[asterisk-users] oneway audio with asterisk behind cisco pix 506

Fri Feb 8 23:54:57 CST 2008

Ravi,

I will explain changing the config in asterisk and the pix:

Asterisk Box - vi to /etc/asterisk/rtp.conf and change the port span to 
10000 to 10050 (to start, you will need to increase later as ports fill up)

(use insert to make a change in a file)

to save:

   1. esc
   2. shift + colon
   3. wq (to save)

If you made a mistake and do not want to save but you changed something 
in the file:

   1. esc
   2. shift + colon
   3. q! (to exit)

Cisco Pix - on my old Pix 520 UR I do not use the ACLs for this case the 
static and conduit commands so this is a example from my setup.

Theses are not usable IPs on the Internet or my IPs but just an example....

outside (interface) - 192.168.1.0/24 (192.168.1.1-192.168.1.254)
dmz (interface) - 192.168.254.0/24 (192.168.254.1-192.168.254.254)

interface ethernet0 100full (sets the duplex and turns on interface)
interface ethernet1 100full (sets the duplex and turns on interface)

nameif ethernet0 outside security0 ( lower security)
nameif ethernet1 dmz security50 (higher security)

no fixup protocol sip 5060
no fixup protocol sip udp 5060

! - this makes things easier so now the pix knows the IP of the asterisk 
box and maps the ip to the name just for configuration purposes only so 
if you had 20 servers or devices you wanted public access to it's just 
easier to remember their names versus IPs.
name 192.168.254.11 dns
name 192.168.254.10 asterisk

! - the static command is used as a permanent mapper from one inside, 
dmz, or other to the global ip vice versa. (Rule of thumb if you map 
using static make sure you have a conduit command)
static (dmz,outside) 192.168.1.22 asterisk netmask 255.255.255.255 0 0

! - here is where you open the ports on the global side to the asterisk 
box. (the conduit command allows connections from lower security 
interfaces to higher security interfaces)
conduit permit udp host 192.168.1.22 eq 10000 any
conduit permit udp host 192.168.1.22 eq 10001 any
conduit permit udp host 192.168.1.22 eq 10002 any
conduit permit udp host 192.168.1.22 eq 10003 any
conduit permit udp host 192.168.1.22 eq 10004 any
conduit permit udp host 192.168.1.22 eq 10005 any

Hope this helps!

--Otis

Ravichandran Rajagopal wrote:
> Otis,
> I am new to Cisco PIX 506 and I am learning this. If you can help me with
> how to do this change on Cisco PIX it would be greatly appreciated. 
>
> Thx
> Ravi
>
> -----Original Message-----
> From: ListAcct [mailto:listacc at ocosa.com] 
> Sent: Friday, February 08, 2008 11:11 PM
> To: ravi at vaishnavy.com; Asterisk Users Mailing List - Non-Commercial
> Discussion
> Subject: Re: [asterisk-users] oneway audio with asterisk behind cisco pix
> 506
>
> Ravi,
>
> Open up the RTP (UDP) ports on your pix. (EX. conduit permit udp host 
> x.x.x.x eq 10049 any). Also set your asterisk rtp config span to 
> something you can configure (10000 to 10200) unless you write a script 
> to just copy and paste about 10000 to 20000 ports in your config on the 
> pix. Cisco's are strange but secure.
>
> It took me about two hours to figure out after taking off the fixup and 
> no more logging/debugging from the cisco. I actually fixed while a call 
> was coming in. LOL! Let me know!!!
>
> --Otis
>
> Ravichandran Rajagopal wrote:
>   
>> Hi,
>>
>> I have the Cisco PIX 506 firewall right in front of the asterisk and I 
>> am getting a one-way audio. I need your help/guidance to resolve this 
>> problem. I have the "fixups" disabled for SIP in the Cisco PIX 506. 
>> Any help rendered by you in this subject is greatly appreciated. I 
>> have been breaking my head trying to resolve this problem for more 
>> than one month. I have included the sip.conf and the extensions.conf 
>> below.
>>
>> [SIP.conf]
>>
>> ; SIP Configuration example for Asterisk
>>
>> [general]
>>
>> context=incoming
>>
>> allowoverlap=no
>>
>> bindport=5060
>>
>> bindaddr=0.0.0.0
>>
>> localnet=192.168.5.0/255.255.255.0
>>
>> externip=a.b.ccc.dd
>>
>> srvlookup=yes
>>
>> allow=ulaw
>>
>> allow=alaw
>>
>> [incoming]
>>
>> type=peer
>>
>> nat=no
>>
>> canreinvite=no
>>
>> host=xx.y.z.aaa
>>
>> qualify=yes
>>
>> dtmfmode=rfc2833
>>
>> context=default
>>
>> [extensions.conf]
>>
>> [general]
>>
>> static=yes
>>
>> writeprotect=yes
>>
>> clearglobalvars=no
>>
>> [default]
>>
>> include => customer
>>
>> exten => h,1,Hangup
>>
>> exten => i,1,Congestion
>>
>> exten => i,2,Hangup
>>
>> [agnosco]
>>
>> include => local-extensions
>>
>> include => customer_ivr
>>
>> include => incoming
>>
>> [customer_ivr]
>>
>> include => local-extensions
>>
>> exten => s,1,Answer
>>
>> exten => s,n,Background(agnosco_intro)
>>
>> exten => s,n,WaitExten
>>
>> ;Dial said extensions
>>
>> exten => 5,1,Dial(SIP/4028805362 at incoming,30)
>>
>> [incoming]
>>
>> exten => 4025901000,1,Goto(1000,1)
>>
>> exten => 1000,1,Goto(customer_ivr,s,1)
>>
>> Thanks
>>
>> sunMoonstar.
>>
>> ------------------------------------------------------------------------
>>
>> _______________________________________________
>> -- Bandwidth and Colocation Provided by http://www.api-digital.com --
>>
>> asterisk-users mailing list
>> To UNSUBSCRIBE or update options visit:
>>    http://lists.digium.com/mailman/listinfo/asterisk-users
>>     
>
>
>   