topic Allowing SIP through ASA 5525-X version 9.x in Network Security

Allowing SIP through ASA 5525-X version 9.x

Terence Lockette — Tue, 12 Mar 2019 07:05:02 GMT

Hello,

Other than configuring the inspect SIP parameter for the global policy of the firewall, is there anything else I need to configure to allow SIP through my ASA? Do I need to configure NAT & ACLs? I attached a diagram of what I think the topology may look like but I assume that I may have to open up port 5060 from the outside going in on the firewall. I'm not sure, however, because we have a router from the telco where inbound and outbounds SIP calls are to be sent and received from (see diagram).

Thanks,

Terence

Assuming inbound calls will

Collin Clark — Tue, 29 Dec 2015 23:16:50 GMT

Assuming inbound calls will be coming over SIP, then yes you will need to create a NAT & ACL. Also ATT can be particular on what address/address space your SIP calls are coming from so you'll want to pay attention to that as well. Even though ATT has a SIP router on premise, there needs to be connectivity between the ATT router and your voice server (which by looking at your diagram, goes through the ASA).

HTH

Hello Terence,

bhavsha2 — Wed, 30 Dec 2015 12:27:47 GMT

Hello Terence,

NAT comes in place if the Call Manager is on the Internet and the phone is on the LAN Network.

So in this case a phone from Network 12.21.89.x would be communicating with a phone on Network 206.x . So are the phones going to be registered with the Call Manager which is in Network 12.21?

If the scenario is the way I have mentioned then translation would be required from 206 network to 12.21 network if the translation is not performed on Telco router

Regards,

Bhavik Shah

Hey guys,

Terence Lockette — Fri, 15 Jan 2016 19:00:25 GMT

Hey guys,

Just so you're aware, we're running Mitel 3300s for our PBXs and will have a SecureLogix appliance to proxy the SIP. We want to keep these devices behind our firewall so I'm sure ACL/NAT will be used along with SIP inspect. I'll provide another updated diagram of how I think the topology will be for the setup. I just need to know what a typical ACL/NAT would look like for allowing SIP through the ASA.

Thanks,

Terence

Collin,

Terence Lockette — Fri, 08 Apr 2016 15:18:25 GMT

Collin,

Can you provide an example of how I would configure NAT on the ASA that I can use as a reference?