SIP through ASA 5505

[elliott.barrere]

Hi all,

I'm trying to allow SIP calls through a 5505 running version 8.2(2).  I've passed port 5060 through the firewall but now I'm seeing the RTP traffic blocked.  I read this page and added this to my config:

class-map inspection_default

match default-inspection-traffic

policy-map global_policy

class inspection_default

inspect sip

service-policy global_policy global

but it's not working.  No idea what else to do!  Any pointers or advice??

Thanks for any help in advance!

Cheers,

-elliott-

[elliott.barrere]

Hi PK,

Thanks for the advice, unfortunately I have tried "debug sip" and I see nothing on the console!  Is there anything that could be preventing me from seeing the logs?  I have set "logging console debug".

[Panos Kampanakis]

Him, if sip inspection is not kicking in then the pinholes will not be opened.

You have sip inspection enabled haven't you?

Does "show service-policy" show counters for sip?

PK

[elliott.barrere]

I have tried to enable it by configuring it in my class-map.  I now see counters for SIP in "show service-policy" but they are empty, even after I make a call.  Still seeing the RTP ports blocked too (I have tried "debug sip" and "debug rtp" and I see nothing on the console when making calls)

# sh service-policy 

Interface inside:
  Service-policy: global_policy
    Class-map: inspection_default
      Inspect: sip , packet 0, drop 0, reset-drop 0
               tcp-proxy: bytes in buffer 0, bytes dropped 0

Interface outside:
  Service-policy: global_policy
    Class-map: inspection_default
      Inspect: sip , packet 0, drop 0, reset-drop 0
               tcp-proxy: bytes in buffer 0, bytes dropped 0

[Panos Kampanakis]

Yeah, the inspection is not kicking in.

Can you "clear local " for the ip that has the issue? And try to pass sip again t see counters increment?

Make sure you have tcp port 5060 in your sip packets and they are hitting the ASA.

Also give us the "sh run policy-map" and "sh run class-map"

PK

[elliott.barrere]

Okay, now we're getting somewhere!

I first tried running "clear local " and that didn't work (didn't seem to be doing anything) but a "clear local" with no args cleared out the whole state table and now the SIP counters are updating and I see channel information with "show sip".  I will have to wait until I'm in the office on Monday to see if the audio path is actually coming up now, but I have hope at this point

Thanks for your help so far!

[Panos Kampanakis]

I believe sip inspection will open the pinholes for the voice streams now.

Good luck,

PK

[abdel1967]

dear,

did you managed to resolve your issue? i have the same and i m looking for advice?

regards