NO Inspect SIP

[S.mooney12]

Hi Guys

Ran into an issue today with our VOIP service provider, calls were not coming through, a quick call to the service provider suggested to turn of SIP inspection, and yep it works.

My question is if SIP is not being inspected and we have no ACL how does this work?

Thanks 

[Dennis Mink · Accepted solution]

when you turn SIP inspection off, you essentially pass on SIP traffic (most likely based on udp/5060 and 61 or tcp).   the ASA will then not "intelligently" inspect SIP protocol headers and dynamically open up RTP ports based on the inspection.  SIP inspection can be a bit of a double edged sword. sometimes it creates problems, sometimes it fixes them 

[David_Mason]

@Dennis Mink we recently had a very similar issue.  

Here's the setup:

We have a global deny policy - no ACL, no pass. 

We did not have ACLs allowing traffic to flow through a firewall to our CUBEs.

SIP inspection was ON.

Calls are flowing.

Change to inspection policy - do not match (inspect) for a single IP.

We apply policy and no new RTP is set up, resulting in calls coming through with no audio.

We quickly put ACLs in place to allow our SIP endpoints (Soft Phones) a path to the CUBEs.

Calls start flowing.

Inspection policy is still in place.

We open a TAC case and the agent says it should have never worked without ACLs.

I'm a little confused.  Should the inspection policy dynamically create pathways for SIP traffic or is an ACL required?  it seems to be as of right now, at least, but the doesn't explain the last few years.  Of note - this is the first time we've touched the inspection policy in our tenure here.