Cisco IOS Firewall Support for TRP

The Cisco IOS Firewall extends the concept of static access control lists (ACLs) by introducing dynamic ACL entries that open on the basis of the necessary application ports on a specific application and close these ports at the end of the application session. The Cisco IOS Firewall achieves this functionality by inspecting the application data, checking for conformance of the application protocol, extracting the relevant port information to create the dynamic ACL entries, and closing these ports at the end of the session. The Cisco IOS Firewall is designed to easily allow a new application inspection whenever support is needed.

The following information describes the deployment scenarios supported by the Cisco IOS Firewall with TRP present in a voice network:

• For the Cisco IOS Firewall that is running on a Cisco router without TRP, STUN packets are processed as regular passthrough packets. To open a pinhole for secondary channels, the firewall must be able to recognize the STUN packets.
• For the Cisco IOS Firewall that is running on a Cisco router with TRP (Branch Office A in the figure below), the firewall will intercept and act on the STUN packets that are sent from the TRP on its WAN side. Cisco IOS firewall validates the Cisco Proprietary Cisco Flow-Data information on the STUN packet and opens the data-channel pinholes for voice traffic. The Cisco Flow-Data has information to authenticate that the message is from a valid TRP device.
• The phones do not yet support STUN. If the firewall has to open pinholes between phones, TRP should send one-sided STUN messages addressed to each phone so the firewall can see the messages and open the pinholes. Without the support of STUN messages from TRP, the firewall would not be able to open the necessary pinholes for the phones to communicate.

Cisco IOS Firewall TRP support enables Cisco IOS Firewall to process UDP STUN messages that open pinholes for secondary channels, which are necessary for implementation of TRPs in voice networks.

Previous implementations of Cisco IOS Firewall, SIP clients could negotiate with the server to dynamically open control channels on a port, which could not be supported using the access-group class map. In addition, SIP traffic was sent through the firewall without any protocol conformance checks.

To overcome these issues, Cisco IOS Firewall supports partial SIP inspection. This allows the SIP Application-level Gateway (ALG) to parse the entire SIP message, including the Session Description Protocol (SDP) part to check for protocol conformance, but does not allows SIP ALG to open pinholes for media information found in the SDP message. The STUN ALG is allowed to open the pinholes in the firewall.

Because partial SIP inspection decouples the media channel from the SIP control channel, SIP ALG can no longer depend on media channel inactivity to timeout the control sessions. Therefore, the SIP ALG implementation in this environment depends on the UDP timeout configured on the router. Because the default setting is low (30 seconds), you must set the UDP timeout value to a value slightly longer than the SIP call duration, when configuring the system.

Note	In Cisco IOS Release 12.4(22)T, if you need to allow SIP control traffic, you must configure the match access-group filter. This filter allows SIP traffic to pass through the firewall without the protocol conformance check (Deep Packet Inspection).

TRP uses the following message types to control how the Cisco IOS Firewall manages sessions:

• Keep-Alive messages

To keep the Cisco IOS Firewall media sessions active the TRP generates authenticated keep-alive messages which must be validated to keep the session open. The keep-alive messages are valid only for a configured length of time, which is configured on the call-control entity (CCE). The Cisco IOS Firewall must receive a new message within the configured time, otherwise it closes the pinhole. The keep-alive message has the Cryptographic Authentication Token (CAT) obtained from the CCE which must be validated by the Cisco IOS Firewall before the keep-alive message is accepted.

• Periodic Open messages

The CAT (obtained from the CCE) is valid only for the CAT-life seconds setting configured on the CCE. After that time TRP gets a new CAT and sends a new message with the new CAT. This periodic open message specifies the keys that the Cisco IOS Firewall uses to authenticate the keep-alive messages until the next new CAT is obtained. Therefore, if the Cisco IOS Firewall does not receive a new CAT with the time specified by the CAT-life seconds, the media session closes as it cannot authenticate any keep-alive messages.

• Close pinhole message

If the Cisco IOS Firewall receives a STUN message from TRP that indicates that a session should be active for 0 seconds (Seconds-Active = 0), it first validates the packet, then generates a syslog message and then allows the message to pass through the Cisco IOS Firewall so that other firewalls on the path can also see the message and close their session, finally it closes the session.

• STUN messages from a remote party

When TRP is configured on both the caller and the called side, the Cisco IOS Firewall receives 2 STUN messages for the same session. The Cisco IOS Firewall does not validate STUN messages from the remote party, instead it drops the packets and generates a syslog message.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    class-map type inspect [match any| match all] class-map-name

4.    match protocol stun-ice stun-ice-parameter-map

5.    exit

6.    class-map type inspect [match any| match all] class-map-name

7.    match access-group {access-group | name access-group-name}

8.    match protocol stun-ice stun-ice-parameter-map

9.    exit

10.    policy-map type inspect policy-map-name

11.    class type inspect class-name

12.    inspect

13.    exit

14.    class type inspect class-name

15.    inspect

16.    exit

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	class-map type inspect [match any| match all] class-map-name Example: Router(config)# class-map type inspect stun-traffic	Creates an inspect type class map and enters class-map configuration mode.
Step 4	match protocol stun-ice stun-ice-parameter-map Example: Router(config-cmap)# match protocol stun-ice cfd1	Configures the match criteria for a class map on the basis of a specified protocol.
Step 5	exit Example: Router(config-cmap)# exit	Exits class-map configuration mode.
Step 6	class-map type inspect [match any| match all] class-map-name Example: Router(config)# class-map type inspect voice-control-traffic	Creates an inspect type class map and enters class-map configuration mode.
Step 7	match access-group {access-group | name access-group-name} Example: Router(config-cmap)# match access-group 101	Configures the match criteria for a class map based on the ACL name or number.
Step 8	match protocol stun-ice stun-ice-parameter-map Example: Router(config-cmap)# match protocol stun-ice cfd2	Configures the match criteria for a class map on the basis of a specified protocol.
Step 9	exit Example: Router(config-cmap)# exit	Exits class-map configuration mode.
Step 10	policy-map type inspect policy-map-name Example: Router(config)# policy-map type inspect voice-traffic	Creates an inspect type policy map and enters policy map configuration mode.
Step 11	class type inspect class-name Example: Router(config-pmap)# class type inspect voice-control-traffic	Specifies the traffic (class) on which an action is to be performed.
Step 12	inspect Example: Router(config-pmap-c)# inspect	Enables Cisco IOS stateful packet inspection.
Step 13	exit Example: Router(config-pmap-c)# exit	Exits policy map class configuration mode.
Step 14	class type inspect class-name Example: Router(config-pmap)# class type inspect stun-traffic	Specifies the traffic (class) on which an action is to be performed.
Step 15	inspect Example: Router(config-pmap-c)# inspect	Enables Cisco IOS stateful packet inspection.
Step 16	exit Example: Router(config-pmap-c)# exit Example: Router(config-pmap)# exit	Exits policy map class and policy map configuration mode.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    parameter-map type protocol-info sip parameter-map-name

4.    disable open-media-channel

5.    exit

6.    class-map type inspect class-map-name

7.    match protocol sip parameter-map-name

8.    exit

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	parameter-map type protocol-info sip parameter-map-name Example: Router(config)# parameter-map type protocol-info sip pmap-sip	Defines a SIP-protocol-info parameter map and enters parameter map type configuration mode.
Step 4	disable open-media-channel Example: Router(config-profile)# disable open-media-channel	Prevents the creation of a media channel when this parameter map is attached to the SIP class map.
Step 5	exit Example: Router(config-profile)# exit	Exits parameter map type configuration mode.
Step 6	class-map type inspect class-map-name Example: Router(config)# class-map type inspect cmap-sip-traffic	Creates an inspect type class map and enters class-map configuration mode.
Step 7	match protocol sip parameter-map-name Example: Router(config-cmap)# match protocol sip pmap-sip	Configures the match criteria for a class map on the basis of a specified protocol.
Step 8	exit Example: Router(config-cmap)# exit	Exits class-map configuration mode.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    parameter-map type protocol-info stun-ice parameter-map-name

4.    authorization agent-id shared-secret password cat-window number

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	parameter-map type protocol-info stun-ice parameter-map-name Example: Router(config)# parameter-map type protocol-info stun-ice abc1	Defines an application-specific parameter map and enters parameter map type configuration mode.
Step 4	authorization agent-id shared-secret password cat-window number Example: Router(config-profile)# authorization agent-id 20 shared-secret 12345flower12345 cat-window 15	Configures the credentials of more than one authorization agent in the same parameter map and associates the same credentials with the filter that was set up via the match protocol stun-ice command.