Cisco ASA 8.2 NAT Question

[eks1]

I can get things done in the ASA if I have examples, but while probably totally obvious, this is stumping me.

I'm trying to get a video conferencing system working and we keep sporadically losing connectivity.

They have asked me to open up ALL TCP/UDP traffic between 192.168.9.15 and 88.88.88.88 (made up IPs).

I know how to open up certain ports, but I'm not clear on how to open up everything. Do I just eliminate the eq 17990 at the end of the access-list command?

access-list inbound extended permit tcp any host 88.88.88.88 eq 17990
static (inside,outside) 88.88.88.88 192.168.9.15 netmask 255.255.255.255

They have also asked that I set the UDP timeout to be longer than 2 minutes. In reading, for security reasons it says not to make this change globally, so is there a way to make the change only for this NAT?

Thanks in advance.

 

[ADB100]

If you want to allow ALL TCP & UDP traffic then you need two lines in the inbound ACL - one to allow tcp and one to allow udp:

access-list inbound extended permit tcp any host 88.88.88.88 
access-list inbound extended permit udp any host 88.88.88.88

What protocol is your VC unit using? If its H.323 or SIP then the PIX should understand the protocol and dynamically create the pinholes for the protocol to operate without you opening all TCP & UDP ports. In my experience you will probably also need ICMP of some sorts as the end stations will need ICMP reachability between themselves - you may need to turn on ICMP inspection as it isn't on by default.

Andy

 

[eks1]

Thanks Andy, that's basically what I was thinking needed to be done. I've made the changes and will test it tonight when I'm off the network.
I believe the video conferencing system is using H.264.
The manufacturer is Vidyo.

Any thoughts on the UDP timeout?

 

[ADB100]

H.264 is a video codec. The actual VC protocol will be almost definitely either SIP or H.323. As I say the PIX should be able to handle either without opening huge port (or all...) ranges. You just need to allow the control traffic ports:

SIP - UDP/5060
H.323 - TCP/1720

Assuming the default global inspections are enabled the PIX intelligently inspects the SIP or H.323 conversations and dynamically opens the RTP ports that are negotiated in the call setup.

Typically you will also need to allow ICMP between the endpoints.

Andy