topic Re: Voice Traffic behind ASA in Network Security

Voice Traffic behind ASA

keven.jones — Mon, 11 Mar 2019 19:27:44 GMT

Hello

Is there any known Issue for Voice Traffic on ASA 5520 running version 8.2, we are unable to pass voice traffic from inside to outside and vice-versa.

We tested connecting to SIP Gateway from insdie to outside but no luck and from outside to insdie its the same issue. We got Static NAT and ACL on inside and outside interface, is it something to do with default policy or Issue due to NAT. Our Voice Gateway on inside network needs to communicate with Other Voice Gateway on Internet.

Please input

cheers

Keven

Re: Voice Traffic behind ASA

Kureli Sankar — Sun, 26 Dec 2010 14:46:28 GMT

Do you have sip inspection enabled?

Issue "sh run policy-map" should be able to show you.

-KS

Re: Voice Traffic behind ASA

keven.jones — Sun, 26 Dec 2010 15:36:03 GMT

Thank You KS for the reply, here is the output of show run policy-map.

Do you advice me to check anything else.

( I recollect I had issue with EMSTP and I removed from here, in Pix 525 SMTP issue was resolved with fixup command )

show run policy-map
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect rsh
inspect rtsp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect netbios
inspect tftp
inspect pptp
inspect ftp
class class_ftp
inspect ftp

Re: Voice Traffic behind ASA

Marcin Latosiewicz — Sun, 26 Dec 2010 16:43:42 GMT

Keven,

Provided you're usuing standard port for skinny you can enabled this as first step 😉

policy-map global_policy
class inspection_default
inspect sip

Which is what Kureli meant.

If you're using NAT, ASA needs to inspect payload of SIP messaging.

HTH,

Marcin

Re: Voice Traffic behind ASA

Kureli Sankar — Sun, 26 Dec 2010 17:09:42 GMT

Yes. Exactly. Thanks Marcin

You need inspection to fixup the address from the inside interface to outside interface and vice versa and also open pin holes accordingly.

Also, make sure to issue "sh run service-policy" and make sure you see a line like this one below.

service-policy gobal_policy global

That should take care of it.

Dont' miss my ATE event Starts January 3, 2011: https://supportforums.cisco.com/community/netpro/ask-the-expert

-KS

Re: Voice Traffic behind ASA

keven.jones — Sun, 26 Dec 2010 20:36:16 GMT

Thanks KS

Its working like a champion.