Updated May 2015
Notes
- A SIP ALG is turned on automatically when NAT is enabled as of IOS version 12.2(8).
- We discovered the SIP ALG to be broken in 12.4(20)T, but an upgrade to 12.4(24)T2 resolved the issue. We have also successfully tested 12.4(15)T9.
Router Configuration
Step 1: Start fresh. The 1800 series ships with a number of preconfigured options that are unnecessary to a basic setup, so the first thing we did was "write erase" and "reload".
Step 2: Configure the DHCP pool for the private network:
ip dhcp pool POOLNAME
network 10.10.10.0 255.255.255.0
default-router 10.10.10.1
domain-name yourdomain.com
dns-server 1.1.1.1 2.2.2.2
lease 0 2
Step 3: Configure the NAT pool and allow the private network to access it:
access-list 23 permit 10.10.10.0 0.0.0.255
ip nat pool NATPOOL 6.7.8.9 6.7.8.9 netmask 255.255.255.0
ip nat inside source list 23 pool NATPOOL overload
(6.7.8.9 is our imaginary public IP that was assigned by our ISP)
Step 4: Configure the WAN interface and configure it for NAT:
interface FastEthernet4
ip address 6.7.8.9 255.255.255.0
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
Step 5: Set up a default route to our ISP's gateway:
ip route 0.0.0.0 0.0.0.0 6.7.8.1
Ping your favorite Internet host to test connectivity.
Step 6: Create a VLAN interface for the private network and configure it for NAT:
interface Vlan1
ip address 10.10.10.1 255.255.255.0
ip nat inside
ip virtual-reassembly
Step 7: Assign your switch port interfaces to your VLAN:
interface FastEthernet0
switchport mode access
switchport access vlan 1
(repeat for any further switchport interfaces required)
Troubleshooting
At this point, your phones should be up and running without having to do anything further. However, if you experience difficulties and need to debug further, you can explicitly set up a SIP firewall, which will allow you to see SIP traffic more clearly. Please note that debugging is resource intensive and will affect performance of the router.
To set up the SIP firewall, at the global config, type:
ip inspect name VOIP sip
And then on your VLAN interface, type:
ip inspect VOIP in
This will give you access to some useful tools, such as:
show ip inspect all
show ip inspect sessions
show ip inspect statistics
debug ip inspect protocol sip
debug ip inspect protocol sessions
We also found the following commands helpful for debugging:
show ip nat translations udp verbose
debug ip cef packet all input 23 rate 0
debug ip packet 23 detail
NOTE: The information provided above is from another OnSIP customer offering these settings for other customers with a similar device. OnSIP does not sell nor monitor equipment and/or it’s firmware updates/etc. The settings of routers can change and are out of the control of OnSIP. For best results, reach out to the manufacturer directly.
Optimize your network for business VoIP with the right router
Comments