topic Re: PIX and SIP in Network Security

PIX and SIP

dngo01 — Fri, 21 Feb 2020 05:48:22 GMT

Please help me to provide an example of configuration to allow SIP with SDP information traversing the PIX Firewall.

According to the PIX Release Note version 6, SIP support is enhanced to read the IP address and port number in SIP messages body, but there is no explanation of how it works and no example to set up the rules.

Any help is appreciated.

Re: PIX and SIP

mmellet — Tue, 19 Jun 2001 18:52:58 GMT

If SIP is enabled through the firewall with a conduit on port 5060, support is automatically enabled (see the fixup protocol sip command). It would be best to use a SIP proxy server like http://www.cisco.com/univercd/cc/td/doc/product/voice/sipproxy/cdinst/solinst.htm in combination with the PIX.

Re: PIX and SIP

dngo01 — Tue, 19 Jun 2001 20:26:09 GMT

Thank you for your help.

Let me summarize this:

Using PIX and SIP proxy server, I can use the command "Fixup protocol sip 5060" to enable SIP support. Then, PIX will dynamically translate (NAT'ed)incoming/outgoing IP and port address contained in the SDP. There is no setup for this (NAT) translation.

Is my understanding correct?

Thanks.

Re: PIX and SIP

mmellet — Thu, 21 Jun 2001 19:16:16 GMT

It looks good to me. fixup protocol sip 5060 is on by default so the PIX should inspect the payload of the port 5060 packet and fix the NAT where applicable.