Inspecting VoIP Traffic

Introduction

Voice over Internet Protocol (VoIP) is a technology to deliver voice communications and multimedia sessions over Internet Protocol (IP) networks, such as the Internet. There are two primary delivery methods: private or on-premises solutions, or externally hosted solutions delivered by third-party providers.

Inspection of VoIP traffic is supported on all Quantum Spark appliances.

To configure VoIP inspection in the WebUI:

1. Go to Access Policy > VoIP.

2. Click On.

   If VoIP is already configured, you can edit the current configuration.

3. For the next sections, click the downward arrow to expand.

4. Click the Off-premise SIP Provider Service heading to expand the section.

   Configure the applicable settings:

   1. Click the checkbox for Use SIP Provider – The available network objects are shown in a table with a Group name. You can select a single IP or a range of servers with external IP address.

   2. To add a new IP address, click New. To remove an IP address, select it and click Remove.

   3. Select whether to Log traffic from this provider.

   4. Select whether to Disable SIP traffic inspection. When this setting is enabled, application level inspection and NAT of the SIP Protocol is allowed.

      When you disable SIP inspection:

      • You must define the RTP ports manually.

      • The SIP service timeout is extended (see Advanced Settings - VoIP Extend SIP service timeout).The SIP_UDP service's timeout is set to the default TCP connection timeout.

   5. Select to Enable bidirectional traffic when the SIP provider is defined. This allows bidirectional traffic with the SIP service provider.

      If the service does not accept replies, bidirectional traffic is not established. A popup window opens and asks if you want to continue.

5. Click the On-premise Devices heading to expand the section.

   The network objects appear in a table, with a Group name.

   Click New to add an item.

   Select an item and click Remove to delete it.

   Configure the applicable settings.

   • Use on-premise phones without SIP server (PBX).

     When no SIP Server Provider is defined, you do not need to define IP addresses for on-premise phones.

   • Allow access to PBX management portal from the Internet.

6. Click the Off-premise phones to expand the section.

   Note - The relevant topology shows automatically for each selection.

   Select one or more of these options:

   • Phones are connected via VPN Site to Site.

   • Phones are connected by VPN Remote Access.

   • Phones are configured with public IP.

     The network objects appear in a table, with a Group name.

     Click New to add an item.

     Select an item and click Remove to delete it.

7. Click the SIP Service heading to expand the section.

   Select the SIP UDP/TCP ports, which by default are 5060.

   All phones should be configured to use the configured ports.

   Click New to add a new SIP service.

   Click Remove to delete a service.