SIP Invite messages address translation.

[hcampuzano]

Hello Checkmates.

As the subject mention, I'd like to ask you if the firewall is capable to translate the destination address in a SIP Invite message from an External IP address to a private one.

A VoIP service provider is hosted online, and it need to reach a call manager inside our network. To do so, a NAT needed to be create and I was requested to create it.

I already did, I created the Static NAT rules and reverse ARP. The NAT is working as the firewall logs show the translation happening both ways.

However, in the call manager some logs were capture indicating that the SIP INVITE message is invalid, as it points to the public IP address.

Could anyone please advise?

[PhoneBoy · Accepted solution]

See: https://support.checkpoint.com/results/sk/sk95369 
NAT (and the limitations thereon) are covered there.

[hcampuzano]

The problem was solved by not defining special Network objects to allow SIP signaling, but using regular Network objects on the access rule.

Thanks for sharing the SK.

[the_rock]

Good job! 👍

[the_rock]

I would say contact TAC if that sk does not help you.

Andy