Sccp Inspection Overview; Supporting Cisco Ip Phones; Restrictions And Limitations - Cisco PIX 500 Series Configuration Manual

Skinny (SCCP) Inspection

SCCP Inspection Overview

Skinny (SCCP) is a simplified protocol used in VoIP networks. Cisco IP Phones using SCCP can coexist
in an H.323 environment. When used with Cisco CallManager, the SCCP client can interoperate with
H.323 compliant terminals. Application layer functions in the security appliance recognize SCCP
Version 3.3. There are 5 versions of the SCCP protocol: 2.4, 3.0.4, 3.1.1, 3.2, and 3.3.2. The security
appliance supports all versions through Version 3.3.2.
The security appliance supports PAT and NAT for SCCP. PAT is necessary if you have more IP phones
than global IP addresses for the IP phones to use. By supporting NAT and PAT of SCCP Signaling
packets, Skinny application inspection ensures that all SCCP signalling and media packets can traverse
the security appliance.
Normal traffic between Cisco CallManager and Cisco IP Phones uses SCCP and is handled by SCCP
inspection without any special configuration. The security appliance also supports DHCP options 150
and 66, which it accomplishes by sending the location of a TFTP server to Cisco IP Phones and other
DHCP clients. Cisco IP Phones might also include DHCP option 3 in their requests, which sets the
default route. For more information, see the
page

Supporting Cisco IP Phones

In topologies where Cisco CallManager is located on the higher security interface with respect to the
Cisco IP Phones, if NAT is required for the Cisco CallManager IP address, the mapping must be static
as a Cisco IP Phone requires the Cisco CallManager IP address to be specified explicitly in its
configuration. An static identity entry allows the Cisco CallManager on the higher security interface to
accept registrations from the Cisco IP Phones.
Cisco IP Phones require access to a TFTP server to download the configuration information they need
to connect to the Cisco CallManager server.
When the Cisco IP Phones are on a lower security interface compared to the TFTP server, you must use
an access list to connect to the protected TFTP server on UDP port 69. While you do need a static entry
for the TFTP server, this does not have to be an identity static entry. When using NAT, an identity static
entry maps to the same IP address. When using PAT, it maps to the same IP address and port.
When the Cisco IP Phones are on a higher security interface compared to the TFTP server and
Cisco CallManager, no access list or static entry is required to allow the Cisco IP Phones to initiate the
connection.

Restrictions and Limitations

The following are limitations that apply to the current version of PAT and NAT support for SCCP:
•
•
If the address of an internal Cisco CallManager is configured for NAT or PAT to a different IP address
or port, registrations for external Cisco IP Phones fail because the security appliance currently does not
support NAT or PAT for the file content transferred over TFTP. Although the security appliance supports
NAT of TFTP messages and opens a pinhole for the TFTP file, the security appliance cannot translate
the Cisco CallManager IP address and port embedded in the Cisco IP Phone configuration files that are
transferred by TFTP during phone registration.
Cisco Security Appliance Command Line Configuration Guide
25-72
10-4.
PAT does not work with configurations containing the alias command.
Outside NAT or PAT is not supported.
Chapter 25 Configuring Application Layer Protocol Inspection
"Using Cisco IP Phones with a DHCP Server" section on
OL-12172-03