Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 194)

5-18

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 5 Configuring Application Inspection (Fixup)

Voice Over IP

The PIX Firewall administrator must open an access list for the well-known H.323 port 1720 for the

H.225 call signaling. However, the H.245 signaling ports are negotiated between the endpoints in the

H.225 signaling. When an H.323 gatekeeper is used, the PIX

Firewall opens an H.225 connection based

on inspection of the ACF message.

The PIX Firewall dynamically allocates the H.245 channel after inspecting the H.225 messages and then

“hookup” the H.245 channel to be fixed up as well. That means whatever H.245 messages pass through

the PIX

Firewall pass through the H.245 application inspection, NATing embedded IP addresses and

opening the negotiated media channels.

The H.323 ITU standard requires that a TPKT header, defining the length of the message, precede the

H.225 and H.245, before being passed on to the reliable connection. Because the TPKT header does not

necessarily need to be sent in the same TCP packet as the H.225/H.245 message, PIX

Firewall must

remember the TPKT length to process/decode the messages properly. PIX

Firewall keeps a data structure

for each connection and that data structure contains the TPKT length for the next expected message.

If the PIX Firewall needs to NAT any IP addresses, then it will have to change the checksum, the UUIE

(user-user information element) length, and the TPKT, if included in the TCP packet with the H.225

message.

If the TPKT is sent in a separate TCP packet, then PIX Firewall will proxy ACK that TPKT

and append a new TPKT to the H.245 message with the new length.

Note PIX Firewall does not support TCP options in the Proxy ACK for the TPKT.

Each UDP connection with a packet going through H.323 inspection is marked as an H.323 connection

and will time out with the H.323 timeout as configured by the administrator using the timeout command.

MGCP

Cisco PIX Firewall Version 6.3 introduces support for application inspection of the Media Gateway

Control Protocol (MGCP). This section describes how to enable application inspection and view

application inspection information. It includes the following topics:

• Overview, page 5-18

• Enabling MGCP Application Inspection, page 5-19

• Configuration for Multiple Call Agents and Gateways, page 5-19

• Viewing MGCP Information, page 5-20

Overview

MGCP is used for controlling media gateways from external call control elements called media gateway

controllers or call agents. A media gateway is typically a network element that provides conversion

between the audio signals carried on telephone circuits and data packets carried over the Internet or over

other packet networks. Examples of media gateways are:

• Trunking gateways, that interface between the telephone network and a Voice over IP network. Such

gateways typically manage a large number of digital circuits.

• Residential gateways, that provide a traditional analog (RJ11) interface to a Voice over IP network.

Examples of residential gateways include cable modem/cable set-top boxes, xDSL devices,

broad-band wireless devices.

• Business gateways, that provide a traditional digital PBX interface or an integrated soft PBX

interface to a Voice over IP network.

1 2 ... 189 190 191 192 193 194 195 196 197 198 199 ... 465 466

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 194

Kommentare zu diesen Handbüchern

Verwandte Produkte und Handbücher für Sicherheitszugriffskontrollsysteme Cisco PIX 525