D-Link DFL-260E User Manual page 274

6.2.8. The SIP ALG
The SIP proxy in the above diagram could alternatively be located remotely across the Internet. The
proxy should be configured with the Record-Route feature enabled to insure all SIP traffic to and
from the office clients will be sent through the SIP Proxy. This is recommended since the attack
surface is minimized by allowing only SIP signalling from the SIP Proxy to enter the local network.
This scenario can be implemented in two ways:
• Using NAT to hide the network topology.
• Without NAT so the network topology is exposed.
The setup steps for this scenario are as follows:
1. Define a SIP ALG object using the options described above.
2. Define a Service object which is associated with the SIP ALG object. The service should have:
• Destination Port set to 5060 (the default SIP signalling port).
• Type set to TCP/UDP.
3. Define two rules in the IP rule set:
• A NAT rule for outbound traffic from clients on the internal network to the SIP Proxy
Server located externally. The SIP ALG will take care of all address translation needed by
the NAT rule. This translation will occur both on the IP level and the application level.
Neither the clients or the proxies need to be aware that the local users are being NATed.
• An Allow rule for inbound SIP traffic from the SIP proxy to the IP of the NetDefend
Firewall. This rule will use core (in other words, NetDefendOS itself) as the destination
interface. The reason for this is due to the NAT rule above. When an incoming call is
received, NetDefendOS will automatically locate the local receiver, perform address
translation and forward SIP messages to the receiver. This will be executed based on the
ALGs internal state.
A SAT rule for translating incoming SIP messages is not needed since the ALG will
automatically redirect incoming SIP requests to the correct internal user. When a SIP client
behind a NATing NetDefend Firewall registers with an external SIP proxy, NetDefendOS
Note: NAT traversal should not be configured
SIP User Agents and SIP Proxies should not be configured to employ NAT Traversal
in any setup. For instance the Simple Traversal of UDP through NATs (STUN)
technique should not be used. The NetDefendOS SIP ALG will take care of all NAT
traversal issues in a SIP scenario.
274
Chapter 6. Security Mechanisms