3

I have following scenario:

[VoIP phone]--------[ASA 5550]----------[SIP Server]
  • VoIP phone: 10.0.0.10
  • SIP server: Public Address

Question:

  1. In above scenario do i need to specify or open RTP port range 10000-20000 on ASA or does ASA will use pinhole method when VoIP phone initiate connection to SIP server?

  2. How does firewall handle UDP port stat? because in TCP we know its stateful but how does firewall understand its UDP traffic initiated from inside to outside to keep that port open bi-directional traffic?

  3. If i enable SIP Inspection does that automatically open RTP media port after SDP inspection in INVITE?

  4. what if i do not enable SIP Inspection in that case do i need to open full RTP port range to allow outside to inside traffic?

Improve this question
3
  • We do have STUN/TURN but here question is related to allow RTP port traffic on firewall.
    – Satish
    Commented Feb 22, 2017 at 21:44
  • With SIP inspection enabled, ASA will automatically create the necessary pinholes, without inspection you need to explicitly open all required ports. For UDP, the firewall considers a 'pseudo session' where all UDP packets with same src/dst address and port belong to a session, until no more packets are seen for a certain time, then the session times out and is considered closed.
    – hertitu
    Commented Feb 23, 2017 at 13:43
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide your own answer and accept it.
    – Ron Maupin ♦
    Commented Aug 6, 2017 at 22:49

1 Answer 1

Reset to default
1

Assuming that your VOIP phone is on remote site and you are connected to firewall through VPN(IKEv1 or IKEv2) connection. Your end terminal is able to reach SIP server on some port 5060,5061 or any other port and successfully registers itself with SIP server.

Then, I think you do not need to explicitly open port for SIP and RTP messages as ASA will automatically create necessary pinholes.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.