Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 337)

21-11

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 21 Applying Application Layer Protocol Inspection

Managing CTIQBE Inspection

• Entering the debug ctiqbe command may delay message transmission, which may have a

performance impact in a real-time environment. When you enable this debugging or logging and

Cisco IP SoftPhone seems unable to complete call setup through the security appliance, increase the

timeout values in the Cisco TSP settings on the system running Cisco IP SoftPhone.

The following summarizes special considerations when using CTIQBE application inspection in specific

scenarios:

• If two Cisco IP SoftPhones are registered with different Cisco CallManagers, which are connected

to different interfaces of the security appliance, calls between these two phones fails.

• When Cisco CallManager is located on the higher security interface compared to

Cisco IP SoftPhones, if NAT or outside NAT is required for the Cisco CallManager IP address, the

mapping must be static as Cisco IP SoftPhone requires the Cisco CallManager IP address to be

specified explicitly in its Cisco TSP configuration on the PC.

• When using PAT or Outside PAT, if the Cisco CallManager IP address is to be translated, its TCP

port 2748 must be statically mapped to the same port of the PAT (interface) address for Cisco IP

SoftPhone registrations to succeed. The CTIQBE listening port (TCP 2748) is fixed and is not

user-configurable on Cisco CallManager, Cisco IP SoftPhone, or Cisco TSP.

Enabling and Configuring CTIQBE Inspection

To enable CTIQBE inspection or change the default port used for receiving CTIQBE traffic, perform the

following steps:

Step 1 Name the traffic class by entering the following command in global configuration mode:

hostname(config)# class-map

class_map_name

Replace class_map_name with the name of the traffic class, For example:

hostname(config)# class-map ctiqbe_port

When you enter the class-map command, the CLI enters the class map configuration mode, and the

prompt changes, as in the following example:

hostname(config-cmap)#

Step 2 In the class map configuration mode, define the match command, as in the following example:

hostname(config-cmap)# match port tcp eq 2748

hostname(config-cmap)# exit

hostname(config)#

To assign a range of continuous ports, enter the range keyword, as in the following example:

hostname(config-cmap)# match port tcp range 2748-2750

To assign more than one non-contiguous port for CTIQBE inspection, enter the access-list command and

define an access control entry to match each port. Then enter the match command to associate the access

lists with the CTIQBE traffic class.

Step 3 Name the policy map by entering the following command:

hostname(config)# policy-map

policy_map_name

Replace policy_map_name with the name of the policy map, as in the following example:

hostname(config)# policy-map inbound_policy

1 2 ... 332 333 334 335 336 337 338 339 340 341 342 ... 603 604

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 337

Kommentare zu diesen Handbüchern