Table of Contents
Advertisement
where the packets should be sent without prior knowl-
edge about what is going on.
Some vendors are working on a firewall control proto-
col that tells the NAT gateway, which ports it should
associate with what computer. However, the standard
is not finalized yet.
Therefore, the approach for solving this problem is to
use a application layer gateway, that looks at the SIP
packets and changes them in a way, that the destina-
tion can use them. If media channels are proposed,
the gateway opens tunnels accordingly, so that the
RTP packets are forwarded to the right destination.
Message Flow
SIP uses proxies for forwarding messages. Stateless
proxies just forward packets without knowing the
complete context the messages are in. By putting a
stateless proxy on the NAT gateway, the messages
can easily be modified to meet the requirements on an
application layer SIP NAT gateway.
SIP URLs contain a user and a host part, e.g.
sip:user@host.com. The user name can be used to
encapsulate the private address which is not visible
from the outside world. For example, if the NAT gate-
way is located on the computer nat.company.com, the
private SIP address usera@192.168.1.2 becomes
usera%40192.168.1.2@nat.company.com
(the
@
becomes %40, so that there is no ambiguity). If the
NAT gateway receives a message for the encapsuled
address, it just strips its hostname and uses the ad-
dress given in the user name.
The SIP NAT gateway just checks if the message is
supposed to be sent to the Internet side or the NAT
side. It then patches the messages headers according
to the encapsulation rules and sends the message.
It also looks at the session descriptions (SDP) which
may be part of the SIP messages. If a port is adver-
tised, it opens a tunnel for the RTP connection which
forwards the RTP packets on arrival to the right desti-
nation.
6
Advertisement
Table of Contents
