Supporting Cisco Ip Phones; Restrictions And Limitations; Configuring And Enabling Sccp Inspection - Cisco 7604 Configuration Manual

Skinny (SCCP) Inspection
Normal traffic between Cisco CallManager and Cisco IP Phones uses SCCP and is handled by SCCP
inspection without any special configuration. The FWSM also supports DHCP options 150 and 66,
which it accomplishes by sending the location of a TFTP server to Cisco IP Phones and other DHCP
clients. Cisco IP Phones might also include DHCP option 3 in their requests, which sets the default route.
For more information, see the

Supporting Cisco IP Phones

In topologies where Cisco CallManager is located on the higher security interface with respect to the
Cisco IP Phones, if NAT is required for the Cisco CallManager IP address, the mapping must be static
because a Cisco IP Phone requires the Cisco CallManager IP address to be specified explicitly in its
configuration. A static identity entry allows the Cisco CallManager on the higher security interface to
accept registrations from the Cisco IP Phones. Cisco IP Phones require access to a TFTP server to
download the configuration information they need to connect to the Cisco CallManager server.
When the Cisco IP Phones are on a lower security interface compared to the TFTP server, you must use
an access list to connect to the protected TFTP server on UDP port 69. While you do need a static identity
entry for the TFTP server, this does not have to be an identity static entry. When you use NAT, a static
identity entry maps to the same IP address. When you use PAT, it maps to the same IP address and port.
When the Cisco IP Phones are on a higher security interface compared to the TFTP server and
Cisco CallManager, no access list or static identity entry is required to allow the Cisco IP Phones to
initiate the connection.

Restrictions and Limitations

The following are limitations that apply to the current version of PAT and NAT support for SCCP:
•
•
If the address of an internal Cisco CallManager is configured for NAT or PAT to a different IP address
or port, registrations for external Cisco IP Phones fail because the FWSM currently does not support
NAT or PAT for the file content transferred over TFTP. Although the FWSM supports NAT of TFTP
messages and opens a pinhole for the TFTP file, the FWSM cannot translate the Cisco CallManager IP
address and port embedded in the Cisco IP Phone configuration files that are transferred by TFTP during
phone registration.
The following is not supported for SCCP version 17 phones:
•
•
The FWSM supports stateful failover of SCCP calls except for calls that are in the middle of call setup.
Note

Configuring and Enabling SCCP Inspection

SCCP inspection is enabled by default.
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM
22-90
PAT does not work with configurations containing the alias command.
Outside NAT or PAT is not supported.
Registrations of endpoints that have IPv6 addresses. The Register messages are dropped and a debug
message is generated.
If IPv6 messages are embedded in the SCCP messages, they are not NATed or PATed; they are left
untranslated.
Chapter 22
"Using Cisco IP Phones with a DHCP Server" section on page
Applying Application Layer Protocol Inspection
8-38.
OL-20748-01