topic Cisco router zone based firewall in Network Security

Cisco router zone based firewall

wayne loh — Tue, 12 Mar 2019 09:15:13 GMT

Hi All,

Could anyone advise on the configuration of the port range port forwarding for the cisco zone based firewall? In face I have the sip trunk that required the range of port forwarding (16000-16511) to internal pabx system.

Many thanks.

Wayne typically RTP uses UDP

Dennis Mink — Mon, 24 Apr 2017 12:47:00 GMT

Wayne typically RTP uses UDP on high ports 16384 - 32767, SIP and SIP_TLS use 5060 and 5061 respectively.

Cisco ASA can be configured to use SIP inspection, which means that the high ports do not have to be explicitly opened, but the ASA will open them dynamically, by inspecting the SIP signalling (at least that is the theory).

Please rate if useful

Hi,

Mohammed al Baqari — Mon, 24 Apr 2017 13:41:47 GMT

Hi,

This is a sample. In your ACLs you can specify the ports you are looking for. Seems that you are running on non-standard SIP.

ip access-list extended IN-OUT
permit ip object-group TRUSTED-SUNBETS object-group TRUSTED-SUNBETS
!
ip access-list extended OUT-IN
permit ip object-group TRUSTED-SUNBETS object-group TRUSTED-SUNBETS

class-map type inspect match-all IN-OUT
match access-group name IN-OUT
class-map type inspect match-all OUT-IN
match access-group name OUT-IN
!
policy-map type inspect IN-OUT
class type inspect IN-OUT
pass
class class-default
!
policy-map type inspect OUT-IN
class type inspect OUT-IN
pass
class class-default

!

zone security OUT
zone security IN

zone-pair security IN-OUT source IN destination OUT
service-policy type inspect IN-OUT
zone-pair security OUT-IN source OUT destination IN
service-policy type inspect OUT-IN

int g0/0
zone security member IN
int g0/1
zone security member OUT