4

After talking to a few hosted VoIP providers, they all state that "ALG" or SIP inspection in the case of the Cisco firewall should be disabled. How is SIP not broken after leaving the firewall over the public Internet when being NAT'd from a private to public address if the SIP payload contains a private address that inspection would normally fixup -- using the older inspection terminology there ;-) ? Is STUN or TURN the only way preventing this breakage and can I assume that these providers support that or does that have to be confirmed? Is it not better to have inspection? I know that certain SIP implementations don't add addressing in the application layer, but in the these cases they do.

I have SIP inspection enabled and don't see any issues with it and I gain the benefit of not only being able to do a show SIP but the necessary pinholes are dynamically created instead of opening wide static holes these providers often request, but the providers still insist having ALG creates more problems.

Improve this question
1
  • I can't speak to a hosted system but I have configured a SIP trunk through an ASA 5505 with no problems and no need to disable any fixups, as I also still like to call them. If you're in the process of selecting a hosted VoIP product/vendor, you could try asking to talk to an engineer/pre-sales support and see if you can get definitive answers on ASA interoperability. That might be a good way to weed out poorer vendors.
    – Todd Wilcox
    Commented Jul 13, 2015 at 12:05

2 Answers 2

Reset to default
3

We had problems using "ALG" or SIP inspection using SIP clients. The problem was the ASA was keeping sessions open when the call was terminated.

What was happening was the when we made a second call we had no voice over the call.

note: We haven't had problems with the provider that was providing voip for our SIP trunk's.

But... The moment we disabled the SIP inspection in total on the ASA, all SIP clients where working perfectly and registration to our own sip server was restored much faster if we had a network disconnect of somekind.

Also i did lots of research in this on the web and everywhere you see to disable the SIP inspection. I have tried to find a workaround or tune the inspection but nothing worked as good as just disabling the inspection.

Maybe this is not the best answer but couldnt comment yet(just signed up) and maybe my reaction can help in somekind of way.

Improve this answer
0

The advice to disable SIP-ALG is based on not all SIP-ALG routines are actually any good. Normally a VoIP provider terminates Voice traffic on a SBC and has provided fix-ups in the SBC in the form of a regex stripping the internal Private IP address and replacing it with the Public one inside the SIP-Headers. The SIP-ALG tries to do the same but without knowledge of the SIP Server in this case. Better let the VoIP provider handle this and disable SIP-ALG.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.