Configuring the SIP Proxy in the Private Zone

With the SIP proxy server in the internal, or private, zone, static NAT on the interface to the external, or public, zone is sufficient to allow callers in the public zone to register with the proxy server.

Before You Begin
For background information, read Understanding the SIP ALG SIP ALG Request Methods Overview Understanding SIP with Network Address Translation (NAT) Understanding Incoming SIP Call Support Using the SIP Registrar

In this example, phone1 and the SIP proxy server are on the ge-0/0/0 interface in the private zone, and phone2 is on the ge-0/0/2 interface in the public zone. You configure static NAT on the ge-0/0/2 interface to the proxy server to allow phone2 to register with the proxy, then create a policy allowing SIP traffic from the public to the private zone to enable callers in the public zone to register with the proxy, and a policy from the private to the public zone to allow phone1 to call out. See Figure 79.

CLI Configuration

Configure interfaces.


                  
                     user@host# set interfaces ge-0/0/0 unit 0 family inet
                           address 10.1.1.1/24
                     user@host# set interfaces ge-0/0/2 unit 0 family inet
                           address 1.1.1.1/24

Configure zones.


                  
                     user@host# set security zones security-zone private
                     user@host# set security zones security-zone public
                     user@host# set security zones security-zone private
                           interfaces ge-0/0/0.0
                     user@host# set security zones security-zone public
                           interfaces ge-0/0/2.0

Configure addresses.


                  
                     user@host# set security zones security-zone private
                           address-book address phone1 10.1.1.3/32
                     user@host# set security zones security-zone private
                           address-book address proxy 10.1.1.4/32
                     user@host# set security zones security-zone public
                           address-book address phone2 1.1.1.4/32

Configure static-NAT.


                  
                     user@host# set security nat interface ge-0/0/2.0 static-nat
                           1.1.1.2/32 host 10.1.1.4/32

Configure policies.


                  
                     user@host# set security policies from-zone private
                           to-zone public policy outgoing match source-address any
                     user@host# set security policies from-zone private to-zone
                        public policy outgoing match destination-address phone2
                     
                     user@host# set security policies from-zone private
                           to-zone public policy outgoing match application junos-sip
                     user@host# set security policies from-zone private
                           to-zone public policy outgoing then permit source-nat interface
                     user@host# set security policies from-zone public to-zone
                           private policy incoming match source-address phone2
                     user@host# set security policies from-zone public to-zone
                           private policy incoming match destination-address static_nat_1.1.1.2_32
                     user@host# set security policies from-zone public to-zone
                           private policy incoming match application junos-sip
                     user@host# set security policies from-zone public to-zone
                           private policy incoming then permit

CLI Configuration

Related Topics