

opens signaling connection pinholes, and marks these connections as SIP connections. This is done for

the messages to reach the SIP application and be NATed.

As a call is set up, the SIP session is considered in the “transient” state until the media address and media

port is received in a Response message from the called endpoint indicating the RTP port the called

endpoint will listen on. If there is a failure to receive the response messages within one minute, the

signaling connection will be torn down.

Once the final handshake is made, the call state is moved to active and the signaling connection will

remain until a BYE message is received.

If an inside endpoint initiates a call to an outside endpoint, a media hole is opened to the outside interface

to allow RTP/RTCP UDP packets to flow to the inside endpoint media address and media port specified

in the INVITE message from the inside endpoint. Unsolicited RTP/RTCP UDP packets to an inside

interface will not traverse the Firewall, unless the PIX

Firewall configuration specifically allows it.

The media connections are torn down within two minutes after the connection becomes idle. This is,

however, a configurable timeout and can be set for a shorter or longer period of time.

Multimedia Applications

This section describes how the PIX Firewall supports multimedia or video-on-demand applications and

protocols and how you can use fixup and other commands to solve specific problems. It includes the

following topics:

• Netshow, page 5-27

• Real Time Streaming Protocol (RTSP), page 5-29

• VDO LIVE, page 5-30

Netshow

Netshow is a streaming multimedia service that allows users to receive audio and video streams from

across the Internet. Users play Netshow content using Windows Media player, which connects to the

Netshow server to receive the multimedia stream.

The data channel in which the streams are transmitted is negotiated in a control channel. This section

describes the different streams and includes the following topics.

• UDP Stream, page 5-27

• TCP Stream, page 5-29

UDP Stream

UDP streams are used with Netshow as follows:

1. Client makes a TCP connection to the server at the well-known port 1755.

1 2 ... 198 199 200 201 202 203 204 205 206 207 208 ... 465 466

Komentarze do niniejszej Instrukcji

Brak uwag

Cisco PIX 525 Dokumentacja Strona 203

Komentarze do niniejszej Instrukcji

Powiązane produkty i podręczniki dla Systemy kontroli dostępu bezpieczeństwa Cisco PIX 525