Voice Over IP

[Elie El Amil]

Hi,

Kindly note that we have five routers 2811 which are distributed in all the branches and connected to head office router 2811 through a tunnel VPN; in other words, every branch connects to head office as well as to all other branches. Besides, we have a primary connection such as Ethernet and a backup connection such as ISDN; add to that a voice over IP. The above mentioned connections go through a loopback interface.

Actually, this network has to be upgraded and will be replaced by a firewalls ASA5505. On the other hand, the router has to be set behind the firewall in order to guarantee a voice over ip. In this case, the tunnel will be removed on the routers and a VPN site to site will be opened between firewalls. Our real concern is the voice over IP, and here I would like to inquire about the proper function of the voice through the firewall due to the fact that the session target is connected to the loopback IP on each router.

Is there any special configuration on the ASA concerning the voip?

Is there any routing to the loopback IPs on the ASA to insure the proper passing voip through the loopback IP?

We appreciated your support.

[paolo bevilacqua · Accepted solution]

Routers do tunnels and  VPN much better than ASA, so you may want to revise your plans.

[Elie El Amil]

I have to implement the scenario with ASA. I don't have another choice.

[Florin Barhala · Accepted solution]

I believe it will do fine; nevertheless you will to read a bit about ASA as it has many differences when comparing to routers; mostly pay attentin to policy-map feature inspection and remove sip and other voice protocols; also depeding of your scenario look on the firewall configuration side, as it has many options to be tuned.

Install ASA, configure the VPNs and VOIP and comeback if any issues should appear. I am running VOICE through ASA 5520 fine.

[Elie El Amil]

Thank you for the important information. kindly could you send me an example about the mentioned configuration? How to can I remove a sip and other voice protocols from the policy-map and why I have to remove it? What is the tuned in the ASA configuration concerning my scenario?

Your time and consideration are highly appreciated.

[Mohamed Sobair · Accepted solution]

Hi,

Your setup will work just fine.

All what you have to do is to allow Voice Signaling protocol through the firewall to Communication Manager or the communication Manager Express (Voice Gateway).

Below link is useful,

http://www.cisco.com/en/US/customer/products/ps6120/products_configuration_example09186a008081042c.shtml

HTH

Mohamed

[Elie El Amil]

Hi,

with reference to the above link ,I found out that the sip is enable by default on ASA,

Is it right? Noting that we haven't a call manager.

[Alfaisaliah Group · Accepted solution]

Yes, SIP is inspected by default on the ASA.

But you still need to allow the incoming traffic on the specified ports based on the Signaling used.

You need to have static nat translation of your call manager express and allow communication (session target communication) between the voice Gatewy router at branch side and the CME.

Please rate this post using the star box below.

HTH

Mohamed

[Mohamed Sobair · Accepted solution]

Yes, SIP is inspected by default on the ASA.

But you still need to allow the incoming traffic on the specified ports based on the Signaling used.

You need to have static nat translation of your call manager express and allow communication (session target communication) between the voice Gatewy router at branch side and the CME.

Pls rate this post using the star box below

HTH

Mohamed

[Elie El Amil]

how can i do the mentioned configuration? could you send me such an example concerning this configuration?

Thanks in advance.

[Mohamed Sobair · Accepted solution]

You can follow the attached link for the required config.

what else part of the config you need?

Regards,

Mohamed

[Elie El Amil]

Hi,

I found out in the attached link how to configure a policy map and inspect SIP. But is there any additional config conecerning the voice? How to configure the static nat translation?

Thanks for your time.

Elie