Cisco Asdm 7 User Guide
Have a look at the manual Cisco Asdm 7 User Guide online for free. It’s possible to download the document as PDF or print. UserManuals.tech offer 53 Cisco manuals and user’s guides for free. Share the user manual or guide on Facebook, Twitter or Google+.
21-33 Cisco ASA Series Firewall ASDM Configuration Guide Chapter 21 Configuring Cisco Intercompany Media Engine Proxy Configuring Cisco Intercompany Media Engine Proxy NoteIn an off path deployment any existing ASA that you have deployed in your environment are not capable of transmitting Cisco Intercompany Media Engine traffic. Off-path signaling requires that outside addresses are translated (using NAT) to an inside IP address. The inside interface address can be used for this mapping service configuration. For the Cisco Intercompany Media Engine Proxy, the ASA creates dynamic mappings for external addresses to the internal IP address. Step 10In the Fallback area, configure the fallback timer for the Cisco Intercompany Media Engine by specifying the following settings: a.In the Fallback Sensitivity File field, enter the path to a file in flash memory that the ASA uses for mid-call PSTN fallback. The file name that you enter must be the name of a file on disk that includes the .fbs file extension. Alternatively, click the Browse Flash button to locate and select the file from flash memory. b.In the Call Quality Evaluation Interval field, enter a number between 10-600 (in milliseconds). This number controls the frequency at which the ASA samples the RTP packets received from the Internet. The ASA uses the data sample to determine if fallback to the PSTN is needed for a call. By default, the length is 100 milliseconds for the timer. c.In the Notification Interval field, enter a number between 10-360 (in seconds). This number controls the amount of time that the ASA waits before notifying Cisco UCM whether to fall back to PSTN. By default, the length is 20 seconds for this timer. NoteWhen you change the fallback timer for the Cisco Intercompany Media Engine Proxy, ASDM automatically removes the proxy from SIP inspection and then reapplies SIP inspection when the proxy is re-enabled. Step 11Click Apply to save the configuration changes for the Cisco Intercompany Media Engine Proxy. Configuring the Cisco UC-IMC Proxy by using the Unified Communications Wizard To configure the Cisco Intercompany Media Engine Proxy by using ASDM, choose Wizards > Unified Communications Wizard from the menu. The Unified Communications Wizard opens. From the first page, select the Cisco Intercompany Media Engine Proxy option under the Business-to-Business section. The wizard automatically creates the necessary TLS proxy, then guides you through creating the Intercompany Media Engine proxy, importing and installing the required certificates, and finally enables the SIP inspection for the Intercompany Media Engine traffic automatically. The wizard guides you through these steps to create the Cisco Intercompany Media Engine Proxy: Step 1Select the Intercompany Media Engine Proxy option. Step 2Select the topology of the Cisco Intercompany Media Engine Proxy, namely whether the ASA is an edge firewall with all Internet traffic flowing through it or whether the ASA is off the path of the main Internet traffic (referred to as an off path deployment). Step 3Specify private network settings such as the Cisco UCM IP addresses and the ticket settings.
21-34
Cisco ASA Series Firewall ASDM Configuration Guide
Chapter 21 Configuring Cisco Intercompany Media Engine Proxy
Configuring Cisco Intercompany Media Engine Proxy
Step 4Specify the public network settings.
Step 5Specify the media termination address settings of Cisco UCM.
Step 6Configure the local-side certificate management, namely the certificates that are exchanged between the
local Cisco Unified Communications Manager servers and the ASA. The identity certificate that the
wizard generates in this step needs to be installed on each Cisco Unified Communications Manager
(UCM) server in the cluster with the proxy and each identity certificate from the Cisco UCMs need to
be installed on the ASA. The certificates are used by the ASA and the Cisco UCMs to authenticate each
other, respectively, during TLS handshakes. The wizard only supports self-signed certificates for this
step.
Step 7Configure the remote-side certificate management, namely the certificates that are exchanged between
the remote server and the ASA. In this step, the wizard generates a certificate signing request (CSR).
After successfully generating the identity certificate request for the proxy, the wizard prompts you to
save the file.
You must send the CSR text file to a certificate authority (CA), for example, by pasting the text file into
the CSR enrollment page on the CA website. When the CA returns the Identity Certificate, you must
install it on the ASA. This certificate is presented to remote servers so that they can authenticate the ASA
as a trusted server.
Finally, this step of the wizard assists you in installing the root certificates of the CA from the remote
servers so that the ASA can determine that the remote servers are trusted.
The wizard completes by displaying a summary of the configuration created for Cisco Intercompany
Media Engine. See the Unified Communications Wizard section in this documentation for more
information.
This section describes how to certain options of the show uc-ime command to obtain troubleshooting
information for the Cisco Intercompany Media Engine Proxy. See the command reference for detailed
information about the syntax for these commands.
show uc-ime signaling-sessions
Displays the corresponding SIP signaling sessions stored by the Cisco Intercompany Media Engine
Proxy. Use this command to troubleshoot media or signaling failure. The command also displays the
fallback parameters extracted from the SIP message headers, whether RTP monitoring is enabled or
disabled, and whether SRTP keys are set.
Through the use of the Cisco Intercompany Media Engine Proxy, not only signaling but also media is
secured for communication. It provides signaling encryption and SRTP/RTP conversion with SRTP
enforced on the Internet side. The Cisco Intercompany Media Engine Proxy inserts itself into the media
path by modifying the SIP signaling messages from Cisco UCMs.The Cisco Intercompany Media Engine
Proxy sits on the edge of the enterprise and inspects SIP signaling between SIP trunks created between
enterprises. It terminates TLS signaling from the Internet and initiates TCP or TLS to the local Cisco
UCM.
hostname# show uc-ime signaling-sessions
1 in use, 3 most used
inside 192.168.10.30:39608 outside 10.194.108.118:5070
Local Media (audio) conn: 10.194.108.119/29824 to 10.194.108.109/21558
Local SRTP key set : Remote SRTP key set
Remote Media (audio) conn: 192.168.10.51/19520 to 192.168.10.3/30930
Call-ID: [email protected]
FB Sensitivity: 3
Session ID: 2948-32325449-0@81a985c9-f3a1-55a0-3b19-96549a027259
21-35 Cisco ASA Series Firewall ASDM Configuration Guide Chapter 21 Configuring Cisco Intercompany Media Engine Proxy Configuring Cisco Intercompany Media Engine Proxy SIP Trunk URI: 81a985c9-f3a1-55a0-3b19-9654@UCM-30;maddr=192.168.10.30 Codec-name: G722 Payload type: 9 NoteIf calls are not going through the Cisco Intercompany Media Engine, you can also use the show tls-proxy session command to troubleshoot the success of the TLS handshake between the components in the Cisco Intercompany Media Engine system. See the command reference for information about this command. show uc-ime signaling-sessions statistics Displays statistical information about corresponding signaling sessions stored by Cisco Intercompany Media Engine Proxy. Failure of signaling sessions in the Cisco Intercompany Media Engine can occur for different call-related reasons; such as failure of ticket verification or domain name verification, or offering RTP over the Internet. hostname# show uc-ime signaling-sessions statistics 10 in use, 20 most used 15 terminated Ticket integrity check failed: 2 Ticket decode failed: 1 Ticket epoch mismatch: 1 Ticket DID mismatch: 0 Ticket timestamp invalid: 4 Ticket domain check failed: 2 Ticket not found: 0 Route domain name check failed: 1 RTP over UC-IME: 2 NoteCall-related failures, for example, can be due to the service policy rule being reconfigured or the primary ASA operating in failover mode. If a service policy rule for the Cisco Intercompany Media Engine Proxy is removed (by using the no service policy command) and reconfigured, the first call trasversing the ASA will fail. To resolve this issue, you must additionally enter the clear connection command and restart the ASA. If the failure is due to failover, the connections from the primary ASA are not synchronized to the standby ASA. show uc-ime media-sessions detail Displays the details about all active media sessions (calls) stored for the Cisco Intercompany Media Engine Proxy. Use this command to display output from successful calls. Additionally, use this command to troubleshoot problems with IP phone audio, such as one-way audio. If no calls are currently up, this output will be blank. hostname(config)# show uc-ime media-sessions detail 2 in use, 5 most used Media-session: 10.194.108.109/21558 :: client ip 192.168.10.51/19520 Call ID: [email protected] Session ID: 2948-32325449-0@81a985c9-f3a1-55a0-3b19-96549a027259 Lcl SRTP conn 10.194.108.109/21558 to 10.194.108.119/29824 tx_pkts 20203 rx_pkts 20200 refcnt 3 : created by Inspect SIP, passthrough not set RTP monitoring is enabled Failover_state : 0 Sum_all_packets : 20196 Codec_payload_format : 9 RTP_ptime_ms : 20 Max_RBLR_pct_x100 : 0 Max_ITE_count_in_8_sec : 0
21-36
Cisco ASA Series Firewall ASDM Configuration Guide
Chapter 21 Configuring Cisco Intercompany Media Engine Proxy
Configuring Cisco Intercompany Media Engine Proxy
Max_BLS_ms : 0
Max_PDV_usec : 1000
Min_PDV_usec : 0
Mov_avg_PDV_usec : 109
Total_ITE_count : 0
Total_sec_count : 403
Concealed_sec_count : 0
Severely_concealed_sec_count : 0
Max_call_interval_ms : 118
Total_SequenceNumber_Resets : 0
Media-session: 192.168.10.3/30930 :: client ip 10.194.108.119/29824
Call ID: N/A
Lcl RTP conn 192.168.10.3/30930 to 192.168.10.51/19520 tx_pkts 20201 rx_pkts 20203
show uc-ime fallback-notification statistics
Displays statistics about the PSTN fallback notifications to the Cisco UMC. Even if a call is sent over
VoIP because the quality of the connection was good, the connection quality might worsen mid-call. To
ensure an overall good experience for the end user, Cisco Intercompany Media Engine attempts to
perform a mid-call fallback. Performing a mid-call fallback requires the adaptive security appliance to
monitor the RTP packets coming from the Internet. If fallback is required, the adaptive security
appliance sends a REFER message to Cisco UCM to tell it that it needs to fallback the call to PSTN.
Cisco Intercompany Media Engine uses a configurable hold-down timer to set the amount of time that
adaptive security appliance waits before notifying Cisco UCM whether to fall back to PSTN.
hostname# show uc-ime fallback-notification statistics
UCM address: 172.23.32.37
Total Notifications Sent: 10
show uc-ime mapping-service-sessions
When the Cisco Intercompany Media Engine Proxy is configured for an off path deployment, displays
mapping-service requests and replies between the proxy and the local Cisco UMC. A TCP port on the
ASA is configured to listen for mapping requests.
The port number must be 1024 or higher to avoid conflicts with other services on the device, such as
Telnet or SSH. By default, the port number is TCP 8060.
Hostname# show uc-b2blink mapping-service-sessions
Total active sessions: 2
Session client (IP:Port) Idle time
192.168.1.10:2001 0:01:01
192.168.1.20:3001 0:10:20
show uc-ime mapping-service-sessions statistics
Displays statistical information about the Cisco Intercompany Media Engine Proxy mapping service
used in off path signaling.
Hostname# show uc-ime mapping-service-sessions statistics
Total active sessions: 2
Session client Total Responses Failed Pending Idle
(IP:Port) requests sent requests responses time
192.168.1.10:2001 10 9 1 0 0:01:01
192.168.1.20:3001 19 19 0 0 0:10:20
21-37 Cisco ASA Series Firewall ASDM Configuration Guide Chapter 21 Configuring Cisco Intercompany Media Engine Proxy Feature History for Cisco Intercompany Media Engine Proxy Feature History for Cisco Intercompany Media Engine Proxy Table 21-1 lists the release history for this feature. Table 21-1 Feature History for Cisco Phone Proxy Feature Name Releases Feature Information Cisco Intercompany Media Engine Proxy 8.3(1) The Cisco Intercompany Media Engine Proxy was introduced. The following pane was added to the ASDM: Configuration > Firewall > Unified Communications > UC-IME Proxy The following wizard was added to ASDM, which allows you to configure the Unified Communication proxies (including the Cisco Intercompany Media Engine Proxy): Wizards > Unified Communications Wizard
21-38 Cisco ASA Series Firewall ASDM Configuration Guide Chapter 21 Configuring Cisco Intercompany Media Engine Proxy Feature History for Cisco Intercompany Media Engine Proxy
CH A P T E R 22-1 Cisco ASA Series Firewall ASDM Configuration Guide 22 Configuring Connection Settings This chapter describes how to configure connection settings for connections that go through the ASA, or for management connections, that go to the ASA. Connection settings include: Maximum connections (TCP and UDP connections, embryonic connections, per-client connections) Connection timeouts Dead connection detection TCP sequence randomization TCP normalization customization TCP state bypass Global timeouts This chapter includes the following sections: Information About Connection Settings, page 22-1 Licensing Requirements for Connection Settings, page 22-4 Guidelines and Limitations, page 22-5 Default Settings, page 22-5 Configuring Connection Settings, page 22-6 Feature History for Connection Settings, page 22-11 Information About Connection Settings This section describes why you might want to limit connections and includes the following topics: TCP Intercept and Limiting Embryonic Connections, page 22-2 Disabling TCP Intercept for Management Packets for Clientless SSL Compatibility, page 22-2 Dead Connection Detection (DCD), page 22-2 TCP Sequence Randomization, page 22-3 TCP Normalization, page 22-3 TCP State Bypass, page 22-3
22-2 Cisco ASA Series Firewall ASDM Configuration Guide Chapter 22 Configuring Connection Settings Information About Connection Settings TCP Intercept and Limiting Embryonic Connections Limiting the number of embryonic connections protects you from a DoS attack. The ASA uses the per-client limits and the embryonic connection limit to trigger TCP Intercept, which protects inside systems from a DoS attack perpetrated by flooding an interface with TCP SYN packets. An embryonic connection is a connection request that has not finished the necessary handshake between source and destination. TCP Intercept uses the SYN cookies algorithm to prevent TCP SYN-flooding attacks. A SYN-flooding attack consists of a series of SYN packets usually originating from spoofed IP addresses. The constant flood of SYN packets keeps the server SYN queue full, which prevents it from servicing connection requests. When the embryonic connection threshold of a connection is crossed, the ASA acts as a proxy for the server and generates a SYN-ACK response to the client SYN request. When the ASA receives an ACK back from the client, it can then authenticate the client and allow the connection to the server. NoteWhen you use TCP SYN cookie protection to protect servers from SYN attacks, you must set the embryonic connection limit lower than the TCP SYN backlog queue on the server that you want to protect. Otherwise, valid clients can nolonger access the server during a SYN attack. To view TCP Intercept statistics, including the top 10 servers under attack, see Chapter 27, “Configuring Threat Detection.” Disabling TCP Intercept for Management Packets for Clientless SSL Compatibility By default, TCP management connections have TCP Intercept always enabled. When TCP Intercept is enabled, it intercepts the 3-way TCP connection establishment handshake packets and thus deprives the ASA from processing the packets for clientless SSL. Clientless SSL requires the ability to process the 3-way handshake packets to provide selective ACK and other TCP options for clientless SSL connections. To disable TCP Intercept for management traffic, you can set the embryonic connection limit; only after the embryonic connection limit is reached is TCP Intercept enabled. Dead Connection Detection (DCD) DCD detects a dead connection and allows it to expire, without expiring connections that can still handle traffic. You configure DCD when you want idle, but valid connections to persist. When you enable DCD, idle timeout behavior changes. With idle timeout, DCD probes are sent to each of the two end-hosts to determine the validity of the connection. If an end-host fails to respond after probes are sent at the configured intervals, the connection is freed, and reset values, if configured, are sent to each of the end-hosts. If both end-hosts respond that the connection is valid, the activity timeout is updated to the current time and the idle timeout is rescheduled accordingly. Enabling DCD changes the behavior of idle-timeout handling in the TCP normalizer. DCD probing resets the idle timeout on the connections seen in the show conn command. To determine when a connection that has exceeded the configured timeout value in the timeout command but is kept alive due to DCD probing, the show service-policy command includes counters to show the amount of activity from DCD.