The exchanges illustrated are as follows:
•
1,2 - An initial INVITE is sent to the outbound local proxy server on the DMZ.
•
3,4 - The proxy server sends the SIP messages towards the destination on the Internet.
•
5,6 - A remote client or proxy server replies to the local proxy server.
•
7,8 - The local proxy forwards the reply to the local client.
This scenario can be implemented in a topology hiding setup with DMZ (Solution A below) as well
as a setup without NAT (Solution B below).
Solution A - Using NAT
The following should be noted about this setup:
•
The IP address of the SIP proxy must be a globally routable IP address. The NetDefend Firewall
does not support hiding of the proxy on the DMZ.
•
The IP address of the DMZ interface must be a globally routable IP address. This address can be
the same address as the one used on the external interface.
The setup steps are as follows:
1.
Define a single SIP ALG object using the options described above.
2.
Define a Service object which is associated with the SIP ALG object. The service should have:
•
Destination Port set to 5060 (the default SIP signalling port)
•
Type set to TCP/UDP
3.
Define four rules in the IP rule set:
•
A NAT rule for outbound traffic from the clients on the internal network to the proxy
located on the DMZ interface. The SIP ALG will take care of all address translation needed
by the NAT rule. This translation will occur both at the IP level and at the application level.
Note
Clients registering with the proxy on the DMZ will have the IP address of the
6.2.8. The SIP ALG
Chapter 6. Security Mechanisms
278
Содержание NetDefend DFL-260E
Страница 27: ...1 3 NetDefendOS State Engine Packet Flow Chapter 1 NetDefendOS Overview 27...
Страница 79: ...2 7 3 Restore to Factory Defaults Chapter 2 Management and Maintenance 79...
Страница 146: ...3 9 DNS Chapter 3 Fundamentals 146...
Страница 227: ...4 7 5 Advanced Settings for Transparent Mode Chapter 4 Routing 227...
Страница 241: ...5 4 IP Pools Chapter 5 DHCP Services 241...
Страница 339: ...6 7 Blacklisting Hosts and Networks Chapter 6 Security Mechanisms 339...
Страница 360: ...7 4 7 SAT and FwdFast Rules Chapter 7 Address Translation 360...
Страница 382: ...8 3 Customizing HTML Pages Chapter 8 User Authentication 382...
Страница 386: ...The TLS ALG 9 1 5 The TLS Alternative for VPN Chapter 9 VPN 386...
Страница 439: ...Figure 9 3 PPTP Client Usage 9 5 4 PPTP L2TP Clients Chapter 9 VPN 439...
Страница 450: ...9 7 6 Specific Symptoms Chapter 9 VPN 450...
Страница 488: ...10 4 6 Setting Up SLB_SAT Rules Chapter 10 Traffic Management 488...
Страница 503: ...11 6 HA Advanced Settings Chapter 11 High Availability 503...
Страница 510: ...12 3 5 Limitations Chapter 12 ZoneDefense 510...
Страница 533: ...13 9 Miscellaneous Settings Chapter 13 Advanced Settings 533...