Topic
This article discusses how to set up a SonicWAlll firewall for use with Cytracom UCaaS
Environment
- Cytracom UCaaS
Description
Follow these steps in order to ensure correct configuration.
Refer to our Firewall Best Practices guide for the latest IP address ranges and services.
Index
- Before you begin
- Set up bandwidth management
- Increase system UDP timeout
- Enable consistent NAT and disable SIP Transformations
- Configure address objects and the Cytracom address group
- Configure the bandwidth object
- Configure the outgoing traffic rule
- Disable SIP ALG
- Disable SIP URIs to have an explicit port
Before you begin
Connecting the SonicWALL firewall
To connect the SonicWALL firewall to the network:
- Ensure the modem or other ISP-provided equipment is in bridge mode.
- If the IP address is static, you must load this information into the SonicWall.
- Connect the router to the modem provided by the ISP, ensuring that it is the only device connected. All other devices will connect to the router or a switch connected to the router.
- In most cases, the router can be accessed locally at 192.168.0.1, 192.168.1.1, 192.168.168.168.
Procedure
Set up bandwidth management
Setting up bandwidth management for the phones is good practice, especially if they share the network with other devices. As an on-demand service, VoIP depends on a stable connection to perform consistently, despite most devices relying on local caching methods which mask ISP network inconsistencies.
1. In the SonicWALL UI, click Network in the left-hand Navigation menu, then select the WAN interface.
2. Go to the advanced tab and scroll down to Bandwidth Management.
3. Tick the option Enable Interface Egress Bandwidth Limitation.
4. Set the Maximum Interface Egress Bandwidth (kbps).
5. Tick the option Enable Interface Ingress Bandwidth Limitation.
6. Set the Maximum Interface Ingress Bandwidth (kbps).
When finished, click Ok.
Figure 1: Bandwidth Management (click to enlarge)
Increase system UDP timeout
1. In the SonicWALL UI, click Firewall in the left-hand Navigation menu, then select Flood Protection.
2. Click the UDP tab near the top of the window.
3. Under UDP Settings, set Default UDP Connection Timeout (seconds) to 180.
Figure 2: UDP Timeout settings (click to enlarge)
Enable consistent NAT and Disable SIP Transformations
1. In the SonicWALL UI, click VoIP in the left-hand Navigation menu, then select Settings.
2. Enable Enable consistent NAT.
3. Disable Enable SIP Transformations
4. Disable Enable H.323 Transformations
When finished, press Accept.
Figure 2: VoIP settings (click to enlarge)
Configure address objects and the Cytracom address group
Configure the address objects
Address Objects allow IP addresses to be defined once and re-used in multiple instances throughout the SonicOS interface. You must define the address objects and the group before configuring the QoS option in the Access rules.
1. In the SonicWALL UI, click the Object tab at the top of the window.
2. Click Match Objects in the left-hand Navigation menu, then select Addresses.
3. Click + ADD, then configure the object as follows:
- Name: Cytracom Voice 1 (recommended).
- Zone: WAN.
- Type: Range.
- Starting IP Address: 64.58.110.1
- Ending IP Address: 64.58.111.254
When finished, click Save.
Figure 3: The Add Object window (click to enlarge)
4. Configure a second Cytracom Voice object as follows:
- Name: Cytracom Voice 2 (recommended).
- Zone: WAN.
- Type: Range.
- Starting IP Address: 184.175.130.161
- Ending IP Address: 184.175.130.186
When finished, click Save.
6. Configure a Cytracom Web object as follows:
- Name: Cytracom Web (recommended).
- Zone: WAN.
- Type: Range.
- Starting IP Address: 3.208.72.128
- Ending IP Address: 3.208.72.158
When finished, click Save.
7. Configure a Firmware Server object as follows (this object requires a change in the Type menu):
- Name: Cytracom Firmware (recommended).
- Zone: WAN.
- Type: FQDN.
- FQDN Hostname: fw.cytracom.com
When finished, click Save.
8. Configure the Provisioning Server object as follows (this object requires a change in the Type menu)
- Name: Cytracom Provision (recommended)
- Zone: WAN
- Type: FQDN
- FQDN Hostname: provision.cytracom.net
When finished, click Save.
Configure the Cytracom address group
1. In the SonicWALL UI, click the Object tab at the top of the window.
2. Click Match Objects in the left-hand Navigation menu, then select Addresses.
3. Click the Address Groups tab.
4. Click + Add, then use the arrow button to add the address objects you created in the previous step.
When finished, click Save.
Figure 4: The Address Group window (click to enlarge)
This address group can contain additional Cytracom address objects, such as firmware or configuration, depending on the strictness of implicit rules. For initial configuration purposes, we have only included the DC location objects. See the firewall best practices guide for more information.
Configure the bandwidth object
Bandwidth Objects allow inbound/outbound bandwidth expectations to be defined one time globally and re-used in multiple instances throughout the SonicOS interface. You musrt define the address object before configuring the BWM option in the Access Rules.
1. In the SonicWALL UI, click the Object tab at the top of the window.
2. Click Profile Objects in the left-hand Navigation menu, then select Bandwidth.
3. Click + ADD, then configure the object as follows:
- Name: Cytracom Guarantee (recommended).
- Guaranteed bandwidth: 100kbps multiplied by the number of phones at that location (desktop application included)
- Maximum bandwidth: Set to the maximum bandwidth provided by your ISP (recommended).
- Traffic priority: 0 Realtime.
- Violation Action: Delay.
When finished, click Save.
Figure 4: Bandwidth Object Settings (click to enlarge)
Configure the outgoing traffic rule
In this step, you will configure options in multiple tabs on the Access Rules page.
General configuration
1. In the SonicWALL UI, click the Policies tab at the top of the window.
2. Click Rules and Policies in the left-hand Navigation menu, then select Access Rules.
3. Click + ADD, then configure the rule as follows:
- Source Zone: LAN.
- Destination Zone: WAN.
- Source Address: Any.
- Destination Address: Cytracom Group.
- Source Port/Services: Any.
- Destination Port/Services: Any.
Figure 5: Outgoing Traffic Rule configuration (click to enlarge)
Users & TCP/UDP configuration
1. Click the Users & TCP/UDP tab and configure options as follows:
- Include: All.
- Exclude: None.
- UDP Inactivity Timeout: 180.
Security Profiles configuration
1. Click the Security Profiles tab and configure options as follows:
- Disable everything.
Traffic Shaping configuration
1. Click the Traffic Shaping tab and configure options as follows:
- DSCP Marking: Preserve.
- 802.1p Marking: None.
- Egress BWM: Cytracom Guarantee.
- Ingress BWM: Cytracom Guarantee.
- Track Bandwidth Usage: Checked.
Optional Settings configuration
1. Click the Optional Settings tab and configure options as follows:
- SIP: Unchecked.
- H323: Unchecked.
- Allow TCP Urgent Packets: Checked.
When finished, click Add.