Cisco 7604 Configuration Guide - Page 506

Skinny (SCCP) Inspection Chapter 22 Applying Application Layer Protocol Inspection Normal traffic between Cisco CallManager and Cisco IP Phones uses SCCP and is handled by SCCP inspection without any special configuration. The FWSM also supports DHCP options 150 and 66, which it accomplishes by sending the location of a TFTP server to Cisco IP Phones and other DHCP clients. Cisco IP Phones might also include DHCP option 3 in their requests, which sets the default route. For more information, see the "Using Cisco IP Phones with a DHCP Server" section on page 8-38. Supporting Cisco IP Phones In topologies where Cisco CallManager is located on the higher security interface with respect to the Cisco IP Phones, if NAT is required for the Cisco CallManager IP address, the mapping must be static because a Cisco IP Phone requires the Cisco CallManager IP address to be specified explicitly in its configuration. A static identity entry allows the Cisco CallManager on the higher security interface to accept registrations from the Cisco IP Phones. Cisco IP Phones require access to a TFTP server to download the configuration information they need to connect to the Cisco CallManager server. When the Cisco IP Phones are on a lower security interface compared to the TFTP server, you must use an access list to connect to the protected TFTP server on UDP port 69. While you do need a static identity entry for the TFTP server, this does not have to be an identity static entry. When you use NAT, a static identity entry maps to the same IP address. When you use PAT, it maps to the same IP address and port. When the Cisco IP Phones are on a higher security interface compared to the TFTP server and Cisco CallManager, no access list or static identity entry is required to allow the Cisco IP Phones to initiate the connection. Restrictions and Limitations The following are limitations that apply to the current version of PAT and NAT support for SCCP: • PAT does not work with configurations containing the alias command. • Outside NAT or PAT is not supported. If the address of an internal Cisco CallManager is configured for NAT or PAT to a different IP address or port, registrations for external Cisco IP Phones fail because the FWSM currently does not support NAT or PAT for the file content transferred over TFTP. Although the FWSM supports NAT of TFTP messages and opens a pinhole for the TFTP file, the FWSM cannot translate the Cisco CallManager IP address and port embedded in the Cisco IP Phone configuration files that are transferred by TFTP during phone registration. The following is not supported for SCCP version 17 phones: • Registrations of endpoints that have IPv6 addresses. The Register messages are dropped and a debug message is generated. • If IPv6 messages are embedded in the SCCP messages, they are not NATed or PATed; they are left untranslated. Note The FWSM supports stateful failover of SCCP calls except for calls that are in the middle of call setup. Configuring and Enabling SCCP Inspection SCCP inspection is enabled by default. 22-90 Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM OL-20748-01