Cisco ASA 5505 Configuration Manual page 871

Chapter 38 Configuring Inspection for Voice and Video Protocols
Because MESSAGE/INFO requests are typically sent using a dynamically allocated port other than port
5060, they are required to go through the SIP inspection engine.
Only the Chat feature is currently supported. Whiteboard, File Transfer, and Application Sharing are not
Note
supported. RTC Client 5.0 is not supported.
SIP inspection translates the SIP text-based messages, recalculates the content length for the SDP
portion of the message, and recalculates the packet length and checksum. It dynamically opens media
connections for ports specified in the SDP portion of the SIP message as address/ports on which the
endpoint should listen.
SIP inspection has a database with indices CALL_ID/FROM/TO from the SIP payload. These indices
identify the call, the source, and the destination. This database contains the media addresses and media
ports found in the SDP media information fields and the media type. There can be multiple media
addresses and ports for a session. The adaptive security appliance opens RTP/RTCP connections
between the two endpoints using these media addresses/ports.
The well-known port 5060 must be used on the initial call setup (INVITE) message; however, subsequent
messages may not have this port number. The SIP inspection engine opens signaling connection
pinholes, and marks these connections as SIP connections. This is done for the messages to reach the
SIP application and be translated.
As a call is set up, the SIP session is in the "transient" state until the media address and media port is
received from the called endpoint in a Response message indicating the RTP port the called endpoint
listens on. If there is a failure to receive the response messages within one minute, the signaling
connection is torn down.
Once the final handshake is made, the call state is moved to active and the signaling connection remains
until a BYE message is received.
If an inside endpoint initiates a call to an outside endpoint, a media hole is opened to the outside interface
to allow RTP/RTCP UDP packets to flow to the inside endpoint media address and media port specified
in the INVITE message from the inside endpoint. Unsolicited RTP/RTCP UDP packets to an inside
interface does not traverse the adaptive security appliance, unless the adaptive security appliance
configuration specifically allows it.
Select SIP Map
The Select SIP Map dialog box lets you select or create a new SIP map. A SIP map lets you change the
configuration values used for SIP application inspection. The Select SIP Map table provides a list of
previously configured maps that you can select for application inspection.
Fields
•
•
•
•
•
OL-20339-01
Use the default SIP inspection map—Specifies to use the default SIP map.
Select a SIP map for fine control over inspection—Lets you select a defined application inspection
map or add a new one.
Add—Opens the Add Policy Map dialog box for the inspection.
Enable encrypted traffic inspection check box—Select to enable the radio buttons to select a proxy
type.
Proxy Type
– TLS Proxy radio button—Use TLS Proxy to enable inspection of encrypted traffic.
Cisco ASA 5500 Series Configuration Guide using ASDM
SIP Inspection
38-25