14-29
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 14 Inspection for Voice and Video Protocols
SIP Inspection
• sip_policy_map is the optional SIP inspection policy map. You need a map only if you want
non-default inspection processing. For information on creating the SIP inspection policy map, see
Configure SIP Inspection Policy Map, page 14-24.
• tls-proxy proxy_name identifies the TLS proxy to use for this inspection. You need a TLS proxy
only if you want to enable inspection of encrypted traffic.
Example:
hostname(config-class)# no inspect sip
hostname(config-class)# inspect sip sip-map
Note If you are editing the default global policy (or any in-use policy) to use a different SIP inspection
policy map, you must remove the SIP inspection with the no inspect sip command, and then
re-add it with the new SIP inspection policy map name.
Step 5 If you are editing an existing service policy (such as the default global policy called global_policy), you
are done. Otherwise, activate the policy map on one or more interfaces.
service-policy policymap_name {global | interface interface_name}
Example:
hostname(config)# service-policy global_policy global
The global keyword applies the policy map to all interfaces, and interface applies the policy to one
interface. Only one global policy is allowed. You can override the global policy on an interface by
applying a service policy to that interface. You can only apply one policy map to each interface.
Configure SIP Timeout Values
The media connections are torn down within two minutes after the connection becomes idle. This is,
however, a configurable timeout and can be set for a shorter or longer period of time.
You can configure several SIP global timeout values on the Configuration > Firewall > Advanced >
Global Timeouts page.
To configure the timeout for the SIP control connection, enter the following command:
hostname(config)# timeout sip hh:mm:ss
This command configures the idle timeout after which a SIP control connection is closed.
To configure the timeout for the SIP media connection, enter the following command:
hostname(config)# timeout sip_media hh:mm:ss
This command configures the idle timeout after which a SIP media connection is closed.
Verifying and Monitoring SIP Inspection
The show sip command displays information for SIP sessions established across the ASA. Along with
the debug sip and show local-host commands, this command is used for troubleshooting SIP inspection
engine issues.
To Next Page
Loading...
Need help?
General