Cisco IP Phone 7900 and NAT

[imfvieira]

Hello,

We need to configure a IP Phone with public address and to do it we need to configure some NATs. The SIP Server is at Internet.

One of the solutions that is possible is to use a SIP Proxy. Does anyone knows if Cisco ASA can be configured as a SIP Proxy?

Is there any special requests to this NAT works? The idea is configure the private address on the data vlan.

Thanks.

[Chris Deren · Accepted solution]

No ASA cannot be a SIP proxy.  Cisco has CUSP product and now virtual CUSP that can server as proxy.  The obvious issue with NATing SIP traffic is that you need to have SIP aware NAT devices along the path as without that SDP content of the SIP message does not reflect proper media IP addresses and for that reason it is not recommended to NAT SIP traffic.

[Mohammed al Baqari]

Hi,

Adding to above, you need to make sure that you allow signaling and media ports to the internet. The problem here that the called party can be random (I am assuming) and the media uses wide range of UDP ports. In this you are exposing your VoIP subnet to internet (security concern)

[imfvieira]

Thanks for all answers.

I'm guessing about this "SIP aware NAT". Is possible to configure it on ASA?
I´m still trying to figure out how to deploy it with few infrastructure changes.
 

[Gordon Ross]

The ASAs & CUCM supported a feature called IP Phone Proxy. It allowed the phone to treat the ASA as its CUCM and the ASA would proxy the phone's traffic back to the real CUCM. The ASA licensing was very expensive, though.

GTG

[Mohammed al Baqari]

Gordon,

ASA Phone Proxy service is basically an SSL VPN connection from SSL-Capable phones to CUCM cluster. It will enable encrypted/authenticated phones to connect to non-secure cluster (basically mixed mode). ASA won't act as SIP proxy. This is totally different.

[Gordon Ross]

Not quite. ASA Phone proxy is as I described. (see www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/unified_comm_phoneproxy.html )

Some IP Phones (7965, 9971) have an inbuilt AnyConnect VPN client.

(And the new 78xx & 88xx phones support remote access via Jabber/Expressway MRA)

GTG

[Mohammed al Baqari]

Thx Gordon for sharing it. We might be having same understanding with different interpretation. ASA won't be a SIP proxy server for sure. Please see this from the document you shared:

"

the phone proxy behaves in the following ways:

- The TLS connections from the phones are terminated on the ASA and a TCP connection is initiated to the Cisco UCM ----- converting secure signaling to non-secure signaling

- SRTP sent from external IP phones to the internal network IP phone via the ASA is converted to RTP ----- converting secure media to non-secure media

......

the phone proxy performs the following major functions:

- Terminates TLS signaling from the phone and initiates TCP or TLS to Cisco UCM

- Inserts itself into the media path by modifying the Skinny and SIP signaling messages

"

You can't point 3rd party SIP client to ASA with Phone Proxy feature because it doesn't perform signaling. It just relays packets.

Note: When I said SSL VPN, I wasn't specific to anyconnect VPN. SSL VPN can be client or clientless. Phones which don't support anyconnect client will use clientless SSL VPN.

[Chris Deren]

Before VPN client was supported on Cisco phones, phony proxy feature was available on ASA with proper licensing to proxy TFTP/signaling traffic between CUCM and phones so that they can be used outside of the network. To my understanding that proxy feature was only specific for CUCM communication and not a SIP proxy.

[Mohammed al Baqari]

Thx Chris for confirming. I have to admit that I am impressed with the depth of your knowledge :)

Glad to see people like you on the forum.