Interdomain Federation for IM and Presence Service on Cisco Unified Communications Manager, Release 9.0(1)
Cisco Adaptive Security Appliance configuration for SIP federation
Download this chapter
Cisco Adaptive Security Appliance configuration for SIP federationCisco Adaptive Security Appliance configuration for SIP federation
Download the complete book
Interdomain Federation for IM and Presence Service on Cisco Unified Communications Manager, Release 9.0(1)Interdomain Federation for IM and Presence Service on Cisco Unified Communications Manager, Release 9.0(1) (PDF - 3 MB)
 Feedback

Cisco Adaptive Security Appliance configuration for SIP federation


Note

IM and Presence Release 9.0 or later supports interdomain federation with Microsoft Lync. For IM and Presence Release 9.0 or later, any reference to interdomain federation with OCS also includes Microsoft Lync, unless explicitly stated otherwise.

Cisco Adaptive Security Appliance Unified Communication wizard

If you deploy a single IM and Presence server in your interdomain federation deployment, you can use the Unified Communication wizard on Cisco Adaptive Security Appliance to configure the presence federation proxy between Cisco Adaptive Security Appliance and IM and Presence.

A configuration example showing the Unified Communication wizard is provided on the IM and Presence documentation wiki, see the URL below.

Related Information

External and internal interface configuration

On the Cisco Adaptive Security Appliance you must configure two interfaces as follows:

  • Use one interface as the outside or external interface. This is the interface to the internet and to the foreign domain servers (for example, Microsoft Access Edge/Access Proxy).
  • Use the second interface as the inside or internal interface. This is the interface to IM and Presence or to the Load Balancer, depending on your deployment.
  • When configuring an interface, you need to refer it with an interface type, for example Ethernet or Gigabit Ethernet, and an interface slot. The Cisco Adaptive Security Appliance has four embedded Ethernet or Gigabit Ethernet ports on slot 0. You may optionally add an SSM-4GE module in slot 1 to obtain an additional four Gigabit Ethernet ports on slot 1.
  • For each interface to route traffic, you need to configure an interface name and an IP address. The internal and external interface IP addresses must be in different subnets, which means they must have different submasks.
  • Each interface must have a security level ranging from zero to 100 (from lowest to highest). A security level value of 100 is the most secure interface (inside interface). A security level value of zero is the least secure interface. If you do not explicitly set the security level for the inside or outside interface, then Cisco Adaptive Security Appliance sets the security level to 100 by default.
  • Please refer to the Cisco Security Appliance Command Line Configuration Guide for details on configuring the external and internal interfaces via the CLI.

Note

You can configure the internal and external interfaces using the ASDM startup wizard. You can also view or edit an interface in ASDM by selecting Configuration > Device Setup > Interfaces.

Configure static IP routes

Cisco Adaptive Security Appliance supports both static routes and dynamic routing protocols such as OSPF, RIP and EIGRP. For this integration you need to configure static routes that define the next hop address for IP traffic routed to the inside interface and for traffic routed to the outside interface of Cisco Adaptive Security Appliance. In the procedure below, the dest_ip mask is the IP address for the destination network and the gateway_ip value is the address of the next-hop router or gateway.

For a detailed description on setting up default and static routes on Cisco Adaptive Security Appliance, refer to the Cisco Security Appliance Command Line Configuration Guide.

Before You Begin

Complete the steps in External and internal interface configuration

Procedure
    Step 1   Enter config mode: 
    >Enable >password
>config t
    Step 2   Enter this command to add a static route for the inside interface: 
    hostname(config)# route inside dest_ip mask gateway_ip
    Step 3   Enter this command to add a static route for the outside interface: 
    hostname(config)# route outside dest_ip mask gateway_ip
    Note   

    You can also view and configure the static routes from ASDM by selecting Configuration > Device Setup > Routing > Static routes.

    Figure 1. Viewing static routes via ASDM



    What to Do Next

    Port Address Translation (PAT)

    Port Address Translation (PAT)

    Port Address Translation for this integration


    Note

    You also use Port Address Translation if you federate with another IM and Presence enterprise deployment in a foreign domain.

    For this integration, Cisco Adaptive Security Appliance uses Port Address Translation (PAT) and static PAT for message address translation. Cisco Adaptive Security Appliance does not use Network Address Translation (NAT) for this integration.

    This integration uses PAT to translate messages sent from IM and Presence to a foreign domain (private to public messages). Port Address Translation (PAT) means the real address and source port in a packet is substituted with a mapped address and unique port that is routable on the destination network. This translation method uses a two step process that translates the real IP address and port to a mapped IP address and port, and then the translation is "undone" for returning traffic.

    Cisco Adaptive Security Appliance translates messages sent from IM and Presence to a foreign domain (private to public messages) by changing the private IP address and port on IM and Presence to a public IP address and one or more public port(s). Therefore, a local IM and Presence domain only uses one public IP address. Cisco Adaptive Security Appliance assigns a NAT command to the outside interface and translates the IP address and port of any message received on that interface as illustrated in the following figure.

    Figure 2. Example PAT for Messages Originating from IM and Presence to a Foreign Domain



    For new messages sent from a foreign domain to IM and Presence, Cisco Adaptive Security Appliance uses static PAT to map any message sent to the public IP address and port for IM and Presence to a designated IM and Presence server. Using static PAT allows you to translate the real IP address to a mapped IP address, and the real port number to a mapped port number. You can translate the real port number to the same port number or to a different port number. In this case, the port number identifies the correct IM and Presence server to handle the message request, as shown in the following figure.


    Note

    If a user does not exist on the IM and Presence server, the IM and Presence routing server uses intercluster routing to redirect the message. All responses are sent to Cisco Adaptive Security Appliance from the IM and Presence routing server.

    Figure 3. Static PAT for Messages Originating from a Foreign Domain



    PAT for private to public requests

    For this integration, the address translation for private to public messages involves the following configuration:

    • Define a NAT rule to identify the real IP address and port number that you wish to translate. In this case, configure a NAT rule that states that Cisco Adaptive Security Appliance must apply a NAT action to any message received on the internal interface.
    • Configure a global NAT action to specify the mapped addresses to use for messages exiting via the external (outside) interface. For this integration, specify only one address (because it uses PAT). The NAT action maps the IP address (of messages received on the internal interface) to the IM and Presence public address.

    PAT for private to public requests provides sample global address translation commands for Cisco Adaptive Security Appliance Releases 8.2 and 8.3. The first row is mandatory for both a single IM and Presence deployment, and a multiple IM and Presence deployment. The second row is for single IM and Presence deployment only. The third row is for a multiple IM and Presence deployment.

    Table 1 Sample global address translation commands

    Sample Configuration

    Cisco Adaptive Security Appliance Release 8.2 Global Command

    Cisco Adaptive Security Appliance Release 8.3 Global Command

    You can use this sample NAT configuration in a deployment where there are one or more IM and Presence servers on the inside interface, with no other firewall traffic. 

    global (outside) 1 <public_cup_address>nat (inside) 1 0 0

    		 
    object network obj_any    host 0.0.0.0
    nat (inside,outside) dynamic <public cup address>

    You can use this sample NAT configuration in a deployment where there is one IM and Presence server on the inside interface, with other firewall traffic. 

    global (outside) 1 <public_cup_address>nat (inside) 1 <private_cup_address> 255.255.255.255

global (outside) 2 interface
nat (inside) 2 0 0
    		 
     host <private cup address>    nat (inside,outside) dynamic <public cup address>

object network my_inside
    subnet 0.0.0.0 0.0.0.0
    nat (inside,outside) dynamic interface

    You can use this sample NAT configuration in a deployment where there are multiple IM and Presence servers on the inside interface, with other firewall traffic. 

    global (outside) 1 <public cup ip>nat (inside) 1 <private_cup_net> <private_cup_netmask>

global (outside) 2 interface
nat (inside) 2 0 0

    object network obj_<private subnet>.0_255.255.255.0    subnet <private subnet> 255.255.255.0
    nat (inside,outside) dynamic <public cup address>

object network my_inside
    subnet 0.0.0.0 0.0.0.0
    nat (inside,outside) dynamic interface

    Note

    The sample configuration shown in the last row in PAT for private to public requests assumes that when there are multiple IM and Presence servers located behind Cisco Adaptive Security Appliance, and these IM and Presence servers are all on the same subnet. Specifically, if all the inside IM and Presence servers are on the 2.2.2.x/24 network, the NAT command is: nat (inside) 1 2.2.2.0 255.255.255.0

    Related References

    Static PAT for new requests

    For this integration the address translation for private to public messages involves the following configuration:

    • Configure a static PAT command on TCP for the following ports: 5060, 5061, 5062 and 5080.
    • Configure a separate static PAT command on UDP for port 5080.

    This integration uses the following ports:

    • 5060 - Cisco Adaptive Security Appliance uses this port for generic SIP inspection.
    • 5061 - The SIP requests are sent to this port and this triggers the TLS handshake.
    • 5062, 5080 - IM and Presence uses these ports in the SIP VIA/CONTACT headers.

    Note

    You can check the peer auth listener port on IM and Presence by selecting Cisco Unified CM IM and Presence Administration > System > Application Listeners.

    Related References
    Related Information

    NAT rules in ASDM

    
 
		
    You can view the NAT rules in ASDM by selecting 
		  Configuration > Firewall > NAT
				Rules. The first five NAT rules shown in the
		  following figure are the static PAT entries, and the final dynamic entry is the
		  outgoing PAT configuration that maps any outgoing traffic to the public 
		  IM and Presence IP address and port. 
		
    
 
		
    Figure 4. Viewing PAT rules via ASDM

    
 
	 
    

    

    Related References
    


    

    Related Information
    


    

    

    

    Sample static PAT commands
    


    Note
    This section shows sample commands for Cisco Adaptive Security Appliance Release 8.3 and Release 8.2. You need to execute these commands when you configure a fresh configuration of Cisco Adaptive Security Appliance for federation. 
    

    

    

    

    PAT configuration for routing IM and Presence node
    

     
		
    The following table shows the PAT commands for the routing 
		  IM and Presence node, where the peer auth listener port is 5062.
		  
		
    
 
		

    Note
     
		  
    For 
			 Cisco Adaptive Security
				Appliance 8.3 configuration, you only need to define an object once
			 and you can reference that object in multiple commands; you do not need to
			 repeatedly define the same object. 
		  
    
 
		
    
 
		

    Table 2 PAT commands for routing 
		  IM and Presence node
     
				  
    Cisco Adaptive Security Appliance Release 8.2 Static
					 Command 
				  
    
 
				    		
 
				  
    Cisco Adaptive Security Appliance Release 8.3 NAT
					 Command 
				  
    
 
				    		

    
    

     
				  
    static (inside,outside) tcp <public cup ipaddress> 5061 <routing cup private address>
5062 netmask 255.255.255.255
    
 
				  
    
 
				  
    If the routing IM and Presence peer auth listening port is 5061,
					 use the command: 
				  
    
 
				  
    static (inside,outside) tcp <public cup ipaddress> 5061 <routing cup private address>
5061 netmask 255.255.255.255
    
 
				    		
 
				  
    Object network obj_host_<public cup ip address>(e.g. object network obj_host_10.10.10.10)
#host <public cup ip address>

object network obj_host_<routing cup private address>
host <routing cup private address>

object service obj_tcp_source_eq_5061
service tcp source eq 5061

object service obj_tcp_source_eq_5062
service tcp source eq 5062

nat (inside,outside) source static obj_host_<routing cup private address> obj_host_<public cup ip address> service obj_tcp_source_eq_5062 obj_tcp_source_eq_5061

    
 
				  
    If the routing IM and Presence peer auth listening port is 5061,
					 use the command: 
				  
    
 
				  
    nat (inside,outside) source static obj_host_<routing cup private address> obj_host_<public cup ip address> service obj_tcp_source_eq_5061 obj_tcp_source_eq_5061
    
 
				    		

    

     
				  
    static (inside,outside) tcp <public cup ip address> 5080 <routing cup private address> 5080 netmask 255.255.255.255
    
 
				    		
 
				  
    object service obj_tcp_source_eq_5080 service tcp source eq 5080

nat (inside,outside) source static obj_host_<routing cup private address> obj_host_<public cup ip address> service obj_tcp_source_eq_5080 obj_tcp_source_eq_5080
    
 
				    		

    

     
				  
    static (inside,outside) tcp <public cup ipaddress> 5060 <routing cup private address>
5060 netmask 255.255.255.255
    
 
				    		
 
				  
    object service obj_tcp_source_eq_5060service tcp source eq 5060
    
 
				  
    Note   
                
               
					 
    5060 displays as "sip" in the service object. 
					 
    
 
					 
    nat (inside,outside) source static obj_host_<routing cup private address> obj_host_<public cup ip address> service obj_tcp_source_eq_5060 obj_tcp_source_eq_5060
    
 
				  
    
 
				    		

    

     
				  
    static (inside,outside) tcp <public cup ipaddress> 5062 <routing cup private address>
5062 netmask 255.255.255.255
    
 
				    		
 
				  
    nat (inside,outside) source static obj_host_<routing cup private address> obj_host_<public cup ip address> service obj_tcp_source_eq_5062 obj_tcp_source_eq_5062
    
 
				    		

    
    

    

    
 
	 
    

    

    Related References
    



    

    

    PAT configuration for intercluster or intracluster IM and Presence nodes
    

    
		
    In a multi-node or an intercluster 
		  IM and Presence deployment, if the non-routing nodes in your 
		  IM and Presence clusters communicate directly with 
		  Cisco Adaptive Security Appliance, you must configure a set of static PAT commands for each
		  of these nodes. The commands listed below are an example of a set of the static
		  PAT commands you must configure for a single node. 
		
    

		
    You must use an unused arbitrary port. We recommend that you
		  select a corresponding number, for example, 5080 uses the unused arbitrary port
		  X5080 where X corresponds to a number that uniquely maps to an 
		  IM and Presence intercluster or intracluster server. For example 45080
		  uniquely maps to one node and 55080 uniquely maps to another node.
		
    

		
    The following table shows the NAT commands for the
		  non-routing 
		  IM and Presence nodes. Repeat the commands for each non-routing 
		  IM and Presence node.
		
    

		

    Note
    
		  
    For 
			 Cisco Adaptive Security Appliance 8.3 configuration, you only need to define an object once
			 and you can reference that object in multiple commands; you do not need to
			 repeatedly define the same object. 
		  
    

		
    

		

    Table 3 NAT commands for non-routing 
		  IM and Presence nodes
    
				  
    Cisco Adaptive Security Appliance Release 8.2 Static
					 Command
				  
    

				    		

				  
    Cisco Adaptive Security Appliance Release 8.3 NAT
					 Command
				  
    

				    		

    
    

    
				  
    static (inside,outside) tcp <public CUPaddress> 45062 <intercluster cup8 private
address> 5062 netmask 255.255.255.255

    

				  
    If the intercluster 
					 IM and Presence peer auth listening port is 5061, use the command:
				  
    

				  
    static (inside,outside) tcp <public CUP
address> 45061 <intercluster cup8 private
address> 5061 netmask 255.255.255.255
    

				    		

				  
    object network obj_host_<intercluster cup8 privateaddress>
host <intercluster cup8 private address>

object service obj_tcp_source_eq_45062
service tcp source eq 45062

nat (inside,outside) source static obj_host_<intercluster cup8 private address> obj_host_<public cup ip address> service obj_tcp_source_eq_5062 obj_tcp_source_eq_45062

    

				  
    If the intercluster 
					 IM and Presence peer auth listening port is 5061, use the command:
				  
    

				  
    object service obj_tcp_source_eq_45061 service tcp source eq 45061

nat (inside,outside) source static obj_host_<intercluster cup8 private address> obj_host_<public cup ip address> service obj_tcp_source_eq_5061 obj_tcp_source_eq_45061
    

				    		

    

    
				  
    static (inside,outside) tcp <public cup ipaddress> 45080 <intercluster cup8 private
address> 5080 netmask 255.255.255.255
    

				    		

				  
    object service obj_tcp_source_eq_45080service tcp source eq 45080

nat (inside,outside) source static obj_host_<intercluster cup8 private address> obj_host_<public cup ip address> service obj_tcp_source_eq_5080 obj_tcp_source_eq_45080
    

				    		

    

    
				  
    static (inside,outside) tcp <public cup ipaddress> 45060 <intercluster cup8 private address> 5060 netmask 255.255.255.255
    

				    		

				  
    object service obj_tcp_source_eq_45060service tcp source eq 45060

nat (inside,outside) source static obj_host_<intercluster cup8 private address> obj_host_<public cup ip address> service obj_tcp_source_eq_5060 obj_tcp_source_eq_45060
    

				    		

    
    

    

    

	 
    

    

    Related References
    



    

    

    

    Cisco Adaptive Security Appliance upgrade options for existing deployments
    

    If you upgrade from Cisco Adaptive Security Appliance Release 8.2 to Release 8.3, Cisco Adaptive Security Appliance migrates the existing commands seamlessly during the upgrade.
    


    Note
    Once you upgrade to IM and Presence Release 9.0, you must open port 5080 on Cisco Adaptive Security Appliance for each IM and Presence 9.0 node located behind Cisco Adaptive Security Appliance. This is independent of whether you have upgraded Cisco Adaptive Security Appliance also.
    

    

    Use one of the following upgrade procedures when you upgrade both IM and Presence and Cisco Adaptive Security Appliance in your existing federation deployment:
    

     

    Upgrade Procedure Option 1:
    

    1. Upgrade IM and Presence to Release 9.0.
    

    2. Configure NAT rules for port 5080 on Cisco Adaptive Security Appliance.
    

    3. Confirm that federation is working in your deployment after the IM and Presence upgrade.
    

    4. Upgrade Cisco Adaptive Security Appliance to Release 8.3.
    

    5. Confirm that federation is working in your deployment after the Cisco Adaptive Security Appliance upgrade.
    

    
    		

    

     

    Upgrade Procedure Option 2:
    

    1. Upgrade both IM and Presence nodes to Release 9.0 and Cisco Adaptive Security Appliance to Release 8.3.
    

    2. After both upgrades, configure NAT rules for port 5080 on Cisco Adaptive Security Appliance.
    

    3. Confirm that federation is working in your deployment.
    
    		

    

    

    These are the commands you require to open port 5080 for each IM and Presence Release 9.0 node that sits behind Cisco Adaptive Security Appliance:
    


    Cisco Adaptive Security Appliance Release 8.2 Static Command
    
    		

    Cisco Adaptive Security Appliance Release 8.3 NAT Command
    
    		

    
    

    static (inside,outside) tcp <public cup ip
address> 5080 <routing cup private address>
5080 netmask 255.255.255.255

static (inside,outside) tcp <public cup ip
address> 45080 <intercluster cup8 private
address> 5080 netmask 255.255.255.255

    

    Note   
                
              
    Configure these commands for each intercluster IM and Presence 9.0 server, and use a different arbitrary port for each.
    

    
    		

    object service obj_tcp_source_eq_5080
# service tcp source eq 5080

nat (inside,outside) source static obj_host_<routing 
cupprivate address> obj_host_<public cup ip address> 
serviceobj_tcp_source_eq_5080 obj_tcp_source_eq_5080

object service obj_tcp_source_eq_45080
# service tcp source eq 45080

nat (inside,outside) source static 
obj_host_<intercluster cup8 private address> 
obj_host_<public cup ip address>service 
obj_tcp_source_eq_5080 obj_tcp_source_eq_45080

    

    Note   
                
              
    Configure these commands for each intercluster IM and Presence 9.0 server, and use a different arbitrary port for each.