25-70
Cisco Security Appliance Command Line Configuration Guide
OL-12172-03
Chapter 25 Configuring Application Layer Protocol Inspection
SIP Inspection
hostname(config-pmap-p)#
max-forwards-validation action
{
drop
|
drop-connection
|
reset
|
log
} [
log
]
e.
To enable check on RTP packets flowing on the pinholes for protocol conformance, enter the
following command:
hostname(config-pmap-p)#
rtp-conformance
[
enforce-payloadtype
]
Where the
enforce-payloadtype
keyword enforces the payload type to be audio or video based on
the signaling exchange.
f.
To identify the Server and User-Agent header fields, which expose the software version of either a
server or an endpoint, enter the following command:
hostname(config-pmap-p)#
software-version action
{
mask
|
log
} [
log
]
Where the
mask
keyword masks the software version in the SIP messages.
g.
To enable state checking validation, enter the following command:
hostname(config-pmap-p)#
state-checking action
{
drop
|
drop-connection
|
reset
|
log
}
[
log
]
h.
To enable strict verification of the header fields in the SIP messages according to RFC 3261, enter
the following command:
hostname(config-pmap-p)#
strict-header-validation action
{
drop
|
drop-connection
|
reset
|
log
} [
log
]
i.
To allow non SIP traffic using the well-known SIP signaling port, enter the following command:
hostname(config-pmap-p)#
traffic-non-sip
j.
To identify the non-SIP URIs present in the Alert-Info and Call-Info header fields, enter the
following command:
hostname(config-pmap-p)#
uri-non-sip action
{
mask
|
log
} [
log
]
The following example shows how to disable instant messaging over SIP:
hostname(config)# policy-map type inspect sip mymap
hostname(config-pmap)# parameters
hostname(config-pmap-p)# no im
hostname(config)# policy-map global_policy
hostname(config-pmap)# class inspection_default
hostname(config-pmap-c)# inspect sip mymap
hostname(config)# service-policy global_policy global
Configuring SIP Timeout Values
The media connections are torn down within two minutes after the connection becomes idle. This is,
however, a configurable timeout and can be set for a shorter or longer period of time. To configure the
timeout for the SIP control connection, enter the following command:
hostname(config)#
timeout sip
hh
:
mm
:
ss
This command configures the idle timeout after which a SIP control connection is closed.
Summary of Contents for 500 Series
Page 38: ...Contents xxxviii Cisco Security Appliance Command Line Configuration Guide OL 12172 03 ...
Page 45: ...P A R T 1 Getting Started and General Information ...
Page 46: ......
Page 277: ...P A R T 2 Configuring the Firewall ...
Page 278: ......
Page 561: ...P A R T 3 Configuring VPN ...
Page 562: ......
Page 891: ...P A R T 4 System Administration ...
Page 892: ......
Page 975: ...P A R T 5 Reference ...
Page 976: ......
