SIP Supported Deployment and NAT Support

Below is a list of supported SIP deployments. Hide or Static Network Address Translation (NAT) can be configured for phones and the proxy in the internal network. NAT status can be Hide, Static, or No-NAT.

	Deployment	No NAT	NAT for Internal Phones Hide/Static NAT	NAT for Proxy Static NAT
1	SIP Endpoint to Endpoint	Yes	Static NAT only	Not applicable
2	SIP Proxy in External Network	Yes	Yes	Not applicable
3	SIP Proxy to SIP Proxy	Yes	Yes	Yes
4	SIP Proxy in DMZ	Yes	Yes	Yes

SIP Proxy

SIP can use a Proxy (or Registrar). If there is more than one proxy device, signaling passes through one or more of them. After the call is set up, the media can pass from endpoint to endpoint directly, or through one or more of the proxies.


1	SIP Endpoint-to-Endpoint	Endpoint-to Endpoint: Phones communicate directly without a proxy. Static NAT can be configured for the phones on the internal side of the gateway.
2	SIP Proxy in External Network	Proxy in External Network: IP phones use the services of a proxy on the external side of the gateway. Enables the use of a proxy that is maintained by another organization. Configure Hide NAT, Static NAT, or no-NAT for the phones on the internal side of the gateway.
3	SIP Proxy-to-SIP Proxy	Proxy-to-Proxy: Each proxy controls a separate endpoint domain. Configure Static NAT for the internal proxy. Configure Hide NAT or Static NAT for the internal phones.
4	SIP Proxy in DMZ	Proxy in DMZ: The same proxy controls both endpoint domains. This makes it possible to provide proxy services to other organizations. Static NAT or no-NAT can be configured for the proxy. Hide NAT, Static NAT, or no NAT can be configured for the phones on the internal side of the gateway.
Manual NAT rules are only supported for proxies in DMZ deployments.

Notes:

Below are the following exceptions for using SIP with NAT:

NAT is not supported on IP addresses behind an external Check Point gateway interface.
Calls cannot be made from an external source to two endpoints on the trusted side of a gateway if only one of the endpoints is NAT enabled.
You can use Automatic NAT for other deployments.