Standalone SIP Phones and NAT Problems

danieltudares84 · ‎08-14-2015

Hi, I have a VOIP setup with some Cisco 7940G IP phones registering with a external Voip provider, I don't have a Call Manager, I'm using an OpenSource firewall (PFSense) with SIPROXd to eliminate the Nat problem between my Ip phones and the provider. Now I'm moving to a Cisco ASA5506-X and I'm not sure how to resolve the SIP Proxy problem. Do I need to install a separate machine running SIPROXd or can I solve it directly with the ASA?

Jaime Valencia · ‎08-14-2015

This is the Video Over IP area, please move to a relevant area.

HTH

java

if this helps, please rate

Mohammed al Baqari · ‎08-15-2015

Hi,

How are you connected to your external server? Are you using VPN? In case over public internet, SIP server should have nat asymmetry feature enabled. If this is enabled, then you don't need to worry about natting SIP phones.

In ASA, you need to allow SIP signalling and RTP/RTCP ports. Another option (I don't recommend) is to allow SIP signalling and enable SIP inspection. I have seen voice degradation with this feature @ high call rates.

danieltudares84 · ‎08-16-2015

Hi Mohammed,

Thanks for your answer! No I'm not connected using VPN, I connect with the VOIP provider (voip.ms) using public internet. So I just need to create an ACL allowing SIP and RTP? (Not port forward?). Is SIP inspection enabled by default on the ASA? (SIP ALG) I read on the voip.ms forum they ask for that feature to be disable.

Mohammed al Baqari · ‎08-16-2015

Hi,

This depends on your ASA version. Prior to 8.3 it is disabled by default. Post 8.3 it is enabled by default.

You can see it in the running config of the ASA

danieltudares84 · ‎08-28-2015

Hi, I tried the SIP phones with the ASA, the phones are working as Standalone (Cisco 7940) so the register directly with my external provider (voip.ms), they succesfully register with voip.ms and I can place calls but it seems that when the stay idle for a time the ASA is closing the ports and I can not receive outside calls, I pinhole the ASA opening the 5060 port and the one used for RTP with no success. What can I do to allow outside calls?

I'm using an ASA 5506-X version 9.4(1) .