Cisco PIX 525 Specifikace stáhnout pdf (Strana 374)

21-48

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 21 Applying Application Layer Protocol Inspection

Managing Skinny (SCCP) Inspection

Supporting Cisco IP Phones

In topologies where Cisco CallManager is located on the higher security interface with respect to the

Cisco IP Phones, if NAT is required for the Cisco CallManager IP address, the mapping must be static

as a Cisco IP Phone requires the Cisco CallManager IP address to be specified explicitly in its

configuration. An identity static entry allows the Cisco CallManager on the higher security interface to

accept registrations from the Cisco IP Phones.

Cisco IP Phones require access to a TFTP server to download the configuration information they need

to connect to the Cisco CallManager server.

When the Cisco IP Phones are on a lower security interface compared to the TFTP server, you must use

an access list to connect to the protected TFTP server on UDP port 69. While you do need a static entry

for the TFTP server, this does not have to be an identity static entry. When using NAT, an identity static

entry maps to the same IP address. When using PAT, it maps to the same IP address and port.

When the Cisco IP Phones are on a higher security interface compared to the TFTP server and

Cisco CallManager, no access list or static entry is required to allow the Cisco IP Phones to initiate the

connection.

Restrictions and Limitations

The following are limitations that apply to the current version of PAT and NAT support for SCCP:

• PAT does not work with configurations containing the alias command.

• Outside NAT or PAT is not supported.

Note Stateful Failover of SCCP calls is now supported except for calls that are in the middle of call setup.

If the address of an internal Cisco CallManager is configured for NAT or PAT to a different IP address

or port, registrations for external Cisco IP Phones fail because the security appliance currently does not

support NAT or PAT for the file content transferred over TFTP. Although the security appliance does

support NAT of TFTP messages, and opens a pinhole for the TFTP file to traverse the security appliance,

the security appliance cannot translate the Cisco CallManager IP address and port embedded in the Cisco

IP Phone configuration files that are being transferred using TFTP during phone registration.

To enable SCCP inspection or change the default port used for receiving SCCP traffic, perform the

following steps:

Step 1 Name the traffic class by entering the following command in global configuration mode:

hostname(config)# class-map

class_map_name

Replace class_map_name with the name of the traffic class, for example:

hostname(config)# class-map sccp_port

When you enter the class-map command, the CLI enters the class map configuration mode, and the

prompt changes, as in the following example:

hostname(config-cmap)#

Step 2 In the class map configuration mode, define the match command, as in the following example:

hostname(config-cmap)# match port tcp eq 2000

hostname(config-cmap)# exit

1 2 ... 369 370 371 372 373 374 375 376 377 378 379 ... 603 604

Komentáře k této Příručce

Žádné komentáře

Cisco PIX 525 Specifikace Strana 374

Komentáře k této Příručce