Hi Julio, No, ASA is between router and local network switch. As I'm doing NAT on border router I need addresses inside H.323 messages to be NATed too, so that's why I'm trying to use CBAC. (Some people states that CBAC in conjunction with NAT can translate addresses both in IP header and in H.323 messages) ... View more

Julio, No, I've turned off both h323 and h323 ras inspection on ASA. (The same result is achieved with inspection turned on on the ASA) ... View more

Julio, There are the configs: show access-lists Extended IP access list 101     10 permit ip any any (1964 matches) show ip inspect all Inspection Rule Configuration Inspection name TEST     h323 alert is on audit-trail is off timeout 3600     h323-annexe alert is on audit-trail is off timeout 30     h323-nxg alert is on audit-trail is off timeout 30 show running-config {some fragment} interface GigabitEthernet0/0  {connects to provider} ip address x.x.x.x x.x.x.x ip access-group 101 in ip nat outside ip virtual-reassembly duplex auto speed auto interface GigabitEthernet0/1 {connects to inside network} description connect to ASA outside ip address Y.Y.Y.Y Y.Y.Y.Y ip access-group 101 in ip nat inside ip inspect TEST in ip virtual-reassembly duplex auto speed auto standby delay minimum 20 reload 20 standby 10 ip Z.Z.Z.Z standby 10 priority 110 standby 10 preempt delay minimum 20 reload 20 sync 10 standby 10 name Redundancy {NATing Polycom's local IP to global one:} ip nat inside source static A.A.A.A V.V.V.V redundancy Redundancy mapping-id 1   ip nat inside source static B.B.B.B W.W.W.W redundancy Redundancy mapping-id 1 P.S. There is Cisco ASA 5510 between router and internal switch. All ports (both in and out) are opened on ASA for Polycom devices. ... View more

Unfortunately we are using Polycom devices. Are there any other ways to make that work? ... View more

ASA version: Cisco Adaptive Security Appliance Software Version 8.2(1) Device Manager Version 6.3(1) Compiled on Tue 05-May-09 22:45 by builders System image file is "disk0:/asa821-k8.bin" Inspection-related config: policy-map type inspect dns preset_dns_map parameters   message-length maximum 512   message-length maximum client auto policy-map global_policy class inspection_default   inspect dns preset_dns_map   inspect ftp   inspect rsh   inspect sqlnet   inspect sunrpc   inspect xdmcp   inspect sip   inspect netbios   inspect tftp   inspect icmp   inspect rtsp   inspect skinny   inspect h323 ras   inspect h323 h225 Can I NAT only embedded in H323 msgs local addresses to global ones, not addresses in IP header (because they are NAT'd on border router) ? ... View more

Hello Julio, I have read some papers which stands that there are embedded IP addresses in H323 messages and the common problem of call setup is that called endpoint uses IP address in received H323 messages as destination address - this problem exists in our network. Our network also have a gatekeeper (Polycom PathNavigator). As I understand the reason of problem is:   When local terminal with IP address A.A.A.A (registered to GK) calls outside terminal it begins sending H323 messages to GK. {address in both IP header and embedded in H323 msg is A.A.A.A}, then GK rewrites embedded address to its own (e.g. B.B.B.B) and sends it to outside terminal {now address in IP header is A.A.A.A but address in H323 msg is B.B.B.B}, then packet arrives at border router which NATs local A.A.A.A address to global unique G.G.G.G and translates it to outside terminal {now address in IP header is G.G.G.G but address in H323 msg is B.B.B.B}, when outside terminal receives that message it will try to respond to address in H323 msg - B.B.B.B (which is not routable address) and sends it to its def. gateway and this pkt eventually will be dropped by provider. So  I need to to change embeded address in H323 msgs to global NAT'd IP address. When I check NAT option in Polycom terminal configuration it uses global NAT'd address in H323 msgs instead of local, but that makes problem for local endpoints trying to call that terminal (as they need to send pkts to global address) and also there would be problems with GK (as it will rewrite H323 address to its own). My question is how I can change embedded address in H323 msgs. Is it possible on ASA 5510 to rewrite that address to specified one (required to modify only H323 embedded address, not IP header address because border router is doing that NAT) or is it possible to rewrite embedded address on border router (Cisco 1900 with IOS Software (C1900-UNIVERSALK9-M), Version 15.0(1)M5). What you could suggest to solve that problem? ... View more

As I know, VLAN ACLs (VACLs) and SVI ACLs are different things. VACLs are configured with vlan access-map command and SVI ACLs with ip access-group under interface vlan. ... View more

Thanks for the links, but I can't find out if SVI ACLs have impact on CPU (Sup720) ... View more

12-20 lines on average, ACLs are apllied in both direction ... View more