Configuring Sip Timeout Values - Cisco PIX 500 Series Configuration Manual

SIP Inspection
e.
f.
g.
h.
i.
j.
The following example shows how to disable instant messaging over SIP:
hostname(config)# policy-map type inspect sip mymap
hostname(config-pmap)# parameters
hostname(config-pmap-p)# no im
hostname(config)# policy-map global_policy
hostname(config-pmap)# class inspection_default
hostname(config-pmap-c)# inspect sip mymap
hostname(config)# service-policy global_policy global

Configuring SIP Timeout Values

The media connections are torn down within two minutes after the connection becomes idle. This is,
however, a configurable timeout and can be set for a shorter or longer period of time. To configure the
timeout for the SIP control connection, enter the following command:
hostname(config)# timeout sip hh : mm : ss
This command configures the idle timeout after which a SIP control connection is closed.
Cisco Security Appliance Command Line Configuration Guide
25-70
hostname(config-pmap-p)# max-forwards-validation action {drop | drop-connection |
reset | log} [log]
To enable check on RTP packets flowing on the pinholes for protocol conformance, enter the
following command:
hostname(config-pmap-p)# rtp-conformance [enforce-payloadtype]
Where the enforce-payloadtype keyword enforces the payload type to be audio or video based on
the signaling exchange.
To identify the Server and User-Agent header fields, which expose the software version of either a
server or an endpoint, enter the following command:
hostname(config-pmap-p)# software-version action {mask | log} [log]
Where the mask keyword masks the software version in the SIP messages.
To enable state checking validation, enter the following command:
hostname(config-pmap-p)# state-checking action {drop | drop-connection | reset | log}
[log]
To enable strict verification of the header fields in the SIP messages according to RFC 3261, enter
the following command:
hostname(config-pmap-p)# strict-header-validation action {drop | drop-connection |
reset | log} [log]
To allow non SIP traffic using the well-known SIP signaling port, enter the following command:
hostname(config-pmap-p)# traffic-non-sip
To identify the non-SIP URIs present in the Alert-Info and Call-Info header fields, enter the
following command:
hostname(config-pmap-p)# uri-non-sip action {mask | log} [log]
Chapter 25 Configuring Application Layer Protocol Inspection
OL-12172-03