Mgcp Inspection - Cisco PIX 500 Series Configuration Manual

Chapter 25 Configuring Application Layer Protocol Inspection
For search responses, when the LDAP server is located outside, NAT should be considered to allow
internal peers to communicate locally while registered to external LDAP servers. For such search
responses, xlates are searched first, and then DNAT entries to obtain the correct address. If both of these
searches fail, then the address is not changed. For sites using NAT 0 (no NAT) and not expecting DNAT
interaction, we recommend that the inspection engine be turned off to provide better performance.
Additional configuration may be necessary when the ILS server is located inside the security appliance
border. This would require a hole for outside clients to access the LDAP server on the specified port,
typically TCP 389.
Because ILS traffic only occurs on the secondary UDP channel, the TCP connection is disconnected after
the TCP inactivity interval. By default, this interval is 60 minutes and can be adjusted using the timeout
command.
ILS/LDAP follows a client/server model with sessions handled over a single TCP connection.
Depending on the client's actions, several of these sessions may be created.
During connection negotiation time, a BIND PDU is sent from the client to the server. Once a successful
BIND RESPONSE from the server is received, other operational messages may be exchanged (such as
ADD, DEL, SEARCH, or MODIFY) to perform operations on the ILS Directory. The ADD REQUEST
and SEARCH RESPONSE PDUs may contain IP addresses of NetMeeting peers, used by H.323 (SETUP
and CONNECT messages) to establish the NetMeeting sessions. Microsoft NetMeeting v2.X and v3.X
provides ILS support.
The ILS inspection performs the following operations:
•
•
•
•
•
•
•
ILS inspection has the following limitations:
•
•
•
Because H225 call signalling traffic only occurs on the secondary UDP channel, the TCP connection is
Note
disconnected after the interval specified by the TCP timeout command. By default, this interval is set at
60 minutes.

MGCP Inspection

This section describes MGCP application inspection. This section includes the following topics:
•
•
•
OL-12172-03
Decodes the LDAP REQUEST/RESPONSE PDUs using the BER decode functions
Parses the LDAP packet
Extracts IP addresses
Translates IP addresses as necessary
Encodes the PDU with translated addresses using BER encode functions
Copies the newly encoded PDU back to the TCP packet
Performs incremental TCP checksum and sequence number adjustment
Referral requests and responses are not supported
Users in multiple directories are not unified
Single users having multiple identities in multiple directories cannot be recognized by NAT
MGCP Inspection Overview, page 25-54
Configuring an MGCP Inspection Policy Map for Additional Inspection Control, page 25-56
Configuring MGCP Timeout Values, page 25-57
Cisco Security Appliance Command Line Configuration Guide
MGCP Inspection
25-53