Router Configuration - Cisco 7604 Configuration Manual

Chapter 22 Applying Application Layer Protocol Inspection
SIP Inspection
Each phone IP address is translated to an external dummy IP address that is not in a network connected
to the FWSM. The translated IP address should not be in a network connected to the FWSM.
hostname(config)# access-group voice in interface outside
hostname(config)# access-group voice in interface inside
hostname(config)# route outside 10.3.0.0 255.0.0.0 10.2.0.5 1
Configure route to10.3.0.0 via 10.2.0.5 (IP address of the next hop router):
hostname(config)# route outside 209.165.201.0 255.0.0.0 10.2.0.5 1
hostname(config)# !
hostname(config)# policy-map global_policy
hostname(config-pmap)# class inspection_default
hostname(config-pmap-c)# inspect dns maximum-length 512
hostname(config-pmap-c)# inspect ftp
hostname(config-pmap-c)# inspect h323 h225
hostname(config-pmap-c)# inspect h323 ras
hostname(config-pmap-c)# inspect rsh
hostname(config-pmap-c)# inspect smtp
hostname(config-pmap-c)# inspect sqlnet
hostname(config-pmap-c)# inspect skinny
hostname(config-pmap-c)# inspect sunrpc
hostname(config-pmap-c)# inspect xdmcp
hostname(config-pmap-c)# inspect netbios
hostname(config-pmap-c)# inspect tftp
hostname(config-pmap-c)# inspect sip privacy

Router configuration:

hostname(config)# interface GigabitEthernet0/2
hostname(config-if)# ip address 10.2.0.5 255.0.0.0
hostname(config-if)# ip policy route-map privacy
hostname(config-if)# duplex auto
hostname(config-if)# speed auto
hostname(config-if)# media-type rj45
hostname(config-if)# no negotiation auto
hostname(config-if)# !
hostname(config)# interface GigabitEthernet0/3
hostname(config-if)# ip address 209.165.201.1 255.0.0.0
hostname(config-if)# duplex auto
hostname(config-if)# speed auto
hostname(config-if)# media-type rj45
hostname(config-if)# no negotiation auto
hostname(config-if)# !
hostname(config-if)# ip route 10.3.0.0 255.0.0.0 10.2.0.10
hostname(config-if)# ip route 50.0.0.0 255.0.0.0 12.0.0.10
Configured route to 10.3.0.0 and 209.165.201.0 reachable via 10.2.0.10 (IP address of FWSM).
hostname(config)# access-list 10 permit ip any 10.3.0.0 0.255.255.255
hostname(config)# !
hostname(config)# route-map privacy permit 10
hostname(config-if)# match ip address 100
hostname(config-if)# set ip next-hop 10.2.0.10
Route map is configured to capture any packets destined for 10.3.0.0 network to be sent to 10.2.0.10 (IP
address of FWSM).
The show conn output at the FWSM shows that voice traffic is getting switched via the FWSM module
and hiding each phone IP address. RTP traffic is not switched via the same subnet. Instead it is getting
routed via the FWSM.
hostname(config)# show conn
6 in use, 28 most used
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM
22-88
OL-20748-01