Unified Videoconferencing（CUVC）IVR を使用した Unified Border Element（CUBE）の設定例

!
version 12.4
service timestamps debug datetime localtime
service timestamps log datetime msec
service password-encryption
service sequence-numbers
!
hostname cube1
!
boot-start-marker
boot system flash:c2800nm-adventerprisek9_ivs-mz.124-22.YB.bin
boot-end-marker
!
ip source-route
!
!
multilink bundle-name authenticated
!
!
!
voice service voip
  allow-connections h323 to h323
  h323
  emptycapability
  null-called-number override 1234567890
  h225 start-h245 on-connect
  call start slow 
  h245 passthru all
!
!
!
voice class h323 10
!
!
voice-card 0
!
!
!
!
interface GigabitEthernet0/0
 ip address 172.16.1.100 255.255.255.0
 ip route-cache same-interface
 duplex auto
 speed auto
 h323-gateway voip interface
 h323-gateway voip id vgk1 ipaddr 172.16.1.100 1719 priority 1 

!--- vgk1 defines zone the cube to register with the local Gatekeeper service
 
 h323-gateway voip h323-id cube1

!--- Defines the ID of CUBE
 
 h323-gateway voip tech-prefix 1#
 h323-gateway voip bind srcaddr 172.16.1.100
!
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 172.16.1.1
ip http server
no ip http secure-server
!
!
!
!
dial-peer voice 1 voip
destination-pattern .T

!--- To match outbound call leg to send to GK process

session target ras
incoming called-number .

!--- For inbound call leg

codec transparent



!
!
gateway
timer receive-rtp 1200
!
!
!
gatekeeper
zone local vgk1 cisco.com 
zone remote CUVCM cisco.com 10.1.1.26 invia vgk1 outvia vgk1
enable-intrazone
zone prefix CUVCM 1234567890
gw-type-prefix 1#* default-technology
no use-proxy GK1 default inbound-to terminal
no use-proxy GK1 default outbound-from terminal
bandwidth interzone default 1000000
no shutdown
!

end

ASA Version 8.2(1)
! 

!--- This is only a portion of the ASA config. !--- In a typical production scenario, these commands would !--- be in addition to the current security policies configured.

!
interface Ethernet0/0
 no nameif
 no security-level
 no ip address
!
interface Ethernet0/0.2
 vlan 2
 nameif inside
 security-level 100
 ip address 10.1.1.1 255.255.255.0 
!
interface Ethernet0/0.12
 vlan 12
 nameif dmz
 security-level 50
 ip address 172.16.1.1 255.255.255.0 
!
interface Ethernet0/0.500
 vlan 500
 nameif outside
 security-level 0
 ip address 192.168.1.2 255.255.255.0 
!
boot system disk0:/asa821-k8.bin
ftp mode passive
clock timezone CDT -6
access-list dmz-in extended permit icmp any any 
access-list dmz-in extended permit udp host 172.16.1.100any eq 1719 
access-list dmz-in extended permit tcp host 172.16.1.100any eq h323

!--- The access list allows CUBE address lookups and call !--- signaling respectively to get to the interior of the network.

!
access-list outside_access_in extended permit icmp any any 
access-list outside_access_in extended permit tcp any host 192.168.1.2 eq h323 
access-list outside_access_in extended permit udp any host 192.168.1.2 eq 1719

!--- The access list allows exterior call setups and address !--- look ups respectively to get to the CUBE.

!  
! 
access-list inside-to-DMZ-exemption extended permit ip 10.0.0.0 255.0.0.0 10.150
.150.0 255.255.255.0

!--- This access list prevents the global NAT translation intended !--- for the outside interface from being used on the conversations !--- between internal endpoints and CUBE.

!
mtu inside 1500
mtu dmz 1500
mtu outside 1500
nat-control
global (outside) 1 192.168.1.5-192.168.1.100 netmask 255.255.255.0

!--- Note that the general NAT pool should not overlap the !--- ASA interface nor the static NAT used for CUBE.

!
nat (inside) 0 access-list inside-to-DMZ-exemption
nat (inside) 1 0.0.0.0 0.0.0.0
nat (dmz) 1 172.168.1.0 255.255.255.0
static (dmz,outside) 192.168.1.2 172.16.1.100 netmask 255.255.255.255

!--- The previous statement is what establishes the publicly !--- routed address for CUBE on the outside interface.

! 
access-group dmz-in in interface dmz
access-group outside_access_in in interface outside
route inside 10.0.0.0 255.255.255.0 10.1.1.2 1
route outside 0.0.0.0 0.0.0.0 192.168.1.254 1

!--- These two static route statements assume the existence of !--- a next hop router on both inside and outside interfaces.

!
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:10:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:10:00 h225 1:00:00 mgcp 0:10:00 mgcp-pat 0:10:00

!--- Note: It is a good idea to increase the H.225 timeout. Not all endpoints !--- send enough traffic on this connection to keep it alive. The H.225 command !--- includes the H.245 attributes.

!
policy-map global_policy
 class inspection_default
  inspect h323 h225 
  inspect h323 ras