11-26
Cisco ASA Series Firewall CLI Configuration Guide
Chapter11 Configuring Inspection for Voice and Video Protocols
Skinny (SCCP) Inspection
When the Cisco IP Phones are on a lower security interface compared to the TFTP server, you must use
an ACL to connect to the protected TFTP server on UDP port 69. While you do need a static entry for
the TFTP server, this does not have to be an identity static entry. When using NAT, an identity static entry
maps to the same IP address. When using PAT, it maps to the same IP address and port.
When the Cisco IP Phones are on a higher security interface compared to the TFTP server and
Cisco CallManager, no ACL or static entry is required to allow the Cisco IP Phones to initiate the
connection.
Restrictions and Limitations
The following are limitations that apply to the current version of PAT and NAT support for SCCP:
•PAT does not work with configurations containing the alias command.
•Outside NAT or PAT is not supported.
If the address of an internal Cisco CallManager is configured for NAT or PAT to a different IP address
or port, registrations for external Cisco IP Phones fail because the ASA currently does not support NAT
or PAT for the file content transferred over TFTP. Although the ASA supports NAT of TFTP messages
and opens a pinhole for the TFTP file, the ASA cannot translate the Cisco CallManager IP address and
port embedded in the Cisco IP Phone configuration files that are transferred by TFTP during phone
registration.
Note The ASA supports stateful failover of SCCP calls except for calls that are in the middle of call setup.
Configuring a Skinny (SCCP) Inspection Policy Map for Additional Inspection Control
To specify actions when a message violates a parameter, create an SCCP inspection policy map. You can
then apply the inspection policy map when you enable SCCP inspection.
To create an SCCP inspection policy map, perform the following steps:
Step1 (Optional) Add one or more regular expressions for use in traffic matching commands according to the
general operations configuration guide. See the types of text you can match in the match commands
described in Step 3.
Step2 (Optional) Create one or more regular expression class maps to group regular expressions according to
the general operations configuration guide.
Step3 Create an SCCP inspection policy map, enter the following command:
ciscoasa(config)# policy-map type inspect skinny policy_map_name
ciscoasa(config-pmap)#
Where the policy_map_name is the name of the policy map. The CLI enters policy-map configuration
mode.
Step4 (Optional) To add a description to the policy map, enter the following command:
ciscoasa(config-pmap)# description string