Sip Sample Configuration - Cisco 7604 Configuration Manual

Chapter 22 Applying Application Layer Protocol Inspection
The first session, with the call-id c3943000-960ca-2e43-228f@10.130.56.44, is in the state Call Init,
which means the session is still in call setup. Call setup is not complete until a final response to the call
has been received. For instance, the caller has already sent the INVITE, and maybe received a 100
Response, but has not yet seen the 200 OK, so the call setup is not complete yet. Any non-1xx response
message is considered a final response. This session has been idle for 1 second.
The second session is in the state Active, in which call setup is complete and the endpoints are
exchanging media. This session has been idle for 6 seconds.

SIP Sample Configuration

Figure 22-17
Figure 22-17
4085550100
209.165.201.115
4085550199
209.165.201.118
See the following configuration for this example:
hostname(config)# interface Vlan12
hostname(config-if)# nameif outside
hostname(config-if)# security-level 0
hostname(config-if)# ip address 10.2.0.10 255.0.0.0
hostname(config-if)# !
Vlan 12 is an outside Vlan that routes all packets to 10.x.x.x network back to the FWSM with the next
hop IP address set to 10.2.0.10. This is done by configuring policy-based routing at the up-stream router.
hostname(config-if)# interface Vlan50
hostname(config-if)# nameif inside
hostname(config-if)# security-level 100
hostname(config-if)# ip address 10.100.100.7 255.255.255.0
The two phones 4085550100 and 4085550199 are used in the same 209.165.201.0 subnet.
hostname(config)# access-list voice extended permit udp any any eq sip
hostname(config)# access-list voice extended permit tcp any any eq sip
hostname(config)# access-list voice extended permit udp any any eq tftp
hostname(config)# !
hostname(config)# sip-map privacy
hostname(config-if)# ip-address-privacy
hostname(config)# !
hostname(config)# nat-control
hostname(config)# static (inside, outside) 10.3.100.115 209.165.201.115 netmask
255.255.255.255
hostname(config)# static (inside, outside) 10.3.100.118 209.165.201.118 netmask
255.255.255.255
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM
OL-20748-01
shows a sample configuration for SIP inspection:
SIP IP Address Privacy Setup
inside
IP
vlan 50
10.2.0.10
FWSM
IP
outside
209.165.201.5
209.165.201.1
SIP Inspection
CallManager
vlan 150
M
209.165.201.100
22-87