Use VoIP ALG Settings

Configuring the VoIP ALG Settings

This section outlines how to configure the VoIP ALG settings.

1. Choose VoIP from the Configuration menu.
   
   

2. Configure settings using the information in the following table as a guide. When you have finished configuring settings, click Submit to make your changes take effect.

   VoIP ALG Parameters

   Item	Description
   Enable ALG Multi-VLAN support	Select the Enable ALG Multi-VLAN support checkbox to support Multiple VLANs with a certificate for VLANs. This option is visible only if the Enable VLAN support is enabled in the Network page.
   ALG LAN using VLAN ID	If VLAN support is enabled, you must select a VLAN for the ALG to support. Choose an option from the ALG LAN using the VLAN ID drop-down list. Voice traffic on the selected VLAN will be processed via the SIP ALG instead of going through the standard layer 3 NAT process. This option is visible only if the Enable VLAN support is enabled in the Network page.
   Enable LLDP	When selected, the Edgemarc will advertise the ALG LAN VLAN to connected voice devices.
   LLDP Broadcast Interval	Enter the interval in seconds between each LLDP frame information broadcast.
   TFTP server IP address	Enter the TFTP IPv4 server address to allow the system to act as a TFTP server providing subsequent configuration information to other VoIP phones or devices.
   ALG Settings
   Use ALG Alias IP Address	Select the Enable ALG IP Addressing checkbox and choose one of the following based on your system configuration: • ALG LAN Interface IP Address (IPv4) • ALG LAN Interface IPv6 Address • ALG WAN Interface IP Address (IPv4) • ALG WAN Interface IPv6 Address Note: In some cases, the ALG addresses do not correspond to the addresses of the LAN or the WAN ports. The addresses are alias addresses that have been configured on the ports. In general, you should leave this feature disabled.
   ALG LAN Interface IP Address	Enter the IPv4 address on the LAN that endpoints communicate with. Generally, this is the same as the LAN IP address.
   ALG LAN Interface IPv6 Address	Enter the IPv6 address on the LAN that endpoints communicate with.
   ALG WAN Interface IP Address	Enter the IPv4 address on the WAN that communicates with the softswitch. Generally, this is the same as the WAN IP address.
   ALG WAN Interface IPv6 Address	Enter the IPv6 address on the WAN that communicates with the softswitch.
   NAT Addressing Configure public and private NAT addressing.
   Public NAT WAN IP address	Enter the public IPv4 address the perimeter security appliance provides for static one-to-one mapping: Public NAT Subscriber IP address—The public IPv4 address that the perimeter security appliance provides for static one-to-one mapping. This allows incoming traffic to the public IP to be translated to the system internal IP. This is typically called a private demilitarized zone (DMZ) which allows devices in this DMZ to be configured with a private RFC 1918 address. The NAT configuration must be a Public IPv4 address configured for a one-to-one NAT translation without any port-mapping to the Video Border Proxy (VBP)-E internal DMZ WAN IPv4 address.
   Private NAT LAN IP address	Enter the private IPv4 address the perimeter security appliance provides for static one-to-one mapping. This allows incoming traffic to the private IP to be translated to the system internal IP. This is typically called a private DMZ which allows devices in this DMZ to be configured with a specific DMZ internal address. The NAT configuration must be an IPv4 address configured for a one-to-one NAT translation to the VBP-E internal DMZ LAN IPv4 address. Typically, this interface is not placed in a NAT environment but can be used in advanced security scenarios.
   Client and Media Settings
   Do strict RTP source check	Select the Do Strict RTP Source Check checkbox to protect against specific Real-time Transport Protocol (RTP)-based denial-of-service attacks and controls address network based gateways that periodically continue to send an RTP stream after a call ends. If the source of an inbound RTP stream does not match the IP address and port for an existing outbound RTP stream, it is assumed that the inbound stream is “rogue RTP.” When rogue RTP is detected, a syslog message is generated and the inbound stream is dropped.
   Enable Client List lockdown	Select the Enable Client List Lockdown checkbox to prevent new clients from registering. Note: You must first configure the Client List. Choose VoIP > Client List and refer to Configure the Clients List. Caution: Do not use Client List Lockdown and Allow Shared Usernames at the same time.
   Allow Shared Usernames	Select the Allow Shared Username checkbox to allow multiple clients to register using the same username. A new entry and a unique contact field are generated for each client. Caution: Do not use Client List Lockdown and Allow Shared Usernames at the same time; new phones using an existing username will not be added to the Clients List and will fail to work.
   Strip G.729 from calls	Select the Strip G.729 From Calls checkbox to improve codec compatibility for legacy and newer networks by removing all references to the G.729 in codec lists for calls made using SIP. The codecs in the signaling protocols are listed in the session description protocol (SDP). When you enable the G.729 feature, the codecs are removed from the SDP.
   SIP Port Settings Configure UDP, TCP and TLS related parameters for SIP. Refer to Configure SIP Port Settings.
   UDP System Port	Specifies the ports on which the system listens for SIP over UDP messages from SIP clients.  To specify multiple UDP ports, separate each port with a comma. Default is “5060,5070,5075.”
   REGISTER restricted to port	Specifies that REGISTER requests will only be processed on the specified port if set to a non-zero port number that matches one of the specified UDP Inbound ports. REGISTER messages sent to other SIP ports are logged and discarded without further processing. When set to zero, REGISTER requests are processed normally on all configured SIP ports and connections. Default is 0.
   UDP System Source Port	Specifies the source port to use when sending SIP over UDP messages to the SIP Server. The system also listens for SIP messages on this port, similar to the Client Listening Ports.  Default value is 5060.
   Block UDP support on WAN	When enabled, the system will not respond to UDP SIP messages received on the WAN interface.
   TCP System Port	Specifies the port on which this device will listen for SIP over TCP connection requests. Enter any valid TCP port. Default value is 5060.
   TCP Connection Timeout (m)	Sets the amount of inactive time. The system monitors all TCP connections and if there is no activity on any connection for a specified amount of time, that connection is closed. Minimum value is 4 minutes.
   Block TCP support on WAN	When enabled, the system will not respond to TCP SIP messages received on the WAN interface.
   TLS System Port	Specifies the port on which this device will listen for SIP over TLS connection requests. Enter any valid TCP port. The TLS port cannot be the same as the TCP port.
   TLS Protocol	Allows you to choose a TLS protocol. The following options are available: TLSv1.2: Allows only TLS protocol version 1.2 (RFC 5246) TLSv1.3: Allows only TLS protocol version 1.3 (RFC 8446)
   Use only selected version	When enabled, only the particular TLS protocol that is selected can be used without supporting the higher versions.
   Ciphers String	Adds or restricts the cipher suites offered by this device during a TLS handshake. See Ciphers for detailed description of the format for this string.
   LAN Certificate	The X.509 certificate for the interface in PEM format. The certificates are loaded using the Security > Certificates page. Make sure that the common name (CN) in the certificate matches the domain name or IP of the interface.
   LAN Policy	Peer certificate verification policy: No check — The peer certificate is not verified. Verify if provided — Send a client certificate request to clients but continue handshake if the client does not return a certificate. Fail if certificate is returned and the verification fails. Require and Verify — Send a client certificate request to clients and continue only if the client sends a certificate and the certificate verification succeeds. Require and Verify Once — Same as Require and Verify except that client certificate requests are not sent during renegotiation.
   WAN Certificate	The X.509 certificate for the interface in PEM format. The certificates are loaded using the Security > Certificates page. Make sure that the common name (CN) in the certificate matches the domain name or IP of the interface.
   WAN Policy	Peer certificate verification policy: No check — The peer certificate is not verified. Verify if provided — Send a client certificate request to clients but continue handshake if the client does not return a certificate. Fail if certificate is returned and the verification fails. Require and Verify — Send a client certificate request to clients and continue only if the client sends a certificate and the certificate verification succeeds. Require and Verify Once — Same as Require and Verify except that client certificate requests are not sent during renegotiation.
   Block TLS support on WAN	When enabled, the system will not respond to TLS SIP messages received on the WAN interface.
   Exclude sips headers for TLS Transport	When enabled 'sip' uri scheme will be used in translated SIP message. This option is available only for TLS transport.
   Set TLS source port	When enabled, the EdgeMarc uses its listening port as a TLS source port for the egress connections.
   NAT Traversal: This feature is only available on 2900, 4700, 4800, 4552v2 and 6000 platforms.
   Disabled	NAT Traversal for SIP will be disabled.
   RFC-3581	With RFC-3581 support, the system will insert report in the outbound SIP messages to the softswitch. RFC-3581 is to resolve failed SIP response problem in a NAT environment. It is recommended that “Use RFC3581 UAS response for signaling modification” should be checked when RFC-3581 is selected. For media to work properly, it requires symmetric RTP support on the media server or one to one port mapping on the NATing router. When RFC-3581 is selected, user should configure keep-alive logic in Survivability page. Recommended keep-alive interval is 30 seconds. The interval may vary for different NATing routers.
   STUN	The System will enable STUN to support NAT traversal for both SIP signaling (UDP only) and media. When STUN is selected, user should configure the “STUN Server” settings and keep-alive logic in Survivability page. Recommended keep-alive interval is 30 seconds. The interval may vary for different NATing routers.
   B2BUA Options Configure B2BUA options.
   Route all SIP signalling through B2BUA	This option enables all SIP messages to be processed by B2BUA.
   Enable Microsoft Feature	Selecting this setting enables all Microsoft related feature logics. For example, Allow WAN side B2BUA trunking device, Response OPTIONS messages from MSFT servers, Insert PTime attribute in SDP body, and so on.
   Enable Smart Ringback feature	This is enabled when Microsoft feature is enabled. The user may disable this when Message translation rule is configured in B2BUA, if required. By default, this is disabled.
   Enable Comfort Noise Generation (CNG)	This option enables the Comfort Noise Generation (CNG) engine to stay in the RTP media path and perform the translation of comfort noise packets between the two end points.
   Enable User-Agent header pass-through	Select this option to pass the User-Agent header from ingress SIP message to the egress SIP message when routed via B2BUA. When disabled, B2BUA inserts a system generated custom string in the User-Agent header of the egress SIP request message. This has no effect on SIP messages processed via ALG.
   B2BUA Redirect Support (302)	If enabled, EdgeMarc processes the 302 Response and sends an INVITE request to the number obtained from the Contact header (except for FQDN in the Contact header). When this is disabled, EdgeMarc translates 302 Response back to the caller. By default, it is enabled.
   PANI Header Refer to Configure PANI Header Settings.
   Enable PANI Header Support	If enabled, EdgeMarc will add PANI (P-Access-Network-Info) header in all requests and response (except ACK and CANCEL requests and response). By default it is disabled.
   Access Type	Specifies information about the access network used and its value is updated as per the RFC 7315. Default value is "IEEE-802.11".
   Access Info	Aditional information about the access network used. Access Info is selected as location-info. The location-info is then updated with EdgeMarc LAN/WAN IP. Note: Format for PANI header with location info is: P-Access-Network-Info: Access Type;"location-info=EdgeMarc LAN/WAN IP";"ue-ip=EdgeMarc LAN/WAN IP";"ue-port=5060".
   Access Info String	This string is updated according to the value of Access Info. Access Info String field is not configurable when user selects access info as "np" or "location-info". If Access info is selected as "np", then Access Info String is automatically set to "network-provided".
   Session Timer SIP provides a mechanism by which both user agents and proxies can determine whether a given SIP session is still active.
   Enable B2BUA Session Timer Support	This option enables support for session refresh when EdgeMarc acts as a B2BUA, and this is required to follow the SIP trunk service specification. The RE-INVITE or UPDATE requests are provided to allow a periodic refresh of SIP sessions.
   Session Refresh Interval (s)	System sends refresh INVITE on this configured session expiry interval for keeping the session alive. System uses this value only when it acts as a refresher. The default value is 90 seconds.
   Media Security: Configure SRTP and MKI support.
   Enable SRTP support	This option enables SRTP support globally in the device.
   Enable MKI support	This option enables support for Master Key Identifier (MKI) parameter in SRTP crypto attribute. This option is available only when Enable SRTP support is enabled.
   SRTP key lifetime	Specifies the key lifetime, measured in the number of packets that can be used with this key before it should be replaced with a new key.
   H.225 and H.245 Port Range	Configure the range of TCP ports to use for handling H.225 and H.245 TCP connections. Specifies the range of Transmission Control Protocol (TCP) ports to use for handling H.225 and H.245 TCP connections. If there is a firewall in front of the system, that firewall must allow TCP connections to this range to reach this system. A smaller range means that less ports must be opened on the firewall; however, each H.323 call may require up to 3 ports each and if the range is too small, the number of H.323 calls that the system can process may be restricted. Port numbers specified are inclusive: Range is 10000 to 65535, default values are 14085 to 15084. The range must contain a minimum of 999 ports.
   RTP Port Range	If an external network entity such as a firewall is configured to allow only a range of ports for RTP, then configure the port range in this field. The port numbers specified are considered inclusive and limited and are checked against the platform as well as licensed number of calls. The minimum number of ports required is two times the number of licensed streams or the Call Admission Control (CAC) value from Traffic Shaping page, whichever is smaller. Choose Network > Traffic Shaper and refer to Configuring Traffic Shaping. The following port ranges are reserved for system functions.  Note that attempting to configure a port range that overlaps with these reserved ranges will result in an error.  Port Range  Description 20000 - 30090 Reserved on systems with FXS or FXO ports 30091 - 41600 Reserved on systems with a PRI port Note: This option is available only on some versions of VOS with a special license.
   RTP Packetization Time (ms)	When this setting is configured, the system inserts the attribute a=ptime: value in the SDP messages with a default setting of 20(ms) if ptime attribute does not exist in the SDP body. Note: This is a Microsoft Feature. It takes effect when Enable Microsoft Feature is enabled.
   Enable Multi-ports	With this option enabled, EdgeMarc will allocate unique source port for each client from the configured range when it is translated through the WAN interface. The following functionalities will not be supported with this feature. B2BUA calls TLS Transport between SIP Server and EM WAN IPv6 between SIP Server and EM WAN High Availability Note: This feature is currently restricted to just hosted clients.
   Multi-port Port Range	Specifies range of ports from which the device will assign unique WAN source port for each hosted clients. The range should be between 22000 and 65535 (including both) and the total number of ports should be less than or equal to maximum phones supported on the device. This value should also not overlap with RTP and H.225/H.245 port range.
   Prioritize Microsoft Teams Selecting this settings allows Microsoft Teams traffic to be prioritized and MoS scored, so that calls are not hampered by bandwidth. Default ports provided by Microsoft are taken into consideration for the shaping and scoring.
   Allow non-translated RTP to be MOS scored
   RTP range to MOS score	If RTP for a non-translated protocol should be MOS scored and traffic-shaped, enter the RTP port range in which the system should listen for RTP. Enter ports to be scored as comma-separated port numbers or ranges of port numbers. For example: 2000,30000-32000,40002,45000-46000 Note: This option is available only on some versions of VOS.
   Calculate Round-Trip-Time Enables Round-Trip-Time (RTT) calculation. RTCP packets, LSR, and DLSR values are used to calculate an RTT value for each RTP stream. RTCP packets can be sent on behalf of phones if they do not send RTCP themselves.
   Calculate Round-Trip-Time	Select the Calculate RTT checkbox to enable the feature.
   RTCP MUX Support This option enables RTCP multiplexing on inbound calls. This helps to establish bi-directional audio calls.
   Bandwidth Settings for H.323 The maximum bandwidth to be used. The total bandwidth is counted as RTP payload plus IP header overhead, for example, the actual link bandwidth set aside for RTP streams. The per-call bandwidth is the RTP payload bandwidth only, for example, the value used in the client to specify the bandwidth of the call. See Configuring Bandwidth Settings for H.323. Note: Only EdgeProtect supports H.323. Please note that EdgeMarc does not support H.323.
   ALG registration	Displays current ALG registration status. The registration status for the ALG feature is displayed to ensure that the feature is enabled. If the feature is not registered, no calls will be allowed to pass. Note: The ALG registration code is available on a sticker on the bottom of the device or from your service provider. To view your license key, click the license key link provided to access the License page or choose Admin from the Configuration Menu and click the license key link in Registration Status. Refer to Manage the License Key.

3. Proceed to Configuring Bandwidth Settings for H.323.

Configuring Bandwidth Settings for H.323

This section outlines how to configure the bandwidth settings for H.323.

1. Choose VoIP from the Configuration Menu.

2. Scroll to Bandwidth Settings for H.323.
   
   

3. Configure bandwidth settings using the information in the following table as a guide.

   VoIP ALG Parameters - H.323 Bandwidth Settings

   Item	Description
   Bandwidth Settings for H.323
   Maximum total bandwidth (kbps)	Enter the maximum available bandwidth. Bandwidth includes the RTF payload plus the IP header overhead. If the bandwidth is set to 0, bandwidth management is not enforced. Only calls with media traversing the system is counted towards the bandwidth maximum. This number applies to the total bandwidth maximum (payload + overhead); the actual payload amount allowed through is 20% lower than this number. For example, if Maximum Bandwidth is set to 1000k, only 800k of actual voice/video is allowed through.
   Maximum per-call bandwidth (kbps)	Enter the maximum available per call bandwidth, which is the bandwidth available for the RTP payload (value that the client uses to specify call bandwidth). The IP overhead is not specified here, but rather the value used in an H.323 endpoint when making a call.
   Default audio stream bandwidth (kbps)	Enter the bandwidth available for streaming audio traffic when an endpoint does not specify the call bandwidth in the SDP.
   Default video stream bandwidth (kbps)	Enter the bandwidth available for streaming video traffic when an endpoint does not specify the call bandwidth in the SDP.
   VoIP ALG Licensed Bandwidth In Use	Displays the sum of RTP payloads of all current calls. For example, if two 384k calls are present, this field displays 768. The system uses the field to subtract against the system licensed value as Video Bandwidth in the license key page.
   Current Total Bandwidth With IP Overhead	Displays the RTP payload of current calls and add the estimated IP overhead. Use this value to budget the requirements for video traversing the customer WAN connection. The value is calculated by the RTP payload divided by .8 to add the IP overhead use to the total. For example, 384k/.8 = 480k of estimated bandwidth usage.

4. Click Submit to apply your changes. For more information on submitting your changes, refer to Submit Configuration Changes.