ASA 5506-X and SIP Phone problem

[skaljkovic]

Hello

I have a problem with this Firewall. It is installed in office where we have Web server and Asterisk VoIP communication server. We have one static public IP and I successfully forwarded custom port for Web server (9090) but we have problems forwarding SIP ports.

On inside network phones works just fine but from outside network we have "one way audio" problem.

I'm new to Cisco configuration and I need step by step instructions how to fix this. I can post all settings that you need just tell me how. :)

I have read other topic about this problems and I tried suggested methods but with no success.

[Philip D'Ath]

What port do the phones connect in on from the outside world?  You can make life much easier for yourself if you use something like TLS.

Do you have an "inspect sip" command on the ASA?  If so, try removing it.

[skaljkovic]

Phones connect over 5060 port and then for media transfer uses ports from 10001-20000 (configured in Asterisk server).

What is TLS?

Others tell me to enable "inspect sip" not to disable it. What is "inspect sip"?

[Philip D'Ath]

"inspect SIP" is an ALG and it often breaks VoIP.  Try it enabled and then disabled to see if it makes any differences.

SIP TLS runs the whole VoIP session over a single encrypted port.  It works great through firewalls, and only requires one port to be opened.

[Philip D'Ath]

https://wiki.asterisk.org/wiki/display/AST/Secure+Calling+Tutorial

[skaljkovic]

Problem with no audio over VPN tunnel is solved.

Problem was in asterisk server configuration. I didn't know that I need to setup server too, I needed to allow new IP range.

Now we are left with same problem from internet access. I just tried it from smart phone with Zoiper software over 3G network to call in local phone and it rang but there is only one way audio.