topic Cisco ASA and polycom in Network Security

Cisco ASA and polycom

Jaro — Fri, 21 Feb 2020 15:54:42 GMT

Hello All,

I have a polycom in my internal network behind firewall cisco asa 5506.

Problem is that second site can see video and audio too, but on my site I cannot see nothing.

Situation is:

Polycom(10.10.10.1) --- > Cisco ASA(NAT to 192.168.1.2) --- > and then it goes to outside interface of provider (192.168.1.253) , and on provider router there is second NAT to some public IP.

NOTE: Polycom has management interface, which is reachable via https to public IP and it is working, so I guess there is NAT 1:1 and it should be okay.

Could you please help me what I should check on cisco ASA? I have already checked realview monitoring and there wasn´t any deny log, or something which should indicate some issues with audio or video.

Could you please help me with this issue ?

Thank you

Re: Cisco ASA and polycom

Francesco Molino — Sun, 24 Jun 2018 02:14:34 GMT

The communication is using sip?

Do you have inspect sip enabled?

Can you share your config please? Remove confidential data before and upload the config in a text file.

Re: Cisco ASA and polycom

Jaro — Mon, 25 Jun 2018 09:42:32 GMT

Hello Francesco, thank you very much for your answer,

The communication is using H323.

Yes I have inspect sip, h323.. etc enabled, please check configuration in attachement.

Thank you

Re: Cisco ASA and polycom

Florin Barhala — Mon, 25 Jun 2018 10:18:41 GMT

Right of the bat, can you schedule a maintenance window and simply disable H232 inspection then see how this goes?

Re: Cisco ASA and polycom

Francesco Molino — Mon, 25 Jun 2018 18:31:09 GMT

As Florin said, can you remove inspect sip?
Use the following to remove it:

policy-map global_policy
class inspection_default
no inspect sip
no inspect h323 h225
no inspect h323 ras

And then test it again and let us know please.