Defining The Message Path Taken By Sip Messages - Cisco 4700M Configuration Manual

Configuring a Layer 7 SIP Inspection Policy

Defining the Message Path Taken by SIP Messages

Cisco 4700 Series Application Control Engine Appliance Security Configuration Guide
3-82
SIP inspection allows you to filter messages coming from or transiting through
certain SIP proxy servers. The ACE maintains a list of unauthorized SIP proxy IP
addresses or URIs in the form of regular expressions. The ACE checks this list
against the VIA header field in each SIP packet. The default action is to drop SIP
packets with VIA fields that match the regex list.
To filter SIP traffic based on the message path, use the match message-path
command in class map SIP inspection configuration mode.
The syntax of this command is as follows:
[line_number] match message-path expression
The arguments and options are as follows:
line_number—(Optional) Argument that assists you in editing or deleting
•
individual match commands. Enter an integer from 2 to 1024 as the line
number. You can enter no line_number to delete long match commands
instead of entering the entire line. The line numbers do not dictate a priority
or sequence for the match statements.
expression—Regular expression that identifies a SIP proxy server. Enter a
•
regular expression from 1 to 255 alphanumeric characters. The ACE supports
the use of regular expressions for matching. Expressions are stored in a
header map in the form header-name: expression. Header expressions allow
spaces, provided that the spaces are escaped or quoted. See
of the supported characters that you can use in regular expressions.
When matching data strings, note that the period (.) and question
Note
mark (?) characters do not have a literal meaning in regular
expressions. Use brackets ([]) to match these symbols (for example,
enter www[.]xyz[.]com instead of www.xyz.com). You can also use a
backslash (\) to escape a dot (.) or a question mark (?).
For example, enter:
host1/Admin(config-cmap-sip-insp)# match message-path
192.168.12.3:5060
Chapter 3 Configuring Application Protocol Inspection
Table 3-5 for a list
OL-16202-01