Below is the script you can use to reproduce this. Points worth mentioning.
- Initial invite sets up the media between SIP Trunk and a media device ( 10.1.2.150) in the inside network, SIP signalling will be with 10.1.2.100. At this poit RTP flows freely between the SIP Trunk and the media device.
- If the call is fax, a re-invite will occur and this will cause the IP address to change in the SDP. The new media endpoint becomes 10.1.2.151 (This device is SIP and Media (T38) capable).
- For every SIP call we establish 10.1.2.150 will be used for media, we do not want to change this behaviour.
!
ASA 8.3 (2)
!
conf t
!
interface Ethernet0/0
nameif Inside_Voice
security-level 100
ip address 10.1.2.11 255.255.255.0 standby 10.1.2.12
exit
!
interface Ethernet0/1
nameif Outside_SIP_Trunk
security-level 0
ip address 10.1.60.254 255.255.255.0 standby 10.1.60.253
exit
!
object-group network SIP_trunks
network-object 1.2.3.0 255.255.255.0
exit
!
object-group service SIP_service
service-object tcp destination eq sip
service-object udp destination eq sip
exit
!
object-group network SIP_inside_servers
network-object host 10.1.2.100
exit
!
access-list Outside_SIP_in extended permit object-group SIP_service object-group SIP_trunks object-group SIP_inside_servers
!
access-group Outside_SIP_in in interface Outside_SIP_Trunk
!
route Outside_SIP_Trunk 0.0.0.0 0.0.0.0 10.1.60.1
!
class-map inspection_default
match default-inspection-traffic
exit
!
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect ip-options
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
inspect icmp
inspect icmp error
lass class-default
set connection decrement-ttl
exit
!
service-policy global_policy global
!
end
