Configuring Mgcp Call Agents And Gateways; Configuring And Enabling Mgcp Inspection - Cisco 7604 Configuration Manual

Chapter 22 Applying Application Layer Protocol Inspection
•
•
Note MGCP inspection does not support the use of different IP addresses for MGCP signaling and RTP data.
A common and recommended practice is to send RTP data from a resilient IP address, such as a loopback
or virtual IP address; however, the FWSM requires the RTP data to come from the same address as
MGCP signalling.

Configuring MGCP Call Agents and Gateways

Use the call-agent command to specify a group of call agents that can manage one or more gateways.
The call agent group information is used to open connections for the call agents in the group (other than
the one a gateway sends a command to) so that any of the call agents can send the response. Call agents
with the same group_id belong to the same group. A call agent may belong to more than one group. The
group_id option is a number from 0 to 4294967295. The ip_address option specifies the IP address of
the call agent.
To specify a group of call agents, enter the call-agent command in MGCP map configuration mode,
which is accessible by entering the mgcp-map command in global configuration mode.
Using call agents to control the MGCP gateways does not restrict calls between the gateways. For
Note
example, the FWSM does not deny voice calls based on the call agent or gateway IP addresses configured
by using the mgcp-map command. The gateways can make voice calls even when they are not
configured by using the mgcp-map command.
Use the gateway command to specify which group of call agents are managing a particular gateway. The
IP address of the gateway is specified with the ip_address option. The group_id option is a number from
0 to 4294967295 that must correspond with the group_id of the call agents that are managing the
gateway. A gateway may only belong to one group.
MGCP call agents send AUEP messages to determine if MGCP end points are present. This establishes
Note
a flow through the FWSM and allows MGCP end points to register with the call agent.

Configuring and Enabling MGCP Inspection

To enable and configure MGCP application inspection, perform the following steps:
Define an access list with ACEs that identify the two ports required for receiving MGCP traffic. The
Step 1
standard ports are UDP ports 2427 and 2727. To create the access list, use the access-list extended
command, as follows:
hostname(config)# access-list acl-name permit udp any any eq port-1
hostname(config)# access-list acl-name permit udp any any eq port-2
where acl-name is the name you assign to the access list, port-1 is the first MGCP port and port-2 is the
second MGCP port.
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM
OL-20748-01
The port on which the gateway receives commands from the call agent. Gateways usually listen to
UDP port 2427.
The port on which the call agent receives commands from the gateway. Call agents usually listen to
UDP port 2727.
MGCP Inspection
22-67