We've read everything about inspecting SIP packets and allowing them to pass through on port 5060, the default SIP port. However, our setup requires the ASA 5505 to allow SIP on ports 5060, 5160 and 5260. Is this possible with the ASA 5505? If it's not, it would be a blocking issue for us to move forward with ASA appliances. We are currently investigating in a lab environment and really having difficulties configuring it to facilitate full SIP functionality. Additional information that our provider gave us is that we would have to allow Port: 5060 / UDP (SIP) Port: 5004 / UDP (RTP) Port: 3478 UDP (STUN) Any help is greatly appreciated. Best, -Ralf ... View more

Hi there, Sorry for "spamming" this forum but we're new to the ASA and really want to get the most out of it. We're running three networks (inside, outside and dmz). Inside is 10.0.1.0/24, dmz is 10.0.2.0/24, outside is a static ip allocated by our ISP. We'd like to configure the following: All traffic from the outside to [static provider ip] on port 80 should go to 10.0.2.200 port 8080. What do we have to configure to do so? ... View more

Hi there, We recently purchases the Cisco ASA 5505 to get familiar with it, possibly buying more appliances for our branch offices. However, since the appliance is installed, our SIP telephones no longer register with our SIP service provider. The SIP phones are all on 10.0.1.0/24 while the SIP provider is external via the outside network. I copied our configuration below. Can anybody advise how to enable SIP for all 10.0.1.0/24 hosts and ports 5060, 5160, 5260, 5360? This matter is pretty urgent... gcxfw# show running-config : Saved : ASA Version 8.4(3) ! hostname gcxfw domain-name *** enable password *** encrypted passwd *** encrypted names ! interface Ethernet0/0 switchport access vlan 2 ! interface Ethernet0/1 ! interface Ethernet0/2 ! interface Ethernet0/3 ! interface Ethernet0/4 ! interface Ethernet0/5 ! interface Ethernet0/6 ! interface Ethernet0/7 switchport access vlan 12 ! interface Vlan1 nameif inside security-level 100 ip address 10.0.1.1 255.255.255.0 ! interface Vlan2 nameif outside security-level 0 ip address 195.14.245.70 255.255.255.224 ! interface Vlan12 nameif dmz security-level 50 ip address 10.0.2.1 255.255.255.0 ! ftp mode passive dns domain-lookup inside dns domain-lookup outside dns server-group DefaultDNS name-server 194.8.194.60 name-server 213.168.112.60 domain-name *** object network obj_any subnet 0.0.0.0 0.0.0.0 object network obj-10.0.1.0 subnet 10.0.1.0 255.255.255.0 object network obj-10.0.2.0 subnet 10.0.2.0 255.255.255.0 pager lines 24 logging enable logging asdm informational mtu inside 1500 mtu outside 1500 mtu dmz 1500 no failover icmp unreachable rate-limit 1 burst-size 1 no asdm history enable arp timeout 14400 nat (dmz,outside) source dynamic obj_any interface nat (inside,dmz) source static obj-10.0.1.0 obj-10.0.1.0 destination static obj-10.0.2.0 obj-10.0.2.0 ! object network obj_any nat (inside,outside) dynamic interface route outside 0.0.0.0 0.0.0.0 195.14.245.65 1 timeout xlate 3:00:00 timeout pat-xlate 0:00:30 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 timeout floating-conn 0:00:00 dynamic-access-policy-record DfltAccessPolicy user-identity default-domain LOCAL aaa authentication ssh console LOCAL http server enable http 10.0.1.0 255.255.255.0 inside http 0.0.0.0 0.0.0.0 outside no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart crypto ca trustpoint _SmartCallHome_ServerCA crl configure crypto ca certificate chain _SmartCallHome_ServerCA certificate ca 6ecc7aa5a7032009b8cebcf4e952d491     ***   quit telnet timeout 5 ssh 10.0.1.0 255.255.255.0 inside ssh 0.0.0.0 0.0.0.0 outside ssh timeout 5 console timeout 0 dhcpd dns 194.8.194.60 213.168.112.60 dhcpd auto_config inside ! threat-detection basic-threat threat-detection statistics threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200 webvpn username *** password *** encrypted privilege 15 ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters   message-length maximum client auto   message-length maximum 512 policy-map global_policy class inspection_default   inspect dns preset_dns_map   inspect ftp   inspect h323 h225   inspect h323 ras   inspect rsh   inspect rtsp   inspect esmtp   inspect sqlnet   inspect skinny    inspect sunrpc   inspect xdmcp   inspect sip    inspect netbios   inspect tftp   inspect ip-options   inspect icmp class class-default   user-statistics accounting ! service-policy global_policy global prompt hostname context call-home reporting anonymous hpm topN enable Cryptochecksum:3636b3a4cffda0c099e3e65ba598164f : end ... View more

Hi there, With our below configuration, hosts on the inside network (10.0.1.0/24) cannot ping the host 10.0.2.200 on the dmz network. What do we have to add/change to make this possible? We also want hosts on inside to be able to do a Mac OS Remote Desktop connection to the host on 10.0.2.200. From the documentation we were to believe, that all traffic from higher security networks (inside) to lower security networks (dmz) would be permitted by default. Looking forward to your help. Has always been speedy and fantastic. Thanks in advance! : Saved : ASA Version 8.4(3) ! hostname *** domain-name *** enable password *** encrypted passwd *** encrypted names ! interface Ethernet0/0 switchport access vlan 2 ! interface Ethernet0/1 ! interface Ethernet0/2 ! interface Ethernet0/3 ! interface Ethernet0/4 ! interface Ethernet0/5 ! interface Ethernet0/6 ! interface Ethernet0/7 switchport access vlan 12 ! interface Vlan1 nameif inside security-level 100 ip address 10.0.1.1 255.255.255.0 ! interface Vlan2 nameif outside security-level 0 ip address 195.14.245.70 255.255.255.224 ! interface Vlan12 nameif dmz security-level 50 ip address 10.0.2.1 255.255.255.0 ! ftp mode passive dns domain-lookup inside dns domain-lookup outside dns server-group DefaultDNS name-server *** name-server *** domain-name *** object network obj_any subnet 0.0.0.0 0.0.0.0 pager lines 24 logging enable logging asdm informational mtu inside 1500 mtu outside 1500 mtu dmz 1500 no failover icmp unreachable rate-limit 1 burst-size 1 no asdm history enable arp timeout 14400 nat (dmz,outside) source dynamic obj_any interface ! object network obj_any nat (inside,outside) dynamic interface route outside 0.0.0.0 0.0.0.0 195.14.245.65 1 timeout xlate 3:00:00 timeout pat-xlate 0:00:30 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 timeout floating-conn 0:00:00 dynamic-access-policy-record DfltAccessPolicy user-identity default-domain LOCAL aaa authentication ssh console LOCAL http server enable http 10.0.1.0 255.255.255.0 inside http 0.0.0.0 0.0.0.0 outside no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart crypto ca trustpoint _SmartCallHome_ServerCA crl configure crypto ca certificate chain _SmartCallHome_ServerCA certificate ca 6ecc7aa5a7032009b8cebcf4e952d491     ***   quit telnet timeout 5 ssh 10.0.1.0 255.255.255.0 inside ssh 0.0.0.0 0.0.0.0 outside ssh timeout 5 console timeout 0 dhcpd dns *** *** dhcpd auto_config inside !             threat-detection basic-threat threat-detection statistics threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200 webvpn username *** password *** encrypted privilege 15 ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters   message-length maximum client auto   message-length maximum 512 policy-map global_policy class inspection_default   inspect dns preset_dns_map   inspect ftp   inspect h323 h225   inspect h323 ras   inspect rsh   inspect rtsp   inspect esmtp   inspect sqlnet   inspect skinny    inspect sunrpc   inspect xdmcp   inspect sip    inspect netbios   inspect tftp   inspect ip-options class class-default   user-statistics accounting ! service-policy global_policy global prompt hostname context call-home reporting anonymous hpm topN enable Cryptochecksum:*** : end ... View more