Cisco Cisco Firepower Management Center 4000

The Advanced Settings page appears.

You have two choices, depending on whether 

 under Application Layer 

Preprocessors is enabled:

If the configuration is enabled, click 

.

If the configuration is disabled, click 

, then click 

.

The Sun RPC Configuration page appears. A message at the bottom of the page identifies the intrusion 
policy layer that contains the configuration. See 

 for more 

information.

In the 

 field, type the port numbers where you want to decode RPC traffic. Separate multiple ports 

with commas. 

You can select or clear any of the following detection options on the Sun RPC Configuration page:

Optionally, click 

 at the top of the page to display rules associated 

with individual options.

Click 

 to return to the Sun RPC Configuration page.

Save your policy, continue editing, discard your changes, revert to the default configuration settings in 
the base policy, or exit while leaving your changes in the system cache. See the 

 table for more information.

Protection

The Session Initiation Protocol (SIP) provides call setup, modification, and teardown of one or more 
sessions for one or more users of such client applications as Internet telephony, multimedia 
conferencing, instant messaging, online gaming, and file transfer. A method field in each SIP request 
identifies the purpose of the request, and a Request-URI specifies where to send the request. A status 
code in each SIP response indicates the outcome of the requested action.

After calls are set up using SIP, the Real-time Transport Protocol (RTP) is responsible for subsequent 
audio and video communication; this part of the session is sometimes referred to as the call channel, the 
data channel, or the audio/video data channel. RTP uses the Session Description Protocol (SDP) within 
the SIP message body for data-channel parameter negotiation, session announcement, and session 
invitation.

The SIP preprocessor is responsible for:

decoding and analyzing SIP 2.0 traffic

extracting the SIP header and message body, including SDP data when present, and passing the 
extracted data to the rules engine for further inspection

generating events when the following conditions are detected and the corresponding preprocessor 
rules are enabled: anomalies and known vulnerabilities in SIP packets; out-of-order and invalid call 
sequences