Cisco Systems and the ASA Services Module Manual De Usuario

To support SIP calls through the ASA, signaling messages for the media connection addresses, media 
ports, and embryonic connections for the media must be inspected, because while the signaling is sent 
over a well-known destination port (UDP/TCP 5060), the media streams are dynamically allocated. 
Also, SIP embeds IP addresses in the user-data portion of the IP packet. SIP inspection applies NAT for 
these embedded IP addresses.

The following limitations and restrictions apply when using PAT with SIP:

If a remote endpoint tries to register with a SIP proxy on a network protected by the ASA, the 
registration fails under very specific conditions, as follows:

PAT is configured for the remote endpoint.

The SIP registrar server is on the outside network.

The port is missing in the contact field in the REGISTER message sent by the endpoint to the 
proxy server.

Configuring static PAT is not supported with SIP inspection. If static PAT is configured for the 
Cisco Unified Communications Manager, SIP inspection cannot rewrite the SIP packet. 
Configure one-to-one static NAT for the Cisco Unified Communications Manager.

If a SIP device transmits a packet in which the SDP portion has an IP address in the owner/creator 
field (o=) that is different than the IP address in the connection field (c=), the IP address in the o= 
field may not be properly translated. This is due to a limitation in the SIP protocol, which does not 
provide a port value in the o= field.

Instant Messaging refers to the transfer of messages between users in near real-time. SIP supports the 
Chat feature on Windows XP using Windows Messenger RTC Client version 4.7.0105 only. The 
MESSAGE/INFO methods and 202 Accept response are used to support IM as defined in the following 
RFCs:

Session Initiation Protocol (SIP)-Specific Event Notification, RFC 3265

Session Initiation Protocol (SIP) Extension for Instant Messaging, RFC 3428

MESSAGE/INFO requests can come in at any time after registration/subscription. For example, two 
users can be online at any time, but not chat for hours. Therefore, the SIP inspection engine opens 
pinholes that time out according to the configured SIP timeout value. This value must be configured at 
least five minutes longer than the subscription duration. The subscription duration is defined in the 
Contact Expires value and is typically 30 minutes.

Because MESSAGE/INFO requests are typically sent using a dynamically allocated port other than port 
5060, they are required to go through the SIP inspection engine.

Only the Chat feature is currently supported. Whiteboard, File Transfer, and Application Sharing are not 
supported. RTC Client 5.0 is not supported.

SIP inspection translates the SIP text-based messages, recalculates the content length for the SDP 
portion of the message, and recalculates the packet length and checksum. It dynamically opens media 
connections for ports specified in the SDP portion of the SIP message as address/ports on which the 
endpoint should listen.