VOIP Phone Behind NAT?

[Anthony.Herman]

ip nat pool IP_PHONE_PF 192.168.111.118 192.168.111.118 netmask 255.255.255.0 type rotary

ip access-list extended Udp_Ranges__IP_Phone

permit udp any any 20001

permit udp any any 50100

permit udp any any range 50098 50508

permit udp any any range 5004 7117

permit tcp any any range 6800 6802

permit tcp any any range 3998 3999

permit tcp any any range 5566 5567

ip nat inside destination list Udp_Ranges__IP_Phone pool IP_PHONE_PF

Will this work?

[Anthony.Herman]

Is there any 'best practice' for implementing VOIP behind a NAT if it is absolutely necessary?

[William Bell]

Paolo,

Just because someone is doing NAT doesn't mean that the phones are exposed to the internet. The OP hasn't stated the "why" and making broad assumptions is not very helpful. One valid scenario is hosted UCM.

Anthony,

You are going to need to do some research and testing on this one. I'd recommend looking at NAT and ALG references in the Cisco UC SRND. I would also take a look at this (somewhat dated) document:

https://supportforums.cisco.com/docs/DOC-8131

Example config guide (your mileage may vary based on version): http://www.cisco.com/en/US/docs/ios-xml/ios/ipaddr_nat/configuration/15-0s/iadnat-applvlgw.html

Another reference to start with that is a Q&A for NAT (again, a little dated):

http://www.cisco.com/en/US/tech/tk648/tk361/technologies_q_and_a_item09186a00800e523b.shtml#voice-nat

You'll want to start with the above docs and do some additional research to account for any version changes.

-Bill (@ucguerrilla)