topic ASA H323 inspection in Network Security

ASA H323 inspection

mj11 — Tue, 12 Mar 2019 02:28:22 GMT

Hi All

I am hoping someone is able to help me with the following, I have checked the Cisco site to no avail.

We have a requirement to disable H323 inspection on a set of access-list on the Cisco ASA firewall for a video conferencing solution however the firewall still needs to have it enabled as part of the default inspection policy.

Any help much appreciated.

Thanks MJ

ASA H323 inspection

Marvin Rhoads — Wed, 21 Aug 2013 04:13:20 GMT

Create a class-map with an access list match criterion that excludes the network addresses you don't want inspected and then tell a policy map to inspect using the H.323. inspection the traffic that matches that class-map.

Apply to the appropriate interface with a service policy.

ASA H323 inspection

mj11 — Fri, 23 Aug 2013 17:35:54 GMT

Hi Marvin

Thank you for the information. The dynamic nature of the H323 does anyone know how the access list would look?

Thanks MJ

ASA H323 inspection

Marius Gunnerud — Fri, 23 Aug 2013 18:29:29 GMT

You could do something like the following:

access-list filter-list extended deny tcp 1.1.1.0 255.255.255.0 any eq h323

access-list filter-list extended deny udp 1.1.1.0 255.255.255.0 any range 1718 1719

access-list filter-list extended permit tcp any any eq h323

access-list filter-list extended permit udp any any range 1718 1719

Then apply it to the global policy map.