Cisco TelePresence MCU 4200 Series

Sample Cisco PIX firewall configurations for use with H.323 video endpoints to work with Cisco acquired Codian units

Hierarchical Navigation

Can you supply some sample Cisco PIX firewall configurations for use with H.323 video endpoints for working with Cisco acquired Codian units?

Note: The sample PIX configurations provided below are for information only and must be used in conjunction with a level of professional expertise appropriate for your application. Cisco cannot be held responsible for any loss of connectivity or downtime arising from the use of the sample configurations in this article.

As far as the PIX firewall is concerned, calls made to and from Cisco acquired Codian products are no different to those made to and from any other H.323 endpoint. For a successful deployment of a PIX firewall in an H.323 network, all that is required is for the PIX to be correctly configured for your network and for H.323 application inspection. Below are some sample configurations taken from PIX firewalls in our test lab, along with descriptions of the scenarios in which they are deployed.

Note: All configurations are complete but public IP addresses and encrypted passwords have been obscured.

Example 1 : H.323 endpoints on a LAN are to dial out to a Cisco TelePresence MCU on the public Internet.

pixfirewall# sh run
: Saved
PIX Version 7.2(2)
hostname pixfirewall
enable password 8RXU2Ry2YjIyt7R4 encrypted
interface Ethernet0
 nameif outside
 security-level 0
 ip address aaa.bbb.ccc.76
interface Ethernet1
 nameif inside
 security-level 100
 ip address
passwd sHoqvvW9J7rJnxYE encrypted
ftp mode passive
pager lines 24
mtu outside 1500
mtu inside 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (outside) 1 aaa.bbb.ccc.79
nat (inside) 1
route outside aaa.bbb.ccc.65 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 2:00:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet inside
telnet timeout 5
ssh timeout 5
console timeout 0
class-map inspection_default
 match default-inspection-traffic
policy-map type inspect dns preset_dns_map
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
service-policy global_policy global
prompt hostname context
: end        

Note: Apart from the obvious network and route configuration, the 'nat' and 'global' lines, highlighted in red above, are all that need to be added to the PIX 7.2(2) factory config in order to achieve this configuration.

Example 2 : H.323 endpoints on the public Internet are to dial into a Cisco acquired Codian product which is located on your LAN and has IP address, behind a PIX firewall.

pixfirewall# sh run
: Saved
PIX Version 6.2(4)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password vW9J7rJnsHoqvxYE encrypted
passwd vWoqvxY9J7rJnsHE encrypted
hostname pixfirewall
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
fixup protocol sip udp 5060
access-list PERMIT_IN permit ip any host aaa.bbb.ccc.108
pager lines 24
interface ethernet0 10baset
interface ethernet1 10full
mtu outside 1500
mtu inside 1500
ip address outside aaa.bbb.ccc.108
ip address inside
ip audit info action alarm
ip audit attack action alarm
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0 0
static (inside,outside) aaa.bbb.ccc.109 netmask 0 0
access-group PERMIT_IN in interface outside
route outside aaa.bbb.ccc.65 1
route inside 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 2:00:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
no sysopt route dnat
telnet inside
telnet timeout 5
ssh timeout 5
dhcpd ping_timeout 750
username admin password XsXnztRvTmrj54T6 encrypted privilege 15
terminal width 80
: end

Note: The 'static' command is very important - this maps the external IP address of your choice (which need not be the external address of the PIX, but must be on the same subnet as it) to the LAN IP address of your Cisco acquired Codian product. Other relevant parts are the nat/global commands and the access list / access group commands.

This article applies to the following products:

  • Cisco TelePresence IP GW 3500 / MSE IPGW blade
  • Cisco TelePresence IP VCR 2200 / MSE VCR blade
  • Cisco TelePresence MCU 4200 / MSE 8420
  • Cisco TelePresence MCU 4500
  • Cisco TelePresence MSE 8510 blade

April 30th, 2011 TAA_KB_105