D-Link DFL-260E User Manual page 275

6.2.8. The SIP ALG
sends its own IP address as contact information to the SIP proxy. NetDefendOS registers the
client's local contact information and uses this to redirect incoming requests to the user. The
ALG takes care of the address translations needed.
4. Ensure the clients are correctly configured. The SIP Proxy Server plays a key role in locating
the current location of the other client for the session. The proxy's IP address is not specified
directly in the ALG. Instead its location is either entered directly into the client software used
by the client or in some cases the client will have a way of retrieving the proxy's IP address
automatically such as through DHCP.
The IP rules with the Record-Route option enabled would be as shown below, the changes that
apply when NAT is used are shown in parentheses "(..)".
Action
Allow
(or NAT)
Allow
Without the Record-Route option enabled the IP rules would be as shown below, the changes that
apply when NAT is used are again shown in parentheses "(..)".
Action
Allow
(or NAT)
Allow
The advantage of using Record-Route is clear since now the destination network for outgoing traffic
and the source network for incoming traffic have to include all IP addresses that are possible.
Scenario 2
Protecting proxy and local clients - Proxy on the same network as clients
In this scenario the goal is to protect the local clients as well as the SIP proxy. The proxy is located
on the same, local network as the clients, with SIP signalling and media data flowing across two
interfaces. This scenario is illustrated below.
Note: NAT traversal should not be configured
SIP User Agents and SIP Proxies should not be configured to employ NAT Traversal
in any setup. For instance, the Simple Traversal of UDP through NATs (STUN)
technique should not be used. The NetDefendOS SIP ALG will take care of all
traversal issues with NAT in a SIP setup.
Src Interface
lan
wan
Src Interface
lan
wan
The Service object for IP rules
In this section, tables which list IP rules like those above, will omit the Service object
associated with the rule. The same, custom Service object is used for all SIP scenarios.
Src Network Dest Interface
lannet
ip_proxy
(or core)
Src Network Dest Interface
lannet
<All possible IPs>
(or core)
275
Chapter 6. Security Mechanisms
Dest Network
wan ip_proxy
lan lannet
(or wan_ip)
Dest Network
wan <All possible IPs>
lan lannet
(or ipwan)