{"id":1284,"date":"2020-05-28T12:42:57","date_gmt":"2020-05-28T11:42:57","guid":{"rendered":"https:\/\/www.balajibandi.com\/?p=1284"},"modified":"2020-11-28T08:46:04","modified_gmt":"2020-11-28T08:46:04","slug":"disable-sip-inspection-on-firepower-through-flexconfig","status":"publish","type":"post","link":"https:\/\/www.balajibandi.com\/?p=1284","title":{"rendered":"Disable SIP Inspection on Firepower through FlexConfig"},"content":{"rendered":"\n<p>We may come across issues with SIP inspection to be disabled on an ASA or Firepower, leading to problems with SIP\/RTP voip audio. As a troubleshooting step, it\u2019s often helpful to disable SIP inspection for testing.<\/p>\n\n\n\n<p>Please read this note from Cisco on disabling SIP inspection to verify you everything in order before doing so:<\/p>\n\n\n\n<p><em>You would typically disable SIP only if the inspection is causing problems in the network. However, if you disable SIP, you must ensure that your access control policies allow the SIP traffic (UDP\/TCP 5060) and any dynamically allocated ports, and that you do not need NAT support for SIP connections. Adjust the access control and NAT policies accordingly through the standard pages, not through FlexConfig.<\/em><\/p>\n\n\n\n<p>For Firepower devices managed by an FMC, here are some quick instructions to push out a FlexConfig policy to disable SIP inspection.<\/p>\n\n\n\n<p>In FMC, navigate to&nbsp;<strong>Devices<\/strong>&nbsp;&gt;&nbsp;<strong>FlexConfig<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/wrmem.net\/wp-content\/uploads\/2020\/05\/sip-inspection-1.png\" alt=\"\" class=\"wp-image-812\"\/><\/figure>\n\n\n\n<p>Click the Pencil icon to edit your FlexConfig device policy. If you don\u2019t have a policy yet click New Policy to create one.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/wrmem.net\/wp-content\/uploads\/2020\/05\/sip-inspection-2-1024x83.png\" alt=\"\" class=\"wp-image-814\"\/><\/figure>\n\n\n\n<p>In the FlexConfig policy click the New FlexConfig Object.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/wrmem.net\/wp-content\/uploads\/2020\/05\/sip-inspection-3-1024x408.png\" alt=\"\" class=\"wp-image-815\"\/><\/figure>\n\n\n\n<p>Give a name a name and description for the new new object and in the text field copy the commands below (note the indentations). Click Save.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">policy-map global_policy<br> class inspection_default<br>  no inspect sip<\/pre>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/wrmem.net\/wp-content\/uploads\/2020\/05\/sip-inspection-4-1024x612.png\" alt=\"\" class=\"wp-image-817\"\/><\/figure>\n\n\n\n<p>Under available FlexConfig find the new object we created, highlight it, and click the left arrow to add it to the policy.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/wrmem.net\/wp-content\/uploads\/2020\/05\/sip-inspection-5-1024x805.png\" alt=\"\" class=\"wp-image-818\"\/><\/figure>\n\n\n\n<p>With the new object added to the policy, save the policy and deploy to your FirePower.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/wrmem.net\/wp-content\/uploads\/2020\/05\/sip-inspection-6-1024x450.png\" alt=\"\" class=\"wp-image-819\"\/><\/figure>\n\n\n\n<p>SSH to the Firepower and run the following command to verify that SIP is no longer in the inspection list:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">show run policy-map | beg global_policy\n\npolicy-map global_policy\n class inspection_default\n  inspect dns preset_dns_map\n  inspect ftp\n  inspect h323 h225\n  inspect h323 ras\n  inspect rsh\n  inspect rtsp\n  inspect sqlnet\n  inspect skinny\n  inspect sunrpc\n  inspect xdmcp\n  inspect netbios\n  inspect tftp\n  inspect icmp\n  inspect icmp error<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>We may come across issues with SIP inspection to be disabled on an ASA or Firepower, leading to problems with SIP\/RTP voip audio. As a troubleshooting step, it\u2019s often helpful to disable SIP inspection for testing. Please read this note from Cisco on disabling SIP inspection to verify you everything in order before doing so: [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,2],"tags":[],"class_list":["post-1284","post","type-post","status-publish","format-standard","hentry","category-ccie-sec","category-cisco"],"_links":{"self":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts\/1284","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1284"}],"version-history":[{"count":1,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts\/1284\/revisions"}],"predecessor-version":[{"id":1285,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts\/1284\/revisions\/1285"}],"wp:attachment":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1284"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1284"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1284"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}