Sip Instant Messaging; Configuring A Sip Inspection Policy Map For Additional Inspection Control - Cisco PIX 500 Series Configuration Manual

SIP Inspection
As a call is set up, the SIP session is in the "transient" state until the media address and media port is
•
received from the called endpoint in a Response message indicating the RTP port the called endpoint
listens on. If there is a failure to receive the response messages within one minute, the signaling
connection is torn down.
Once the final handshake is made, the call state is moved to active and the signaling connection remains
until a BYE message is received.
If an inside endpoint initiates a call to an outside endpoint, a media hole is opened to the outside interface
•
to allow RTP/RTCP UDP packets to flow to the inside endpoint media address and media port specified
in the INVITE message from the inside endpoint. Unsolicited RTP/RTCP UDP packets to an inside
interface does not traverse the security appliance, unless the security appliance configuration
specifically allows it.

SIP Instant Messaging

Configuring a SIP Inspection Policy Map for Additional Inspection Control

Instant Messaging refers to the transfer of messages between users in near real-time. SIP supports the
To specify actions when a message violates a parameter, create a SIP inspection policy map. You can
Chat feature on Windows XP using Windows Messenger RTC Client version 4.7.0105 only. The
then apply the inspection policy map when you enable SIP inspection according to the
MESSAGE/INFO methods and 202 Accept response are used to support IM as defined in the following
Application Inspection" section on page
RFCs:
To create a SIP inspection policy map, perform the following steps:
•
•
Step 1 (Optional) Add one or more regular expressions for use in traffic matching commands according to the
"Creating a Regular Expression" section on page
MESSAGE/INFO requests can come in at any time after registration/subscription. For example, two
commands described in
users can be online at any time, but not chat for hours. Therefore, the SIP inspection engine opens
pinholes that time out according to the configured SIP timeout value. This value must be configured at
(Optional) Create one or more regular expression class maps to group regular expressions according to
Step 2
least five minutes longer than the subscription duration. The subscription duration is defined in the
the
Contact Expires value and is typically 30 minutes.
(Optional) Create a SIP inspection class map by performing the following steps.
Step 3
Because MESSAGE/INFO requests are typically sent using a dynamically allocated port other than port
A class map groups multiple traffic matches. Traffic must match all of the match commands to match
5060, they are required to go through the SIP inspection engine.
the class map. You can alternatively identify match commands directly in the policy map. The difference
between creating a class map and defining the traffic match directly in the inspection policy map is that
the class map lets you create more complex match criteria, and you can reuse class maps.
Only the Chat feature is currently supported. Whiteboard, File Transfer, and Application Sharing are not
Note
supported. RTC Client 5.0 is not supported.
To specify traffic that should not match the class map, use the match not command. For example, if the
match not command specifies the string "example.com," then any traffic that includes "example.com"
SIP inspection translates the SIP text-based messages, recalculates the content length for the SDP
does not match the class map.
portion of the message, and recalculates the packet length and checksum. It dynamically opens media
For the traffic that you identify in this class map, you can specify actions such as drop-connection, reset,
connections for ports specified in the SDP portion of the SIP message as address/ports on which the
and/or log the connection in the inspection policy map.
endpoint should listen.
If you want to perform different actions for each match command, you should identify the traffic directly
SIP inspection has a database with indices CALL_ID/FROM/TO from the SIP payload. These indices
in the policy map.
identify the call, the source, and the destination. This database contains the media addresses and media
a.
ports found in the SDP media information fields and the media type. There can be multiple media
addresses and ports for a session. The security appliance opens RTP/RTCP connections between the two
endpoints using these media addresses/ports.
The well-known port 5060 must be used on the initial call setup (INVITE) message; however, subsequent
messages may not have this port number. The SIP inspection engine opens signaling connection
pinholes, and marks these connections as SIP connections. This is done for the messages to reach the
SIP application and be translated.
b.
Cisco Security Appliance Command Line Configuration Guide
25-66
If a remote endpoint tries to register with a SIP proxy on a network protected by the security
appliance, the registration fails under very specific conditions, as follows:
PAT is configured for the remote endpoint.
–
The SIP registrar server is on the outside network.
–
The port is missing in the contact field in the REGISTER message sent by the endpoint to the
–
proxy server.
If a SIP device transmits a packet in which the SDP portion has an IP address in the owner/creator
field (o=) that is different than the IP address in the connection field (c=), the IP address in the o=
field may not be properly translated. This is due to a limitation in the SIP protocol, which does not
provide a port value in the o= field.
Session Initiation Protocol (SIP)-Specific Event Notification, RFC 3265
Session Initiation Protocol (SIP) Extension for Instant Messaging, RFC 3428
Step 3.
"Creating a Regular Expression Class Map" section on page
Create the class map by entering the following command:
hostname(config)# class-map type inspect sip [match-all | match-any] class_map_name
hostname(config-cmap)#
Where the class_map_name is the name of the class map. The match-all keyword is the default, and
specifies that traffic must match all criteria to match the class map. The match-any keyword
specifies that the traffic matches the class map if it matches at least one of the criteria. The CLI
enters class-map configuration mode, where you can enter one or more match commands.
(Optional) To add a description to the class map, enter the following command:
hostname(config-cmap)# description string
Chapter 25 Configuring Application Layer Protocol Inspection
25-5.
21-6. See the types of text you can match in the match
21-9.s
"Configuring
OL-12172-03