Cisco FirePOWER ASA 5500 series User Manual

25-69
Cisco Security Appliance Command Line Configuration Guide
OL-10088-01
Chapter 25 Configuring Application Layer Protocol Inspection
Skinny (SCCP) Inspection
Note The security appliance supports stateful failover of SCCP calls except for calls that are in the middle of
call setup.
Verifying and Monitoring SCCP Inspection
The show skinny command assists in troubleshooting SCCP (Skinny) inspection engine issues. The
following is sample output from the show skinny command under the following conditions. There are
two active Skinny sessions set up across the security appliance. The first one is established between an
internal Cisco IP Phone at local address 10.0.0.11 and an external Cisco CallManager at 172.18.1.33.
TCP port 2000 is the CallManager. The second one is established between another internal Cisco IP
Phone at local address 10.0.0.22 and the same Cisco CallManager.
hostname# show skinny
LOCAL FOREIGN STATE
---------------------------------------------------------------
1 10.0.0.11/52238 172.18.1.33/2000 1
MEDIA 10.0.0.11/22948 172.18.1.22/20798
2 10.0.0.22/52232 172.18.1.33/2000 1
MEDIA 10.0.0.22/20798 172.18.1.11/22948
The output indicates that a call has been established between two internal Cisco IP Phones. The RTP
listening ports of the first and second phones are UDP 22948 and 20798 respectively.
The following is sample output from the show xlate debug command for these Skinny connections:
hostname# show xlate debug
2 in use, 2 most used
Flags: D - DNS, d - dump, I - identity, i - inside, n - no random,
r - portmap, s - static
NAT from inside:10.0.0.11 to outside:172.18.1.11 flags si idle 0:00:16 timeout 0:05:00
NAT from inside:10.0.0.22 to outside:172.18.1.22 flags si idle 0:00:14 timeout 0:05:00
Configuring a Skinny (SCCP) Inspection Policy Map for Additional Inspection
Control
To specify actions when a message violates a parameter, create an SCCP inspection policy map. You can
then apply the inspection policy map when you enable SCCP inspection according to the “Configuring
Application Inspection” section on page 25-5.
To create an SCCP inspection policy map, perform the following steps:
Step 1 (Optional) Add one or more regular expressions for use in traffic matching commands according to the
“Creating a Regular Expression” section on page 21-6. See the types of text you can match in the match
commands described in Step 3.
Step 2 (Optional) Create one or more regular expression class maps to group regular expressions according to
the “Creating a Regular Expression Class Map” section on page 21-8.
Step 3 Create an SCCP inspection policy map, enter the following command:
hostname(config)# policy-map type inspect skinny policy_map_name
hostname(config-pmap)#

Cisco FirePOWER ASA 5500 series Specifications

General

Brand	Cisco
Model	FirePOWER ASA 5500 series
Category	Firewall
Language	English