[cisco-voip] ACLs for voice

[Wes Sisk]

Lelio,

It seems the document authors may not be attuned to details of SIP/TCP 
behavior.

Regards,
Wes

On 8/3/2011 9:39 AM, Lelio Fulgenzi wrote:
> Hi Wes,
>
> Just looking over your note and the document I was referring to:
>
> http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/port/7_1_2/CCM_7.1.2PortList.pdf
>
> The document has no mention of the behaviour you point out.
>
> The document seems recent and there are also documents for 8.0 and 
> 8.5, so it seems like it's being maintained.
>
> Any idea why the discrepancy?
>
> ---
> Lelio Fulgenzi, B.A.
> Senior Analyst (CCS) * University of Guelph * Guelph, Ontario N1G 2W1
> (519) 824-4120 x56354 (519) 767-1060 FAX (JNHN)
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> Cooking with unix is easy. You just sed it and forget it.
>                               - LFJ (with apologies to Mr. Popeil)
>
>
> ------------------------------------------------------------------------
> *From: *"Wes Sisk" <wsisk at cisco.com>
> *To: *"Lelio Fulgenzi" <lelio at uoguelph.ca>
> *Cc: *"cisco-voip (cisco-voip at puck.nether.net)" 
> <cisco-voip at puck.nether.net>
> *Sent: *Tuesday, August 2, 2011 4:37:11 PM
> *Subject: *Re: [cisco-voip] ACLs for voice
>
> Most documents are superseded by the port numbers built into the 
> platform now. Under platform web pages show->ip preferences.
>
> This lists each service, port numbers, and peer device.
>
> For SIP trunks the port usage is somewhat configurable. For SIP line 
> side it is:
>
> Phone initiates TCP session from TCP port 49499 to CUCM port 5060.
> Phone sends register and proceeds as expected.
> Another endpoint initiates a call to CUCM that is routed to this 
> phone.  CUCM attempts to initiate a TCP session from a CUCM ephemeral 
> port to this phone on port 49499.
>
> You're not going to be able to do an ACL for SIP traffic other than 
> permit all for sessions initiated from CUCM ephemeral port range 
> toward the end points.
>
> Regards,
> Wes
>
> On 8/2/2011 4:04 PM, Lelio Fulgenzi wrote:
>
>     As mentioned in a previous thread, I'm updating our voice VLAN
>     ACLs. I'm using 'established' entries to help out, but I'm going
>     to assume many of the protocols are two way, so I'd like to
>     include those where possible.
>
>     In reading the documentation, some of the requirements show what
>     I'm pretty sure is a one way connection, i.e. Phone -> Unified CM
>     = 2000/TCP. I take this to mean the phone picks a random TCP port
>     and communicates to the Unified CM on port 2000 from this random port.
>
>     Others show Phone -> Unified CM = 5060/TCP,UDP and the opposite,
>     Unified CM -> Phone = 5060/TCP,UDP.
>
>     Does this mean that the phone talks to Unified CM using port 5060
>     to port 5060, -or- does it mean that the phone picks a random port
>     to talk to the Unified CM port 5060 and sometimes the Unified CM
>     picks a random port to talk to the Phone's 5060 port?
>
>     There two different things in my opinion.
>
>     Thoughts?
>
>     Lelio
>
>
>     ---
>     Lelio Fulgenzi, B.A.
>     Senior Analyst (CCS) * University of Guelph * Guelph, Ontario N1G 2W1
>     (519) 824-4120 x56354 (519) 767-1060 FAX (JNHN)
>     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>     Cooking with unix is easy. You just sed it and forget it.
>                                   - LFJ (with apologies to Mr. Popeil)
>
>
>
>     _______________________________________________
>     cisco-voip mailing list
>     cisco-voip at puck.nether.net
>     https://puck.nether.net/mailman/listinfo/cisco-voip
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://puck.nether.net/pipermail/cisco-voip/attachments/20110803/fcc96022/attachment.html>