Cisco PIX 525 Especificaciones descargar pdf (Pagina 339)

21-13

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 21 Applying Application Layer Protocol Inspection

Managing CTIQBE Inspection

Verifying and Monitoring CTIQBE Inspection

The show ctiqbe command displays information regarding the CTIQBE sessions established across the

security appliance. It shows information about the media connections allocated by the CTIQBE

inspection engine.

The following is sample output from the show ctiqbe command under the following conditions. There

is only one active CTIQBE session setup across the security appliance. It is established between an

internal CTI device (for example, a Cisco IP SoftPhone) at local address 10.0.0.99 and an external Cisco

CallManager at 172.29.1.77, where TCP port 2748 is the Cisco CallManager. The heartbeat interval for

the session is 120 seconds.

hostname# # show ctiqbe

Total: 1

LOCAL FOREIGN STATE HEARTBEAT

---------------------------------------------------------------

1 10.0.0.99/1117 172.29.1.77/2748 1 120

----------------------------------------------

RTP/RTCP: PAT xlates: mapped to 172.29.1.99(1028 - 1029)

----------------------------------------------

MEDIA: Device ID 27 Call ID 0

Foreign 172.29.1.99 (1028 - 1029)

Local 172.29.1.88 (26822 - 26823)

----------------------------------------------

The CTI device has already registered with the CallManager. The device internal address and RTP

listening port is PATed to 172.29.1.99 UDP port 1028. Its RTCP listening port is PATed to UDP 1029.

The line beginning with

RTP/RTCP: PAT xlates: appears only if an internal CTI device has registered

with an external CallManager and the CTI device address and ports are PATed to that external interface.

This line does not appear if the CallManager is located on an internal interface, or if the internal CTI

device address and ports are NATed to the same external interface that is used by the CallManager.

The output indicates a call has been established between this CTI device and another phone at

172.29.1.88. The RTP and RTCP listening ports of the other phone are UDP 26822 and 26823. The other

phone locates on the same interface as the CallManager because the security appliance does not maintain

a CTIQBE session record associated with the second phone and CallManager. The active call leg on the

CTI device side can be identified with Device ID 27 and Call ID 0.

The following is sample output from the show xlate debug command for these CTIBQE connections:

hostname# show xlate debug

3 in use, 3 most used

Flags: D - DNS, d - dump, I - identity, i - inside, n - no random,

r - portmap, s - static

TCP PAT from inside:10.0.0.99/1117 to outside:172.29.1.99/1025 flags ri idle 0:00:22

timeout 0:00:30

UDP PAT from inside:10.0.0.99/16908 to outside:172.29.1.99/1028 flags ri idle 0:00:00

timeout 0:04:10

UDP PAT from inside:10.0.0.99/16909 to outside:172.29.1.99/1029 flags ri idle 0:00:23

timeout 0:04:10

The show conn state ctiqbe command displays the status of CTIQBE connections. In the output, the

media connections allocated by the CTIQBE inspection engine are denoted by a ‘C’ flag. The following

is sample output from the show conn state ctiqbe command:

hostname# show conn state ctiqbe

1 in use, 10 most used

hostname# show conn state ctiqbe detail

1 in use, 10 most used

Flags: A - awaiting inside ACK to SYN, a - awaiting outside ACK to SYN,

1 2 ... 334 335 336 337 338 339 340 341 342 343 344 ... 603 604

Comentarios a estos manuales

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 339

Comentarios a estos manuales