11-24
Cisco ASA Series Firewall CLI Configuration Guide
Chapter11 Configuring Inspection for Voice and Video Protocols
Skinny (SCCP) Inspection

Configuring SIP Timeout Values

The media connections are torn down within two minutes after the connection becomes idle. This is,
however, a configurable timeout and can be set for a shorter or longer period of time. To configure the
timeout for the SIP control connection, enter the following command:
ciscoasa(config)# timeout sip hh:mm:ss
This command configures the idle timeout after which a SIP control connection is closed.
To configure the timeout for the SIP media connection, enter the following command:
ciscoasa(config)# timeout sip_media hh:mm:ss
This command configures the idle timeout after which a SIP media connection is closed.

Verifying and Monitoring SIP Inspection

The show sip command assists in troubleshooting SIP inspection engine issues and is described with the
inspect protocol sip udp 5060 command. The show timeout sip command displays the timeout value
of the designated protocol.
The show sip command displays information for SIP sessions established across the ASA. Along with
the debug sip and show local-host commands, this command is used for troubleshooting SIP inspection
engine issues.
Note We recommend that you configure the pager command before entering the show sip command. If there
are a lot of SIP session records and the pager command is not configured, it takes a while for the show
sip command output to reach its end.
The following is sample output from the show sip command:
ciscoasa# show sip
Total: 2
call-id c3943000-960ca-2e43-228f@10.130.56.44
state Call init, idle 0:00:01
call-id c3943000-860ca-7e1f-11f7@10.130.56.45
state Active, idle 0:00:06
This sample shows two active SIP sessions on the ASA (as shown in the Total field). Each call-id
represents a call.
The first session, with the call-id c3943000-960ca-2e43-228f@10.130.56.44, is in the state Call Init,
which means the session is still in call setup. Call setup is not complete until a final response to the call
has been received. For instance, the caller has already sent the INVITE, and maybe received a 100
Response, but has not yet seen the 200 OK, so the call setup is not complete yet. Any non-1xx response
message is considered a final response. This session has been idle for 1 second.
The second session is in the state Active, in which call setup is complete and the endpoints are
exchanging media. This session has been idle for 6 seconds.
Skinny (SCCP) Inspection
This section describes SCCP application inspection. This section includes the following topics: