Cisco 7800 Series Administration Manual page 60

SIP and NAT Configuration
Configure NAT mapping with STUN
If the service provider network does not provide a Session Border Controller functionality and if the other
requirements are met, it is possible to use Session Traversal Utilities for NAT (STUN) to discover the NAT
mapping. The STUN protocol allows applications operating behind a network address translator (NAT) to
discover the presence of the network address translator and to obtain the mapped (public) IP address (NAT
addresses) and the port number that the NAT has allocated for the User Datagram Protocol (UDP) connections
to remote hosts. The protocol requires assistance from a third-party network server (STUN server) located on
the opposing (public) side of the NAT, usually the public Internet. This option is considered a last resort and
should be used only if the other methods are not available. To use STUN:
• The router must use asymmetric NAT . See
• A computer running STUN server software is available on the network. You can also use a public STUN
server or set up your own STUN server.
Procedure
Step 1 In the phone web user interface, navigate to Admin Login > advanced > Voice > SIP.
Step 2
In the NAT Support Parameters section, set Handle VIA received, Insert VIA received,Substitute VIA
Addr, Handle VIA rport, Insert VIA rport, Send Resp To Src Port fields to Yes.
Step 3 In the NAT Support Parameters section, set STUN Enable field to Yes.
Step 4
Enter the IP address for your STUN server in the STUN Server field.
Step 5 Click the Ext(n) tab.
Step 6 In the NAT Settings section, set NAT Mapping Enable to Yes.
Step 7 (Optional) Set NAT Keep Alive Enable to Yes.
The service provider might require the phone to send NAT keep alive messages to keep the NAT ports open.
Check with your service provider to determine the requirements.
Step 8 Click Submit All Changes.
What to Do Next
Configure the firewall settings on your router to allow SIP traffic.
Determining Symmetric or Asymmetric NAT
STUN does not work on routers with symmetric NAT. With symmetric NAT, IP addresses are mapped from
one internal IP address and port to one external, routable destination IP address and port. If another packet is
sent from the same source IP address and port to a different destination, a different IP address and port number
combination is used. This method is restrictive because an external host can send a packet to a particular port
on the internal host only if the internal host first sent a packet from that port to the external host.
This procedure assumes that a syslog server is configured and is ready to receive syslog messages.
To Determine Whether the Router Uses Symmetric or Asymmetric NAT:
Cisco IP Phone 7800 Series for Third-Party Call Control Administration Guide
46
Determining Symmetric or Asymmetric NAT, on page 46