14-33
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 14 Inspection for Voice and Video Protocols
Skinny (SCCP) Inspection
Step 4
Configure parameters that affect the inspection engine.
a.
Enter parameters configuration mode.
hostname(config-pmap)#
parameters
hostname(config-pmap-p)#
b.
Set one or more parameters. You can set the following options; use the
no
form of the command to
disable the option:
•
enforce-registration
—Enforces registration before calls can be placed.
•
message-ID max
hex_value
—Sets the maximum SCCP station message ID allowed. The
message ID is in hex, and the default maximum is 0x181.
•
rtp-conformance
[
enforce-payloadtype
]—Checks RTP packets flowing on the pinholes for
protocol conformance. The optional
enforce-payloadtype
keyword enforces the payload type
to be audio or video based on the signaling exchange.
•
sccp-prefix-len
{
max
|
min
}
length
—Sets the maximum or minimum SCCP prefix length value
allowed. Enter the command twice to set both a minimum and maximum value. The default
minimum is 4, there is no default maximum.
•
timeout
{
media
|
signaling
}
time
—Sets the timeouts for media and signaling connections (in
hh:mm:ss format). To have no timeout, specify 0 for the number. The default media timeout is
5 minutes, the default signaling timeout is one hour.
Example
The following example shows how to define an SCCP inspection policy map.
hostname(config)# policy-map type inspect skinny skinny-map
hostname(config-pmap)# parameters
hostname(config-pmap-p)# enforce-registration
hostname(config-pmap-p)# match message-id range 200 300
hostname(config-pmap-p)# drop log
hostname(config)# class-map inspection_default
hostname(config-cmap)# match default-inspection-traffic
hostname(config)# policy-map global_policy
hostname(config-pmap)# class inspection_default
hostname(config-pmap-c)# inspect skinny skinny-map
hostname(config)# service-policy global_policy global
Configure the SCCP Inspection Service Policy
The default ASA configuration includes SCCP inspection on the default port applied globally on all
interfaces. A common method for customizing the inspection configuration is to customize the default
global policy. You can alternatively create a new service policy as desired, for example, an
interface-specific policy.
Procedure
Step 1
If necessary, create an L3/L4 class map to identify the traffic for which you want to apply the inspection.
class-map
name
match
parameter
Summary of Contents for ASA 5508-X
Page 11: ...P A R T 1 Access Control ...
Page 12: ......
Page 157: ...P A R T 2 Network Address Translation ...
Page 158: ......
Page 233: ...P A R T 3 Service Policies and Application Inspection ...
Page 234: ......
Page 379: ...P A R T 4 Connection Management and Threat Detection ...
Page 380: ......
