Internet Communications Using SIP : Delivering VoIP and Multimedia Services With Session Initiation Protocol {2Nd Ed.}

Figure 10.4 SIP ALG for firewall traversal

The other alternative to an ALG, which proxies both the signaling and
media, is to use a SIP firewall proxy that communicates with the firewall or
NAT. The firewall proxy performs any authentication, authorization, and so
on, and then parses the SIP messages for the source and destination IP
addresses and port numbers of the RTP packets. For example, the source and
destination IP addresses and port numbers can be obtained from the SDP in
the INVITEand 200 OKmessages. The firewall proxy then tells the firewall to
open pinholes to let only those RTP packets pass. The firewall proxy also main-
tains the NAT address binding, and modifies the SDP accordingly so that the
RTP packets can be sent directly between the UAs. Upon session termination
with a BYE, the firewall proxy tells the firewall to close the pinholes and the
NAT to remove the address binding. There is currently no standard protocol
for communication between the SIP proxy and the firewall/NAT.
For these types of firewall traversal to work, the Contactheader of the UA
behind the firewall either must be set by the UA to resolve to the IP address of
the ALG or firewall proxy, or the ALG or firewall proxy must Record-Route.
A proxy inserts a Record-Routeheader containing an entry that resolves

1 INVITE sdp A

3 100 Trying

5 180 Ringing

2 INVITE sdp ALG

9 ACK

Firewall permits

SIP and RTP

signaling to the

ALG proxy only -

all other SIP and

RTP packets are

blocked.

Also works for

NAT traversal

4 180 Ringing

8 ACK

10 BYE

Media Session

No More Media Session

Media Session

7 200 OK sdp ALG

13 200 OK

6 200 OK sdp B

11 BYE

12 200 OK

Client SIP ALG Firewall Server

NAT and Firewall Traversal 181