Sample Cisco Adaptive Security Appliance Configuration

Table Of Contents

Sample Cisco Adaptive Security Appliance Configuration

Sample PAT Commands and Access Lists

Sample Cisco Adaptive Security Appliance Configuration

---

January 26, 2009

•Sample PAT Commands and Access Lists

Sample PAT Commands and Access Lists

This section provides a sample configuration for a Cisco Unified Presence server that is federating with a foreign OCS enterprise deployment. There are two additional intercluster Cisco Unified Presence servers in the local enterprise deployment.

The following values are used in this sample configuration:

•Public Cisco Unified Presence IP Address = 10.10.10.10

•Private Routing Cisco Unified Presence IP Address = 1.1.1.1

•Private Second Cisco Unified Presence IP Address = 2.2.2.2

•Private Third Cisco Unified Presence IP Address = 3.3.3.3

•Peer Auth Listener Port on Cisco Unified Presence = 5062

•Netmask = 255.255.255.255

•Foreign Domain = abc.com

•Microsoft OCS External Interface = 20.20.20.20

These PAT commands are defined for the (routing) Cisco Unified Presence server:

static (inside,outside) tcp 10.10.10.10 5061 1.1.1.1 5062 netmask 255.255.255.255 

static (inside,outside) udp 10.10.10.10  5070 1.1.1.1 5070 netmask 255.255.255.255 

static (inside,outside) tcp 10.10.10.10  5070 1.1.1.1 5070 netmask 255.255.255.255 

static (inside,outside) tcp 10.10.10.10  5060 1.1.1.1 5060 netmask 255.255.255.255

static (inside,outside) tcp 10.10.10.10 5062 1.1.1.1 5061 netmask 255.255.255.255 

These PAT commands are defined for the two additional intercluster Cisco Unified Presence servers in the enterprise deployment:

static (inside,outside) udp 10.10.10.10 45070 2.2.2.2 5070 netmask 255.255.255.255 

static (inside,outside) tcp 10.10.10.10 45070 2.2.2.2 5070 netmask 255.255.255.255 

static (inside,outside) udp 10.10.10.10 55070 3.3.3.3 5070 netmask 255.255.255.255 

static (inside,outside) tcp 10.10.10.10 55070 3.3.3.3 5070 netmask 255.255.255.255 

static (inside,outside) udp 10.10.10.10 40000 2.2.2.2 5062 netmask 255.255.255.255 

static (inside,outside) tcp 10.10.10.10 50000 3.3.3.3 5062 netmask 255.255.255.255 

The corresponding access lists for this configuration are provided below. Note that for each foreign domain that you federate with, you must add access lists similar to these access lists for the domain abc.com.

access-list ent_cup_to_abc extended permit tcp host 1.1.1.1 host 20.20.20.20 eq 5061 

access-list ent_abc_to_cup extended permit tcp host 20.20.20.20 host 10.10.10.10 eq 5061

access-list ent_secondcup_to_abc extended permit tcp host 2.2.2.2 host 20.20.20.20 eq 5061

access-list ent_thirdcup_to_abc extended permit tcp host 3.3.3.3 host 20.20.20.20 eq 5061

access-list ent_abc_to_secondcup extended permit tcp host 20.20.20.20 host 10.10.10.10 
access-list ent_abc_to_thirdcup extended permit tcp host 20.20.20.20 host 10.10.10.10 

Associate each of your access lists with the a class map:

class-map ent_cup_to_abc

match access-list ent_cup_to_abc

class-map ent_abc_to_cup

match access-list ent_abc_to_cup

class-map ent_secondcup_to_abc

match access-list ent_secondcup_to_abc

class-map ent_thirdcup_to_abc

match access-list ent_thirdcup_to_abc

class-map ent_abc_to_secondcup

match access-list ent_abc_to_secondcup

class-map ent_abc_to_thirdcup

match access-list ent_abc_to_thirdcup

Update the global policy map for each class map you created. In this example, the TLS proxy instance 
for TLS connections initiated by Cisco Unified Presence is called "cup_to_foreign", and the TLS 
proxy instance for TLS connections initiated by a foreign domain is called "foreign_to_cup".

policy-map global_policy

class ent_cup_to_abc

inspect sip sip_inspect tls-proxy ent_cup_to_foreign

policy-map global_policy

class ent_abc_to_cup

inspect sip sip_inspect tls-proxy ent_foreign_to_cup

policy-map global_policy

class ent_secondcup_to_abc

inspect sip sip_inspect tls-proxy ent_cup_to_foreign

policy-map global_policy

class ent_thirdcup_to_abc

inspect sip sip_inspect tls-proxy ent_cup_to_foreign

policy-map global_policy

class ent_abc_to_secondcup

inspect sip sip_inspect tls-proxy ent_foreign_to_cup

policy-map global_policy

class ent_abc_to_thirdcup

inspect sip sip_inspect tls-proxy ent_foreign_to_cup