SIP Inspection on ASA for customize SIP port tcp/5062.

[ManadarDesai2895]

Dear Community,

I have SIP inspection enabled on my Cisco5516. Now we are migrating different service provider on my SIP server for which we using different SIP ports rather than default one tcp/5060 which is already configured for ISP-1. Now we are migrating ISP-2 on my SIP server which is in DMZ zone behind my ASA & I want to enable SIP inspection for customize port i.e. tcp/5062. How we can achieve that in Cisco ASA?  Currently Global SIP inspection has been enabled for tcp-udp/5060. 

[Mohammed al Baqari]

Hi,

You can modify the default ports

You can configure the SIP Protocol Inspection for non-standard ports with
these configuration lines (replace XXXX with the new port number):

access-list sip-list extended permit udp any any eq XXXX
!
class-map sip-class
match access-list sip-list
!
policy-map global_policy
class sip-class
inspect sip

**** please remember to rate useful posts

[ManadarDesai2895]

Thanks MD al Baqari,

Just few questions.

1. Does this policy affect current SIP inspection enabled for tcp/5060 ?

2. Find current global policy configured, would adding other class map affect exiting class map?

policy-map global_policy
description Customize_SIP_Inspection
class inspection_default
inspect ftp
inspect h323 h225
inspect h323 ras
inspect ip-options
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect xdmcp
inspect dns preset_dns_map
inspect sip

[MHM Cisco World · Accepted solution]

access-list sip-list extended permit udp any any eq XXXX

access-list sip-list extended permit tcp any any eq 5060<- add this so it also include the default SIP tcp port

[Mohammed al Baqari · Accepted solution]

You can consolidate both ports in single ACL (5060 and 5062) or you can
leave the default one and keep 5062 only in the ACL. Both will work.

***** please remember to rate useful posts

[ManadarDesai2895]

Dear Community,

I have made this changes post that SIP inspection started working for customize ports.

class-map sip-class
  match port tcp eq 5062

policy-map global_policy
  class sip-class
  inspect sip

[Mohammed al Baqari]

That is good news. Please remember to rate useful posts

**** please remember to rate useful posts