Cisco 7604 Configuration Manual page 475

Chapter 22 Applying Application Layer Protocol Inspection
hostname(config-dial-peer)#destination-pattern 4085550199
hostname(config-dial-peer)#port 3/0/0
hostname(config-dial-peer)#^Z
Configuration of the IOS H.323 Gatekeeper (router inGK) on the inside interface:
hostname(config)#hostname inGK
hostname(config)#interface FastEthernet0/1
hostname(config-if)# ip address 10.0.0.6 255.0.0.0
hostname(config-if)#no shut
hostname(config-if)#exit
hostname(config)#gatekeeper
hostname(config-gk)#zone local inGK cisco.com 10.0.0.6
hostname(config-gk)#no shut
hostname(config)#
hostname(config)#ip route 209.165.201.0 255.0.0.0 10.100.100.2
Configuration of the FWSM for H.323 inspection:
hostname# config t
hostname(config)# interface Vlan100
hostname(config-if)#
hostname(config-if)#
hostname(config-if)#
hostname(config-if)#
hostname(config-if)# interface Vlan50
hostname(config-if)#
hostname(config-if)#
hostname(config-if)#
hostname(config-if)#
hostname(config-if)# access-list voice extended permit udp any any eq 1719
hostname(config)# access-list voice extended permit tcp any any eq h323
hostname(config)#
hostname(config)# access-group voice in interface outside
hostname(config)# access-group voice in interface inside
hostname(config)#
hostname(config)# policy-map global_policy
hostname(config-pmap)#
hostname(config-pmap-c)# inspect h323 h225
hostname(config-pmap-c)#
hostname(config-pmap-c)#
Output of show conn shows H.323 media connections and control (connections flagged by h and output
of show h225):
FWSM/admin# show conn
4 in use, 7 most used
Network Processor 1 connections
UDP out 209.165.201.1:52906 in 10.0.0.6:1719 idle 0:00:07 Bytes 5162
FLAGS - H
TCP out 209.165.201.1:1720 in 10.100.100.1:12139 idle 0:00:54 Bytes 1307 FLAGS - UOIh
UDP out 209.165.201.1:19253 in 10.100.100.1:17815 idle 0:00:03 Bytes 13012
FLAGS - H
UDP out 209.165.201.1:19252 in 10.100.100.1:17814 idle 0:00:00 Bytes 1370400
FLAGS - H
Network Processor 2 connections
Multicast sessions:
Network Processor 1 connections
Network Processor 2 connections
IPv6 connections:
FWSM/admin# show h225
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM
OL-20748-01
nameif outside
security-level 0
ip address 209.165.201.2 255.0.0.0
nameif inside
security-level 100
ip address 10.100.100.2 255.0.0.0
class inspection_default
inspect h323 ras
H.323 Inspection
22-59