Cisco Systems NAT and PAT Prerequisites, Prerequisites for IP Phones on Multiple Interfaces

52-8
Cisco ASA 5500 Series Configuration Guide using ASDM
Chapter52 Configuring the Cisco Phone Proxy
Prerequisites for the Phone Proxy
Note All these ports are configurable on the Cisco UCM, except for TFTP. These are the default
values and should be modified if they are modified on the Cisco UCM. For example, 3804 is the
default port for the CAPF Service. This default value should be modified if it is modified on the
Cisco UCM.
NAT and PAT Prerequisites
NAT Prerequisites
•If NAT is configured for the TFTP server, the NAT configuration must be configured prior to
configuring the TFTP Server for the phone proxy.
•If NAT is configured for the TFTP server or Cisco UCMs, the translated “global” address must be
used in the access lists.
PAT Prerequisites
•When the Skinny inspection global port is configured to use a non-default port, then you must
configure the nonsecure port as the global_sccp_port+443.
Therefore, if global_sccp_port is 7000, then the global secure SCCP port is 7443. Reconfiguring the
port might be necessary when the phone proxy deployment has more than one Cisco UCM and they
must share the interface IP address or a global IP address.
Note Both PAT configurations—for the nonsecure and secure ports—must be configured.
•When the IP phones must contact the CAPF on the Cisco UCM and the Cisco UCM is configured
with static PAT (LCS provisioning is required), you must configure static PAT for the default CAPF
port 3804.
Prerequisites for IP Phones on Multiple Interfaces
When IP phones reside on multiple interfaces, the phone proxy configuration must have the correct IP
address set for the Cisco UCM in the CTL file.
See the following example topology for information about how to correctly set the IP address:
Table52-1 Port Configuration Requirements
Address Port Protocol Description
Media Termination 1024-65535 UDP Allow incoming SRTP
TFTP Server 69 UDP Allow incoming TFTP
Cisco UCM 2443 TCP A llow incoming secure
SCCP
Cisco UCM 5061 TCP A llow incoming secure
SIP
CAPF Service (on Cisco
UCM)
3804 TCP Allow CAPF service for
LSC provisioning