Skinny is a protocol used in VoIP applications. (Skinny is another name for the Simple Client Control Protocol [SCCP].) Cisco IP Phones, Cisco CallManager, and Cisco CallManager Express use this protocol. Figure 8-13 demonstrates the registration and communication process between a Cisco IP Phone and all the respective components such as Cisco CallManager.
Figure 8-13. Cisco IP Phone Registration and Communication Flow
In Figure 8-13, the Cisco IP Phone is assigned to a specific VLAN. After that, it sends a request to the DHCP server to get an IP address, DNS server address, and TFTP server name or address. It also gets a default gateway address if you have set these options in the DHCP server.
Note
If a TFTP server name is not included in the DHCP reply, the Cisco IP Phone uses the default server name.
The Cisco IP Phone obtains its configuration from the TFTP server. It resolves the Cisco CallManager name via DNS and starts the Skinny registration process.
The Cisco ASA inspects the Skinny transactions with the use of the inspect skinny command. This command is enabled by default.
Note
Cisco ASA does not support fragmented Skinny messages.
As previously discussed, Cisco IP Phones download their configuration information from a TFTP server. This information includes the name or IP address of the Cisco CallManager server to which they need to connect. You must use an ACL to open UDP port 69 when the Cisco IP Phones are on a lower security interface compared to the TFTP server. If the Cisco IP Phones are on a lower security interface compared to the Cisco CallManager, create a static NAT entry for the Cisco CallManager.
Note
Instructions on how to create ACLs and static NAT entries are covered in Chapter 5, "Network Access Control."
Part I: Product Overview
Introduction to Network Security
Product History
Hardware Overview
Part II: Firewall Solution
Initial Setup and System Maintenance
Network Access Control
IP Routing
Authentication, Authorization, and Accounting (AAA)
Application Inspection
Security Contexts
Transparent Firewalls
Failover and Redundancy
Quality of Service
Part III: Intrusion Prevention System (IPS) Solution
Intrusion Prevention System Integration
Configuring and Troubleshooting Cisco IPS Software via CLI
Part IV: Virtual Private Network (VPN) Solution
Site-to-Site IPSec VPNs
Remote Access VPN
Public Key Infrastructure (PKI)
Part V: Adaptive Security Device Manager
Introduction to ASDM
Firewall Management Using ASDM
IPS Management Using ASDM
VPN Management Using ASDM
Case Studies