Filter
Top Products
12-21
Cisco ASA Series Firewall ASDM Configuration Guide
Chapter 12 Configuring Inspection for Voice and Video Protocols
SIP Inspection
• SIP Inspection Overview, page 12-21
• SIP Instant Messaging, page 12-22
• Select SIP Map, page 12-22
• SIP Class Map, page 12-23
• Add/Edit SIP Traffic Class Map, page 12-24
• Add/Edit SIP Match Criterion, page 12-24
• SIP Inspect Map, page 12-26
• Add/Edit SIP Policy Map (Security Level), page 12-27
• Add/Edit SIP Policy Map (Details), page 12-28
• Add/Edit SIP Inspect, page 12-30
•
SIP Inspection Overview
SIP, as defined by the IETF, enables call handling sessions, particularly two-party audio conferences, or
“calls.” SIP works with SDP for call signalling. SDP specifies the ports for the media stream. Using SIP,
the ASA can support any SIP VoIP gateways and VoIP proxy servers. SIP and SDP are defined in the
following RFCs:
• SIP: Session Initiation Protocol, RFC 3261
• SDP: Session Description Protocol, RFC 2327
To support SIP calls through the ASA, signaling messages for the media connection addresses, media
ports, and embryonic connections for the media must be inspected, because while the signaling is sent
over a well-known destination port (UDP/TCP 5060), the media streams are dynamically allocated.
Also, SIP embeds IP addresses in the user-data portion of the IP packet. SIP inspection applies NAT for
these embedded IP addresses.
The following limitations and restrictions apply when using PAT with SIP:
• If a remote endpoint tries to register with a SIP proxy on a network protected by the ASA, the
registration fails under very specific conditions, as follows:
–
PAT is configured for the remote endpoint.
–
The SIP registrar server is on the outside network.
–
The port is missing in the contact field in the REGISTER message sent by the endpoint to the
proxy server.
–
Configuring static PAT is not supported with SIP inspection. If static PAT is configured for the
Cisco Unified Communications Manager, SIP inspection cannot rewrite the SIP packet.
Configure one-to-one static NAT for the Cisco Unified Communications Manager.
• If a SIP device transmits a packet in which the SDP portion has an IP address in the owner/creator
field (o=) that is different than the IP address in the connection field (c=), the IP address in the o=
field may not be properly translated. This is due to a limitation in the SIP protocol, which does not
provide a port value in the o= field.