Cisco PIX 525 Spécifications télécharger pdf (Page 197)

5-21

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 5 Configuring Application Inspection (Fixup)

Voice Over IP

Overview

Cisco IP Phones using SCCP can coexist in an H.323 environment. When used with Cisco CallManager,

the SCCP client can interoperate with H.323 compliant terminals. Application layer functions in the

PIX

Firewall recognize SCCP Version 3.3. The functionality of the application layer software ensures

that all SCCP signalling and media packets can traverse the Firewall by providing NAT of the SCCP

Signaling packets.

You can use the fixup command to change the default port assignment for SCCP. The command syntax

is as follows.

[no] fixup protocol skinny [port[-port]]

There are 5 versions of the SCCP protocol: 2.4, 3.0.4, 3.1.1, 3.2, and 3.3.2. PIX Firewall Version 6.3

supports up to Version 3.3.2.

Application inspection for SCCP is enabled by default. To change the default port assignments from

2000 use the port option. Use the -port option to apply SCCP application inspection to a range of port

numbers.

If the address of a Cisco CallManager server is configured for NAT or PAT to a different address or port

and outside phones register to it using TFTP, the connection will fail because PIX

Firewall does not

support NAT or PAT of the file content transferred using TFTP. Although PIX Firewall does support NAT

of TFTP messages and opens a pinhole for the TFTP file to traverse the firewall, PIX Firewall cannot

translate the Cisco CallManager IP address and port embedded in the Cisco IP Phone’s configuration

files that are transferred using TFTP during phone registration. For a workaround to this problem, refer

to the

“Using SCCP with Cisco CallManager on a Higher Security Interface” section on page 5-23.

PIX Firewall Version 6.2 introduces support of DHCP options 150 and 66, which allow the PIX Firewall

to send the location of a TFTP server to Cisco IP Phones and other DHCP clients. For further information

about this new feature, refer to

“Using the PIX Firewall DCHP Server” in Chapter 4, “Using PIX

Firewall in SOHO Networks.”

Using PAT with SCCP

PIX Firewall Version 6.3 introduces PAT and NAT support for SCCP. PAT is necessary if you have

limited numbers of global IP addresses for use by IP phones. The following are the limitations that apply

to the current version of PAT and NAT support for SCCP:

• PAT will not work with configurations using the alias command.

• Stateful failover of SCCP calls is not supported.

• Use of debug skinny command may result in a delay of the sending of the messages which may have

a performance impact in a real-time environment.

• No support for fragmented SCCP messages

• Outside NAT or PAT is not supported

If the clear xlate command is entered after PAT xlates are created for Cisco CallManager, SCCP calls

cannot be established because the xlates for the Cisco CallManager are permanently deleted. Under these

circumstances, Cisco IP Phones need to reregister with the Cisco CallManager to establish calls through

the PIX

Firewall.

In topologies where Cisco CallManager is located on the higher security interface with respect to the

Cisco IP Phones, if NAT is required for the Cisco CallManager IP address, the mapping must be static

as a Cisco IP Phone requires the Cisco CallManager IP address to be specified explicitly in its

configuration.

1 2 ... 192 193 194 195 196 197 198 199 200 201 202 ... 465 466

Commentaires sur ces manuels

Pas de commentaire

Cisco PIX 525 Spécifications Page 197

Commentaires sur ces manuels

Produits connexes et manuels pour Systèmes de contrôle d'accès de sécurité Cisco PIX 525