Configuring Interface Source NAT for Incoming SIP Calls

In a two-zone scenario with the SIP proxy server in an external, or public zone, you can use NAT for incoming calls by configuring source NAT on the interface to the public zone.

Before You Begin
For background information, read Understanding the SIP ALG SIP ALG Request Methods Overview Understanding SIP with Network Address Translation (NAT) Understanding Incoming SIP Call Support Using the SIP Registrar

In this example, phone1 is on the ge-0/0/0 interface in the private zone, and phone2 and the proxy server are on the ge-0/0/2 interface in the public zone. You configure interface source NAT on ge-0/0/2.0 for incoming calls, then create a policy permitting SIP traffic from the public zone to the private zone and reference the source NAT in the policy. You also create a policy that permits SIP traffic from the private to the public zone, again referencing the source NAT address pool. This enables phone1 in the private zone to register with the proxy in the public zone. See Figure 76.

To configure interface source NAT for incoming calls, use either the J-Web or the CLI configuration editor.

CLI Configuration

Configure interfaces.


                  
                     user@host# set interfaces ge-0/0/0 unit 0 family inet
                           address 10.1.1.1/24
                     user@host# set interfaces ge-0/0/2 unit 0 family inet
                           address 1.1.1.1/24
                     user@host# set security zones security-zone private
                           interface ge-0/0/0.0

Configure addresses.


                  
                     user@host# set security zones security-zone private
                           address-book address phone1 10.1.1.3/32
                     user@host# set security zones security-zone public
                           address-book address proxy 10.1.1.3/32
                     user@host# set security zones security-zone public
                           address-book address phone2 1.1.1.4/32

Configure zones.


                  
                     user@host# set security zones security-zone private
                     user@host# set security zones security-zone public
                     user@host# set security zones security-zone private
                           interfaces ge-0/0/0.0
                     user@host# set security zones security-zone public
                           interfaces ge-0/0/2.0

Configure source NAT.


                  
                     user@host# set security nat interface ge-0/0/2.0 source-nat
                           allow-incoming
                     user@host# set security nat source-nat address-persistent

Configure policies.


                  
                     user@host# set security policies from-zone private
                           to-zone public policy outgoing match source-address phone1 destination-address
                           any application junos-sip
                     user@host# set security policies from-zone private
                           to-zone public policy outgoing then permit source-nat interface
                     user@host# set security policies from-zone public to-zone
                           private policy incoming match source-address any destination-address
                           incoming-nat-fe0/0/2.0 application junos-sip
                     user@host# set security policies from-zone public to-zone
                           private policy incoming then permit

CLI Configuration

Related Topics