Cisco Systems - page 256

11-8
Cisco ASA Series Firewall CLI Configuration Guide
Chapter11 Configuring Inspection for Voice and Video Protocols
H.323 Inspection
You can specify multiple class or match commands in the policy map. For information about the order
of class and match commands, see the “Defining Actions in an Inspection Policy Map” section on
page 2-4.
Step7 To configure parameters that affect the inspection engine, perform the following steps:
a. To enter parameters configuration mode, enter the following command:
ciscoasa(config-pmap)# parameters
ciscoasa(config-pmap-p)#
b. To enable call setup betweeen H.323 Endpoings, enter the following command:
ciscoasa(config)# ras-rcf-pinholes enable
You can enable call setup between H.323 endpoints when the Gatekeeper is inside the network. The
ASA includes options to open pinholes for calls based on the
RegistrationRequest/RegistrationConfirm (RRQ/RCF) messages. Because these RRQ/RCF
messages are sent to and from the Gatekeeper, the calling endpoint's IP address is unknown and the
ASA opens a pinhole through source IP address/port 0/0. By default, this option is disabled.
c. To define the H.323 call duration limit, enter the following command:
ciscoasa(config-pmap-p)# call-duration-limit time
Where time is the call duration limit in seconds. Range is from 0:0:0 ti 1163:0;0. A value of 0 means
never timeout.
d. To enforce call party number used in call setup, enter the following command:
ciscoasa(config-pmap-p)# call-party-number
e. To enforce H.245 tunnel blocking, enter the following command:
ciscoasa(config-pmap-p)# h245-tunnel-block action {drop-connection | log}
f. To define an hsi group and enter hsi group configuration mode, enter the following command:
ciscoasa(config-pmap-p)# hsi-group id
Where id is the hsi group ID. Range is from 0 to 2147483647.
To add an hsi to the hsi group, enter the following command in hsi group configuration mode:
ciscoasa(config-h225-map-hsi-grp)# hsi ip_address
Where ip_address is the host to add. A maximum of five hosts per hsi group are allowed.
To add an endpoint to the hsi group, enter the following command in hsi group configuration
mode:
ciscoasa(config-h225-map-hsi-grp)# endpoint ip_address if_name
Where ip_address is the endpoint to add and if_name is the interface through which the endpoint
is connected to the security appliance. A maximum of ten endpoints per hsi group are allowed.
g. To check RTP packets flowing on the pinholes for protocol conformance, enter the following
command:
ciscoasa(config-pmap-p)# rtp-conformance [enforce-payloadtype]
Where the enforce-payloadtype keyword enforces the payload type to be audio or video based on
the signaling exchange.
h. To enable state checking validation, enter the following command:
ciscoasa(config-pmap-p)# state-checking {h225 | ras}