Cisco 7604 Configuration Guide - Page 494

SIP Inspection Chapter 22 Applying Application Layer Protocol Inspection IP Address Privacy When IP Address Privacy is enabled, if any two SIP endpoints participating in an IP phone call or instant messaging session use the same internal firewall interface to contact their SIP proxy server on an external firewall interface, all SIP signaling messages go through the SIP proxy server. IP Address Privacy can be enabled when SIP over TCP or UDP application inspection is enabled. By default, this feature is disabled. If IP Address Privacy is enabled, the FWSM does not translate internal and external host IP addresses embedded in the TCP or UDP payload of inbound SIP traffic, ignoring translation rules for those IP addresses. You control whether this feature is enabled by using the ip-address-privacy command in SIP map configuration mode. Configuring a SIP Inspection Policy Map for Additional Inspection Control To specify actions when a message violates a parameter, create a SIP inspection policy map. You can then apply the inspection policy map when you enable SIP inspection according to the "Configuring Application Inspection" section on page 22-6. To create a SIP inspection policy map, perform the following steps: Step 1 Step 2 Step 3 (Optional) Add one or more regular expressions for use in traffic matching commands according to the "Creating a Regular Expression" section on page 20-11. See the types of text you can match in the match commands described in Step 3. (Optional) Create one or more regular expression class maps to group regular expressions according to the "Creating a Regular Expression Class Map" section on page 20-14.s (Optional) Create a SIP inspection class map by performing the following steps. A class map groups multiple traffic matches. Traffic must match all of the match commands to match the class map if match-all is specified. Traffic must match any one of the match commands to match the class map if the match-any keyword is used. You can alternatively identify match commands directly in the policy map. The difference between creating a class map and defining the traffic match directly in the inspection policy map is that the class map lets you create more complex match criteria, and you can reuse class maps. To specify traffic that should not match the class map, use the match not command. For example, if the match not command specifies the string "example.com," then any traffic that includes "example.com" does not match the class map. For the traffic that you identify in this class map, you can specify actions such as drop-connection, reset, drop, drop-connection log, reset log, and/or log the connection in the inspection policy map. If you want to perform different actions for each match command, you should identify the traffic directly in the policy map. a. Create the class map by entering the following command: hostname(config)# class-map type inspect sip [match-all | match-any] class_map_name hostname(config-cmap)# Where the class_map_name is the name of the class map. The name can be a string up to 40 characters. The match-all keyword is the default, and specifies that traffic must match all criteria to match the class map if match-all is specified. The match-any keyword specifies that the traffic matches the class map if any of the match commands in the class map is matched. 22-78 Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM OL-20748-01