Cisco PIX 525 Especificaciones descargar pdf (Pagina 351)

21-25

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 21 Applying Application Layer Protocol Inspection

Managing H.323 Inspection

An H.323 client may initially establish a TCP connection to an H.323 server using TCP port 1720 to

request Q.931 call setup. As part of the call setup process, the H.323 terminal supplies a port number to

the client to use for an H.245 TCP connection. In environments where H.323 gatekeeper is in use, the

initial packet is transmitted using UDP.

H.323 inspection monitors the Q.931 TCP connection to determine the H.245 port number. If the H.323

terminals are not using FastConnect, the security appliance dynamically allocates the H.245 connection

based on the inspection of the H.225 messages.

Within each H.245 message, the H.323 endpoints exchange port numbers that are used for subsequent

UDP data streams. H.323 inspection inspects the H.245 messages to identify these ports and dynamically

creates connections for the media exchange. RTP uses the negotiated port number, while RTCP uses the

next higher port number.

The H.323 control channel handles H.225 and H.245 and H.323 RAS. H.323 inspection uses the

following ports.

• 1718—Gate Keeper Discovery UDP port

• 1719—RAS UDP port

• 1720—TCP Control Port

You must open an access list for the well-known H.323 port 1720 for the H.225 call signaling. However,

the H.245 signaling ports are negotiated between the endpoints in the H.225 signaling. When an H.323

gatekeeper is used, the security appliance opens an H.225 connection based on inspection of the ACF

message.

The security appliance dynamically allocates the H.245 channel after inspecting the H.225 messages and

then links to the H.245 channel to be fixed up as well. That means whatever H.245 messages pass

through the security appliance pass through the H.245 application inspection, NATing embedded IP

addresses and opening the negotiated media channels.

The H.323 ITU standard requires that a TPKT header, defining the length of the message, precede the

H.225 and H.245, before being passed on to the reliable connection. Because the TPKT header does not

necessarily need to be sent in the same TCP packet as the H.225/H.245 message, the security appliance

must remember the TPKT length to process/decode the messages properly. The security appliance keeps

a data structure for each connection and that data structure contains the TPKT length for the next

expected message.

If the security appliance needs to NAT any IP addresses, then it changes the checksum, the UUIE length,

and the TPKT, if included in the TCP packet with the H.225 message. If the TPKT is sent in a separate

TCP packet, then the security appliance proxy ACKs that TPKT and append a new TPKT to the H.245

message with the new length.

Note The security appliance does not support TCP options in the Proxy ACK for the TPKT.

Each UDP connection with a packet going through H.323 inspection is marked as an H.323 connection

and times out with the H.323 timeout as configured with the timeout command.

Limitations and Restrictions

The following are some of the known issues and limitations when using H.323 application inspection:

• Static PAT may not properly translate IP addresses embedded in optional fields within H.323

messages. If you experience this kind of problem, do not use static PAT with H.323.

1 2 ... 346 347 348 349 350 351 352 353 354 355 356 ... 603 604

Comentarios a estos manuales

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 351

Comentarios a estos manuales