IP Telephony in Full Nat Environment

[kumar.22.gaurav]

HI Everybody,

I handle operations of Firewall.

I have a question regarding the capability of IP Telephony since I am not an expert in that.

We have a network with one central site and two remote locations connceted to Central site via Metro-Ethernet.

We have routers on all the three locations behind which we have Cisco ASA 5520.

Both the remote locations do not have any direct connectivity and is routed through Central router.

At DMZ in central site we have Cisco Call Manager for Cisco VOIP phone on central and remote sites.

We have VPN from both remote sites to central sites and one between both remote sites.

My Questions.

1) If Call manager goes down after call setup between two remote location IP Phones, will existing call continue?

2) If we use NAT for the communication between all sites will ip telephony keep on working? What will be the impact?

3) If answer to question 2 is, yes, then what happens if call manager goes down (will the communication go through the remote site to remote site VPN)?

Attached is a network diagram for reference.

If there is any similar post which answers all of the above, please tell me as I am new to this forum and tried to search but haven't found any.

Thanks for enlightening.

Regards

Gaurav Kumar

[Joseph Martini · Accepted solution]

1) If Call manager goes down after call setup between two remote location IP Phones, will existing call continue?

Yes, phones will maintain a call between two IP phones even if they lose connection to the call manager server.  The audio path is directly between the phones so the phones continue to send and receive audio without the server.

2) If we use NAT for the communication between all sites will ip telephony keep on working? What will be the impact?

It can be done but it is diffucult.  NAT has to be able to do deep inspection to translate the IP addresses that are inside of the SCCP messages and/or SIP messages, not just the IP headers. 

3) If answer to question 2 is, yes, then what happens if call manager goes down (will the communication go through the remote site to remote site VPN)?

If the call manager is down you can't make a new phone call (unless you have SRST - Surviable Remote Site Telephony), but existing calls for the most part will stay up.

[kumar.22.gaurav]

Hey Joe,

Thanks for the answers.

Just one more quick question.

What is required for deep inspection and NAT? Is it a hardware dependency, a design dependency or a configuration requirement?

I have an environment having only cisco devices and nothing else. For VC we have Tandberg. Please suggest a document for better understanding.

Thanks in advance....

Regards

Gaurav Kumar

[Gordon Ross]

You *really* want to avoid NAT with SIP & RTP. You're really better off using something like a VPN that is invisible to the phones.

GTG

[kumar.22.gaurav]

Right...I am already using VPN but at the same time I don't want anybody to see other persons IP So I am using nat in VPN as well. But not yet using for VOIP. I am planning to use it.

On top of that, leave it aside, if it should be done or not. I want to know how it can be done.

---Gaurav

[Gordon Ross]

You're best bet to NAT SIP traffic is to use something like Cisco CUBE (

http://www.cisco.com/en/US/products/sw/voicesw/ps5640/ ) But that is really intended for SIP trunks, and not SIP endpoints.

You might be better off using CME at each site, and just having SIP trunks between them, which you NAT with CUBE.

GTG