Cisco 5505 - ASA Firewall Edition Bundle, Cli Configuration Manual

Page: 1152 / 2164

1-10
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring Inspection for Voice and Video Protocols
H.323 Inspection
Monitoring H.225 Sessions
The show h225 command displays information for H.225 sessions established across the ASA. Along
with the debug h323 h225 event , debug h323 h245 event , and show local-host commands, this
command is used for troubleshooting H.323 inspection engine issues.
Before entering the show h225 , show h245 , or show h323-ras commands, we recommend that you
configure the pager command. If there are a lot of session records and the pager command is not
configured, it may take a while for the show command output to reach its end. If there is an abnormally
large number of connections, check that the sessions are timing out based on the default timeout values
or the values set by you. If they are not, then there is a problem that needs to be investigated.
The following is sample output from the show h225 command:
hostname# show h225
Total H.323 Calls: 1
1 Concurrent Call(s) for
Local: 10.130.56.3/1040 Foreign: 172.30.254.203/1720
1. CRV 9861
Local: 10.130.56.3/1040 Foreign: 172.30.254.203/1720
0 Concurrent Call(s) for
Local: 10.130.56.4/1050 Foreign: 172.30.254.205/1720
This output indicates that there is currently 1 active H.323 call going through the ASA between the local
endpoint 10.130.56.3 and foreign host 172.30.254.203, and for these particular endpoints, there is 1
concurrent call between them, with a CRV for that call of 9861.
For the local endpoint 10.130.56.4 and foreign host 172.30.254.205, there are 0 concurrent calls. This
means that there is no active call between the endpoints even though the H.225 session still exists. This
could happen if, at the time of the
show h225 command, the call has already ended but the H.225 session
has not yet been deleted. Alternately, it could mean that the two endpoints still have a TCP connection
opened between them because they set “maintainConnection” to TRUE, so the session is kept open until
they set it to FALSE again, or until the session times out based on the H.225 timeout value in your
configuration.
Monitoring H.245 Sessions
The show h245 command displays information for H.245 sessions established across the ASA by
endpoints using slow start. Slow start is when the two endpoints of a call open another TCP control
channel for H.245. Fast start is where the H.245 messages are exchanged as part of the H.225 messages
on the H.225 control channel.) Along with the
debug h323 h245 event , debug h323 h225 event , and
show local-host commands, this command is used for troubleshooting H.323 inspection engine issues.
The following is sample output from the show h245 command:
hostname# show h245
Total: 1
LOCAL TPKT FOREIGN TPKT
1 10.130.56.3/1041 0 172.30.254.203/1245 0
MEDIA: LCN 258 Foreign 172.30.254.203 RTP 49608 RTCP 49609
Local 10.130.56.3 RTP 49608 RTCP 49609
MEDIA: LCN 259 Foreign 172.30.254.203 RTP 49606 RTCP 49607
Local 10.130.56.3 RTP 49606 RTCP 49607
There is currently one H.245 control session active across the ASA. The local endpoint is 10.130.56.3,
and we are expecting the next packet from this endpoint to have a TPKT header because the TPKT value
is 0. The TKTP header is a 4-byte header preceding each H.225/H.245 message. It gives the length of
the message, including the 4-byte header. The foreign host endpoint is 172.30.254.203, and we are
expecting the next packet from this endpoint to have a TPKT header because the TPKT value is 0.