Certificate based LGW behind NAT

[Bal_S]

We are trying to setup Certificate based LGW behind NAT. CUBE shows dial-peer keepalive active ad TLS connection established. But Control Hub shows SIP OPTIONs got no response from CUBE. We are seeing response to options go out from CUBE towards webex calling. One of the session at Cisco live 2023 mentioned support for setup behind NAT is coming soon. Anyone has done it or any suggestions?

[Bal_S]

Incase this helps anyone. We were able to get this cert based LGW register behind NAT and calling seems to be working too. This is a test setup for us so we are good, but for prod setup we will have to wait for Cisco support of this-which we got an update through our Cisco team is expected next month.

[Jonathan Schulenberg · Accepted solution]

This is a bad, fragile, idea; don’t do it - and for sure don’t put a production environment in an unsupported state until Cisco stupidly agrees to support this.
With that warning out of the way: you will need to configure a SIP profile that replaces the internal IP with the external NATed IP in every header and SDP line. Also, only static 1:1 NAT will ever work - not PAT/overload where the TCP/UDP change.

[Bal_S]

Thanks Jonathan. We will rethink our plan

I don't understand why Cisco has not yet updated docs after announcing support at Cisco live. MS Direct routing works well behind NAT, we expected this works too. Registration based LGW will not work for us with max limit of 250 calls. We also don't see docs or support for multiple registration based LGW on single CUBE  (which was also announced at Cisco Live).