Cisco ASA 5506-X Configuration Manual page 225

Chapter 8 Inspection for Voice and Video Protocols
•
Also note that inspection of encrypted traffic is not enabled. You must configure a TLS proxy to inspect
encrypted traffic.
Configure SCCP (Skinny) Inspection
SCCP (Skinny) application inspection performs translation of embedded IP address and port numbers
within the packet data, and dynamic opening of pinholes. It also performs additional protocol
conformance checks and basic state tracking.
SCCP inspection is enabled by default. You need to configure it only if you want non-default processing,
or if you want to identify a TLS proxy to enable encrypted traffic inspection. If you want to customize
SCCP inspection, use the following process.
Procedure
Configure a Skinny (SCCP) Inspection Policy Map for Additional Inspection Control, page
Step 1
Configure the SCCP Inspection Service Policy, page
Step 2
Configure a Skinny (SCCP) Inspection Policy Map for Additional Inspection Control
To specify actions when a message violates a parameter, create an SCCP inspection policy map. You can
then apply the inspection policy map when you enable SCCP inspection.
Procedure
Create an SCCP inspection policy map.
Step 1
hostname(config)# policy-map type inspect skinny policy_map_name
hostname(config-pmap)#
Where the policy_map_name is the name of the policy map. The CLI enters policy-map configuration
mode.
(Optional) Add a description to the policy map.
Step 2
hostname(config-pmap)# description string
Step 3 (Optional) Drop traffic based on the station message ID field in SCCP messages.
a.
RTP conformance: Not enforced.
Identify the traffic based on the station message ID value in hexadecimal, from 0x0 to 0xffff. You
can either specify a single ID, or a range of IDs, using the match [not] message-id command. If you
use a match not command, then any traffic that does not match the criterion in the match not
command has the action applied.
hostname(config-pmap)# match message-id value
hostname(config-pmap)# match message-id range start_value end_value
Example:
hostname(config-pmap)# match message-id 0x181
hostname(config-pmap)# match message-id range 0x200 0xffff
8-34.
Cisco ASA Series Firewall CLI Configuration Guide
Skinny (SCCP) Inspection
8-33.
8-33