Inspecting VoIP Traffic

Introduction

Voice over Internet Protocol (VoIP) is a technology to deliver voice communications and multimedia sessions over Internet Protocol (IP) networks, such as the Internet. There are two primary delivery methods: private or on-premises solutions, or externally hosted solutions delivered by third-party providers.

Inspection of VoIP traffic is supported on all Quantum Spark appliances.

To configure VoIP inspection in the WebUI:

1. Go to Access Policy > VoIP.

2. Click On.

   If VoIP is already configured, you can edit the current configuration.

3. For the next sections, click the downward arrow to expand.

4. Click the Off-premise SIP Provider Service heading to expand the section.

   Configure the applicable settings:

   1. Click the checkbox for Use SIP Provider – The available network objects are shown in a table with a Group A collection of objects, such as user accounts, with shared attributes. name. You can select a single IP or a range of servers with external IP address.

   2. To add a new IP address, click New. To remove an IP address, select it and click Remove.

   3. Select or clear the option Log traffic from this provider.

   4. Select or clear the option Disable SIP traffic inspection.

      When you select this option, you allow the application level inspection and NAT for the SIP traffic.

      When you clear this option:

      • You must configure the RTP ports manually.

      • The timeout for UDP SIP connections (the "SIP_UDP" service) is the same as the default timeout for TCP SIP connections (the "SIP_TCP" service).

        Note - In the R81.10.X releases, this feature is available starting from the R81.10.05 version.

   5. Select to Enable bidirectional traffic when the SIP provider is defined. This allows bidirectional traffic with the SIP service provider.

      If the service does not accept replies, bidirectional traffic is not established. A popup window opens and asks if you want to continue.

5. Click the On-premise Devices heading to expand the section.

   The network objects appear in a table, with a Group name.

   Click New to add an item.

   Select an item and click Remove to delete it.

   Configure the applicable settings.

   • Use on-premise phones without SIP server (PBX).

     When no SIP Server Provider is defined, you do not need to define IP addresses for on-premises phones.

   • Allow access to PBX management portal from the Internet.

6. Click the Off-premise phones to expand the section.

   Note - The relevant topology shows automatically for each selection.

   Select one or more of these options:

   • Phones are connected via VPN Site to Site.

   • Phones are connected by VPN Remote Access.

   • Phones are configured with public IP.

     The network objects appear in a table, with a Group name.

     Click New to add an item.

     Select an item and click Remove to delete it.

7. Click the SIP Service heading to expand the section.

   Select the SIP UDP/TCP ports, which by default are 5060.

   All phones should be configured to use the configured ports.

   Click New to add a new SIP service.

   Click Remove to delete a service.