Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Sip Trunk Between Two ASA´s

Hello All,

Can any help me to confirm if is possible to establish a SIP trunk between two CUCM 9.1 through Cisco ASA.

Please see the attach picture.

Do i need a special license for this in ASA ?

Can point me to the correct documentation for this deployment ?


ASA Version: 8.4(2) and ASA Version 9.1(2)

Thanks for your response.

Everyone's tags (1)
VIP Super Bronze

I dont see any issues with it

I dont see any issues with it other than the fact that you will need to set up your firewall to allow sip and rtp packets between the sites. The only issue will be with the long as you configure it properly, I don't see any issues at all

Please rate all useful posts "The essence of christianity is not the enthronement but the obliteration of self --William Barclay"
New Member

Thanks for your response man.

Thanks for your response man..


Can you point me to the correct documentation about setup the firewall to allow sip and rtp packets.



Hello1- you have to enable


1- you have to enable port 5060 for the access list which will permit traffic between the two sites to ITSP.

2-You have to enable SIP & RTP traffic into  inspection to allow SIP traffic and RTP .

3- Kindly find the below documents , i hope to be useful for you.


note: if you get any issues , kindly check the below blog for Cisco support community for security devices who are so expert .



Please rate all useful information


If you have access to both

If you have access to both ASA's I would just create a site-2-site VPN between them with some NAT exempt! It's a 2min job using the wizard on the ASA then you are not messing around with opening ports etc.

Plus your pushing your voice over a VPN tunnel rather than just out onto the internet!

If you do go down the road of port forwarding watch out for port 5060:

You don't want to find yourself with a BIG phone bill for calls you didn't make!

Good luck!

Just bear in mind that SIP (&

Just bear in mind that SIP (& RTP) don't always play nice with NAT.


If you're not having to NAT, and you're just running a transparent VPN tunnel with the ASAs, then it should work fine.


If you need to NAT, then you should consider a SIP Session Border Controller (e.g. Cisco CUBE)




PS - ASA's have protocol inspection that tries to help by looking deep into the packets and rejecting/cleaning packets. Unfortunately, it doesn't always work well, so consider switching it off...

Please rate all helpful posts.
New Member

Hi Thanks for your response.

Hi Thanks for your response.


I don´t have VPN tunnel with the ASAs, so i think that the second option is good for me (NAT).


Can you point me to the correct documentation about configuring it or if you have an example about this please point me to it.. i have a CUBE for Site A and Site B but i don´t know how configure it for this purpose.

Thanks for your response and help on this.