SonicWALL 3 manual Configuring the VoIP Settings, SIP Settings, 195

Firewall > VoIP

Configuring the VoIP Settings

The SonicWALL security appliance allows VoIP phone and applications to be deployed behind the firewall. The Firewall > VoIP page includes the settings for supporting VoIP traffic on the SonicWALL security appliance.

SIP Settings

This section provides configuration tasks for SIP Settings.

•Enable SIP Transformations - This setting transforms SIP messages between LAN (trusted) and WAN (untrusted). You need to check this setting when you want the SonicWALL to do the SIP transformation. If your SIP proxy is located on the public (WAN) side of the SonicWALL and SIP clients are on the LAN side, the SIP clients by default embed/use their private IP address in the SIP/Session Definition Protocol (SDP) messages that are sent to the SIP proxy, hence these mes- sages are not changed and the SIP proxy does not know how to get back to the client behind the SonicWALL. Selecting Enable SIP Transformations enables the SonicWALL to go through each SIP message and change the private IP address and assigned port. Enable SIP Transformation also controls and opens up the RTP/RTCP ports that need to be opened for the SIP session calls to happen. NAT translates Layer 3 addresses but not the Layer 7 SIP/SDP addresses, which is why you need to select Enable SIP Transformations to transform the SIP messages. It's recom- mended that you turn on Enable SIP Transformations unless there is another NAT traversal solu- tion that requires this feature to be turned off. SIP Transformations works in bi-directional mode and it transforms messages going from LAN to WAN and vice versa.

•Permit non-SIP packets on signalling port - This checkbox is disabled by default. Select this checkbox for enabling applications such as Apple iChat. Enabling this checkbox may open your network to malicious attacks caused by malformed or invalid SIP traffic.

•SIP Signalling inactivity time out (seconds) - This field has a default value of 1200 seconds (20 minutes).

•SIP Media inactivity time out (seconds) - This field has a default value of 120 seconds (2 minutes).

H.323 Settings

This section provides configuration tasks for H.323 Settings.

•Enable H.323 Transformation - Select this option to allow stateful H.323 protocol-aware packet content inspection and modification by the SonicWALL. The SonicWALL performs any dynamic IP address and transport port mapping within the H.323 packets, which is necessary for communica- tion between H.323 parties in trusted and untrusted networks/zones. Clear the Enable H.323 Transformation to bypass the H.323 specific processing performed by the SonicWALL.

•H.323 Signalling/Media inactivity time out (seconds) - This field has a default value of 300 seconds (5 minutes). This is a similar setting to the “TCP connection inactivity timeout.”

SONICWALL SONICOS STANDARD 3.0 ADMINISTRATOR’S GUIDE 195