Verifying And Monitoring H.323 Inspection; Monitoring H.225 Sessions - Cisco ASA Series Configuration Manual

H.323 Inspection
hostname(config-class)# inspect h255 h323-map
hostname(config-class)# inspect ras h323-map
Note
If you are editing an existing service policy (such as the default global policy called global_policy), you
Step 5
are done. Otherwise, activate the policy map on one or more interfaces.
service-policy policymap_name {global | interface interface_name}
Example:
hostname(config)# service-policy global_policy global
The global keyword applies the policy map to all interfaces, and interface applies the policy to one
interface. Only one global policy is allowed. You can override the global policy on an interface by
applying a service policy to that interface. You can only apply one policy map to each interface.
Configuring H.323 and H.225 Timeout Values
You can configure H.323/H.255 global timeout values on the Configuration > Firewall > Advanced >
Global Timeouts page. You can set the interval for inactivity after which an H.255 signaling connection
is closed (default is 1 hour) or an H.323 control connection is closed (default is 5 minutes).
To configure the idle time after which an H.225 signaling connection is closed, use the timeout h225
command. The default for H.225 timeout is one hour.
To configure the idle time after which an H.323 control connection is closed, use the timeout h323
command. The default is five minutes.

Verifying and Monitoring H.323 Inspection

The following sections describe how to display information about H.323 sessions.
•
•
•

Monitoring H.225 Sessions

The show h225 command displays information for H.225 sessions established across the ASA. Along
with the debug h323 h225 event, debug h323 h245 event, and show local-host commands, this
command is used for troubleshooting H.323 inspection engine issues.
If there is an abnormally large number of connections, check that the sessions are timing out based on
the default timeout values or the values set by you. If they are not, then there is a problem that needs to
be investigated.
Cisco ASA Series Firewall CLI Configuration Guide
14-10
If you are editing the default global policy (or any in-use policy) to use a different H.323
inspection policy map, you must remove the H.323 inspection with the no inspect h323
command, and then re-add it with the new H.323 inspection policy map name.
Monitoring H.225 Sessions, page 14-10
Monitoring H.245 Sessions, page 14-11
Monitoring H.323 RAS Sessions, page 14-12
Chapter 14 Inspection for Voice and Video Protocols