SIP Trunk (outgoing) without SBC 1

[ayking]

Hi,

Would it be ok if we set up SIP trunk for outgoing calls without a SBC for an IPO 500 V2 on 9.0.4 behind a firewall, assuming we make the following settings:
- Firewall access control only allow communications between ITSP SIP server IP and the public IP
- Port forward only 5060, 5061 and RTP port ranges

We'd really like to avoid the added cost of SBC without sacrificing too much security.

Thanks in advance!

 

[Westi]

that and also only make an IP route to the ITSP in the IP Office so that any other packets coming in will not be answered. No 0.0.0.0 IP route
Most people don't want to buy an SBC as soon as they see the price tag.


Joe W.

FHandw, ACSS (SME), ACIS (SME)


“This is the end of the world, make sure to buy your T-shirt before it is too late"
Original expression of my daughter

 

[amriddle01]

Good SIP trunks don't need any port forwarding at all, so it's completely behind NAT

 

[IPGuru]

+1 for Amriddle
this should not need any port forwarding on the router/firewall if you have a decent SIP Provider

A Maintenance contract is essential, not a Luxury.
Do things on the cheap & it will cost you dear

 

[ayking]

Thanks guys for the reply. I think I will arrange for a trial SIP trunk license from our BP. For testing I am thinking of using Anveo Direct, their call termination is by IP authorization and prefix in the SIP URI sent directly to them. I was confused and thought I still need RTP ports forwarded after the call is set-up.

Now to complicate things a bit, what if we want to have One-X Mobile in VoIP mode directly on Android? We have it in regular mode right now by just forwarding 2 ports (5222, 8444) forwarded to One-X UCM.

Possible solutions:
1. Open up 5060, 5061 & RTP ports to all traffic on existing interface (not preferred)
2. Open up non-standard UDP/TCP SIP ports and RTP ports to all traffic on existing interface
3. Open up non-standard UDP/TCP SIP ports and RTP ports to all traffic on a DMZ IP set-up on LAN2.
And of course the final one which is to drop external direct SIP access altogether.

For softphone and Flare experience on Windows laptop I have no problem asking the guys to VPN in first, just trying to avoid that on the mobile.

Thanks so much!