Cisco ASA 5506-X Configuration Manual page 216

SIP Inspection
•
•
•
SIP Instant Messaging
Instant Messaging refers to the transfer of messages between users in near real-time. SIP supports the
Chat feature on Windows XP using Windows Messenger RTC Client version 4.7.0105 only. The
MESSAGE/INFO methods and 202 Accept response are used to support IM as defined in the following
RFCs:
•
•
MESSAGE/INFO requests can come in at any time after registration/subscription. For example, two
users can be online at any time, but not chat for hours. Therefore, the SIP inspection engine opens
pinholes that time out according to the configured SIP timeout value. This value must be configured at
least five minutes longer than the subscription duration. The subscription duration is defined in the
Contact Expires value and is typically 30 minutes.
Because MESSAGE/INFO requests are typically sent using a dynamically allocated port other than port
5060, they are required to go through the SIP inspection engine.
Only the Chat feature is supported. Whiteboard, File Transfer, and Application Sharing are not
Note
supported. RTC Client 5.0 is not supported.
SIP inspection translates the SIP text-based messages, recalculates the content length for the SDP
portion of the message, and recalculates the packet length and checksum. It dynamically opens media
connections for ports specified in the SDP portion of the SIP message as address/ports on which the
endpoint should listen.
SIP inspection has a database with indices CALL_ID/FROM/TO from the SIP payload. These indices
identify the call, the source, and the destination. This database contains the media addresses and media
ports found in the SDP media information fields and the media type. There can be multiple media
addresses and ports for a session. The ASA opens RTP/RTCP connections between the two endpoints
using these media addresses/ports.
The well-known port 5060 must be used on the initial call setup (INVITE) message; however, subsequent
messages may not have this port number. The SIP inspection engine opens signaling connection
pinholes, and marks these connections as SIP connections. This is done for the messages to reach the
SIP application and be translated.
Cisco ASA Series Firewall CLI Configuration Guide
8-24
If a remote endpoint tries to register with a SIP proxy on a network protected by the ASA, the
registration fails under very specific conditions, as follows:
– PAT is configured for the remote endpoint.
The SIP registrar server is on the outside network.
–
The port is missing in the contact field in the REGISTER message sent by the endpoint to the
–
proxy server.
If a SIP device transmits a packet in which the SDP portion has an IP address in the owner/creator
field (o=) that is different than the IP address in the connection field (c=), the IP address in the o=
field may not be properly translated. This is due to a limitation in the SIP protocol, which does not
provide a port value in the o= field.
When using PAT, any SIP header field which contains an internal IP address without a port might
not be translated and hence the internal IP address will be leaked outside. If you want to avoid this
leakage, configure NAT instead of PAT.
Session Initiation Protocol (SIP)-Specific Event Notification, RFC 3265
Session Initiation Protocol (SIP) Extension for Instant Messaging, RFC 3428
Chapter 8 Inspection for Voice and Video Protocols