Ports to be opened up for Hosted Voice Access on the ASA

[Ramesh Chauhan]

Hi Guys,

I have a customer who is going to host a VOICE services like providing SIP services to its customers.

Can someone tell me the specific ports required to be opened up for this on ASA  5515X. I would rate it ASAP.

[Jennifer Halim]

For SIP, if they are using default port, normally it's TCP or UDP/5060. However if they change the default port and use other ports, then you would need to configure it accordingly.

Further to that, you would also need to configure "inspect sip" (it's enabled by default, but just in case the inspection is disabled for whatever reason).

Also, you would need to ask your customer if they have other voice services that they need to open ports for apart from SIP.

Here is more information on SIP inspection:

http://www.cisco.com/en/US/docs/security/asa/asa84/command/reference/i2.html#wp1765334

There are also H323 that ASA can inspect. Here is more inforation on H323 inspection:

http://www.cisco.com/en/US/docs/security/asa/asa84/command/reference/i2.html#wp1759941

Lastly, ASA also inspect Skinny, but this is more for Cisco phone environment, so don't think voice hosting services will have this. But just in case you need it, here is more information on Skinny inspection:

http://www.cisco.com/en/US/docs/security/asa/asa84/command/reference/i2.html#wp1762128

Hope that helps.

[Ramesh Chauhan]

Jennifer,

Thanks a lot!

This is from inside to outside access. What about outside to inside access ? What happens when a SIP customer tries to access the SIP services sitting behing the ASA?

[Jennifer Halim]

Same deal, you would need to configure access-list and apply that to the outside interface plus, you would also need to configure static NAT since the traffic is initiated from outside to inside (low to high security levels).