topic SIP Inspection on ASA for customize SIP port tcp/5062. in Network Security

SIP Inspection on ASA for customize SIP port tcp/5062.

ManadarDesai2895 — Tue, 21 Jun 2022 07:50:34 GMT

Dear Community,

I have SIP inspection enabled on my Cisco5516. Now we are migrating different service provider on my SIP server for which we using different SIP ports rather than default one tcp/5060 which is already configured for ISP-1. Now we are migrating ISP-2 on my SIP server which is in DMZ zone behind my ASA & I want to enable SIP inspection for customize port i.e. tcp/5062. How we can achieve that in Cisco ASA? Currently Global SIP inspection has been enabled for tcp-udp/5060.

Re: SIP Inspection on ASA for customize SIP port tcp/5062.

Mohammed al Baqari — Tue, 21 Jun 2022 08:31:19 GMT

Hi,

You can modify the default ports

You can configure the SIP Protocol Inspection for non-standard ports with
these configuration lines (replace XXXX with the new port number):

access-list sip-list extended permit udp any any eq XXXX
!
class-map sip-class
match access-list sip-list
!
policy-map global_policy
class sip-class
inspect sip

**** please remember to rate useful posts

Re: SIP Inspection on ASA for customize SIP port tcp/5062.

ManadarDesai2895 — Tue, 21 Jun 2022 09:23:31 GMT

Thanks MD al Baqari,

Just few questions.

1. Does this policy affect current SIP inspection enabled for tcp/5060 ?

2. Find current global policy configured, would adding other class map affect exiting class map?

policy-map global_policy
description Customize_SIP_Inspection
class inspection_default
inspect ftp
inspect h323 h225
inspect h323 ras
inspect ip-options
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect xdmcp
inspect dns preset_dns_map
inspect sip

Re: SIP Inspection on ASA for customize SIP port tcp/5062.

MHM Cisco World — Tue, 21 Jun 2022 10:03:36 GMT

access-list sip-list extended permit udp any any eq XXXX

access-list sip-list extended permit tcp any any eq 5060<- add this so it also include the default SIP tcp port

Re: SIP Inspection on ASA for customize SIP port tcp/5062.

Mohammed al Baqari — Tue, 21 Jun 2022 10:39:19 GMT

You can consolidate both ports in single ACL (5060 and 5062) or you can
leave the default one and keep 5062 only in the ACL. Both will work.

***** please remember to rate useful posts

Re: SIP Inspection on ASA for customize SIP port tcp/5062.

ManadarDesai2895 — Thu, 23 Jun 2022 06:49:32 GMT

Dear Community,

I have made this changes post that SIP inspection started working for customize ports.

class-map sip-class
match port tcp eq 5062

policy-map global_policy
class sip-class
inspect sip

Re: SIP Inspection on ASA for customize SIP port tcp/5062.

Mohammed al Baqari — Thu, 23 Jun 2022 06:57:20 GMT

That is good news. Please remember to rate useful posts

**** please remember to rate useful posts