Configure Sccp (Skinny) Inspection; Configure A Skinny (Sccp) Inspection Policy Map For Additional Inspection Control - Cisco ASA Series Configuration Manual

Firewall cli, asa services module, and the adaptive security virtual appliance
Hide thumbs Also See for ASA Series:
Table of Contents

Advertisement

Skinny (SCCP) Inspection

Configure SCCP (Skinny) Inspection

SCCP (Skinny) application inspection performs translation of embedded IP address and port numbers
within the packet data, and dynamic opening of pinholes. It also performs additional protocol
conformance checks and basic state tracking.
SCCP inspection is enabled by default. You need to configure it only if you want non-default processing,
or if you want to identify a TLS proxy to enable encrypted traffic inspection. If you want to customize
SCCP inspection, use the following process.
Procedure
Configure a Skinny (SCCP) Inspection Policy Map for Additional Inspection Control, page
Step 1
Configure the SCCP Inspection Service Policy, page
Step 2

Configure a Skinny (SCCP) Inspection Policy Map for Additional Inspection Control

To specify actions when a message violates a parameter, create an SCCP inspection policy map. You can
then apply the inspection policy map when you enable SCCP inspection.
Procedure
Create an SCCP inspection policy map.
Step 1
hostname(config)# policy-map type inspect skinny policy_map_name
hostname(config-pmap)#
Where the policy_map_name is the name of the policy map. The CLI enters policy-map configuration
mode.
(Optional) Add a description to the policy map.
Step 2
hostname(config-pmap)# description string
Step 3
(Optional) Drop traffic based on the station message ID field in SCCP messages.
a.
b.
c.
Cisco ASA Series Firewall CLI Configuration Guide
14-32
Identify the traffic based on the station message ID value in hexadecimal, from 0x0 to 0xffff. You
can either specify a single ID, or a range of IDs, using the match [not] message-id command. If you
use a match not command, then any traffic that does not match the criterion in the match not
command has the action applied.
hostname(config-pmap)# match message-id value
hostname(config-pmap)# match message-id range start_value end_value
Example:
hostname(config-pmap)# match message-id 0x181
hostname(config-pmap)# match message-id range 0x200 0xffff
Specify the action to perform on matching packets. You can drop the packet and optionally log it.
hostname(config-pmap)# drop [log]
Repeat the process until you identify all message IDs that you want to drop.
Chapter 14
Inspection for Voice and Video Protocols
14-33.
14-32.

Hide quick links:

Advertisement

Table of Contents
loading

Table of Contents