H.245 Analysis Configuration - Enterasys Intrusion Prevention System Manual

H.245 Analysis Configuration

H.245 is also an ITU-T call signaling protocol that can be used in session establishment for Voice
over IP (VoIP). The H.245 protocol analyzer verifies that capability exchange, command, request,
and response messages are legal, as defined in the ITU-T H.245 specification. If any errors are
found, then the H.245 protocol decoder raises an event [H245:INVALID-MESSAGE].
Analysis of this protocol is disabled by default because not all infrastructures support VoIP.
Note: If the H.245 messages are encrypted, then the protocol decoder will generate an event for
every message.
Procedure
To configure H.245 Analysis settings:
1. Click the Network Policy View icon and the Network Policies tab.
2. Expand the tree by clicking the expansion symbols and select the desired custom policy name.
The modules for that policy are displayed in the tree.
3. Click the Protocol Analysis Module in the tree.
4. Expand H245 Analysis in the Protocol column.
5. H.245 analysis is disabled by default. To enable it, click disable in the Property column, then
select no from the drop-down list in the Value column.
6. All of the H.245 analysis properties are enabled by default. To disable any of them, click the
desired property in the Property column, then select no from the drop-down list in the Value
column. Refer to the ITU-T H.245 specification for descriptions of the properties.
Configuring the Protocol Analysis Module
Creating Network Sensor Policies and Signatures 2-61