Cisco Systems ASA 5580, ASA 5505, ASA 5545-X manual 11-8, Ciscoasaconfig# ras-rcf-pinholes enable

Chapter 11 Configuring Inspection for Voice and Video Protocols

H.323 Inspection

You can specify multiple class or match commands in the policy map. For information about the order of class and match commands, see the “Defining Actions in an Inspection Policy Map” section on page 2-4.

Step 7 To configure parameters that affect the inspection engine, perform the following steps:

a.To enter parameters configuration mode, enter the following command:

ciscoasa(config-pmap)# parameters ciscoasa(config-pmap-p)#

b.To enable call setup betweeen H.323 Endpoings, enter the following command:

ciscoasa(config)# ras-rcf-pinholes enable

You can enable call setup between H.323 endpoints when the Gatekeeper is inside the network. The ASA includes options to open pinholes for calls based on the RegistrationRequest/RegistrationConfirm (RRQ/RCF) messages. Because these RRQ/RCF messages are sent to and from the Gatekeeper, the calling endpoint's IP address is unknown and the ASA opens a pinhole through source IP address/port 0/0. By default, this option is disabled.

c.To define the H.323 call duration limit, enter the following command:

ciscoasa(config-pmap-p)# call-duration-limittime

Where time is the call duration limit in seconds. Range is from 0:0:0 ti 1163:0;0. A value of 0 means never timeout.

d.To enforce call party number used in call setup, enter the following command:

ciscoasa(config-pmap-p)# call-party-number

e.To enforce H.245 tunnel blocking, enter the following command:

ciscoasa(config-pmap-p)#h245-tunnel-block action {drop-connection log}

f.To define an hsi group and enter hsi group configuration mode, enter the following command:

ciscoasa(config-pmap-p)# hsi-groupid

Where id is the hsi group ID. Range is from 0 to 2147483647.

To add an hsi to the hsi group, enter the following command in hsi group configuration mode:

ciscoasa(config-h225-map-hsi-grp)# hsi ip_address

Where ip_address is the host to add. A maximum of five hosts per hsi group are allowed.

To add an endpoint to the hsi group, enter the following command in hsi group configuration mode:

ciscoasa(config-h225-map-hsi-grp)# endpoint ip_address if_name

Where ip_address is the endpoint to add and if_name is the interface through which the endpoint is connected to the security appliance. A maximum of ten endpoints per hsi group are allowed.

g.To check RTP packets flowing on the pinholes for protocol conformance, enter the following command:

ciscoasa(config-pmap-p)#rtp-conformance [enforce-payloadtype]

Where the enforce-payloadtypekeyword enforces the payload type to be audio or video based on the signaling exchange.

h.To enable state checking validation, enter the following command:

ciscoasa(config-pmap-p)#state-checking {h225 ras}

Cisco ASA Series Firewall CLI Configuration Guide

11-8