Norstar Version - IP Office Info

STUN Settings for Network
These settings are used if SIP trunks are added to the phone system's configuration using the SIP Trunk Administration
91 menu. These settings are necessary to allow SIP connections from the network on which the phone system is attached
to reach the public network on which the SIP provider is located.
The following fields can be completed either manually or the phone system can attempt to automatically discover the
appropriate values. To complete the fields automatically, only the STUN Server IP Address is required. STUN operation
is then tested by clicking Run STUN. If successful the remaining fields are filled with the results.
· Enable STUN: Default = Off
This field is used to select whether STUN is used or not.
· STUN Server IP Address: Default = Blank
This is the IP address of the line providers SIP STUN server. The phone system will send basic SIP messages to this
destination and from data inserted into the replies can try to determine the type ITSP NAT changes being applied
by any firewall between it and the ITSP.
· STUN Port: Default = 3478
Defines the port to which STUN requests are sent if STUN is used.
· Firewall/NAT Type: Default = Unknown
The settings here reflect different types of network firewalls.
· Blocking Firewall
Allow outgoing TFTP WRQ. Typically this will be the case. It has been observed that the Avaya corporate
firewall permits outgoing TFTP RRQ.
· Symmetric Firewall
SIP packets are unchanged but ports need to be opened and kept open with keep-alives. If this type of NAT is
detected or manually selected, a warning ‘Communication is not possible unless the STUN server is supported
on same IP address as the ITSP will be displayed as part of the manager validation.
· Open Internet
No action required. If this mode is selected, STUN lookups are not performed.
· Symmetric NAT
A symmetric NAT is one where all requests from the same internal IP address and port, to a specific destination
IP address and port, are mapped to the same external IP address and port. If the same host sends a packet
with the same source address and port, but to a different destination, a different mapping is used.
Furthermore, only the external host that receives a packet can send a UDP packet back to the internal host.
SIP Packets need to be mapped but STUN will not provide the correct information unless the IP address on the
STUN server is the same as the ITSP Host. If this type of NAT/Firewall is detected or manually selected, a
warning ‘Communication is not possible unless the STUN server is supported on same IP address as the ITSP’
will be displayed as part of the manager validation.
· Full Cone NAT
A full cone NAT is one where all requests from the same internal IP address and port are mapped to the same
external IP address and port. Furthermore, any external host can send a packet to the internal host, by
sending a packet to the mapped external address. SIP packets need to be mapped to NAT address and Port;
any Host in the internet can call in on the open port, that is the local info in the SDP will apply to multiple ITSP
Hosts.
· Restricted Cone NAT
A restricted cone NAT is one where all requests from the same internal IP address and port are mapped to the
same external IP address and port. Unlike a full cone NAT, an external host (with IP address X) can send a
packet to the internal host only if the internal host had previously sent a packet to IP address X. SIP packets
needs to be mapped. Responses from hosts are restricted to those that a packet has been sent to. So if
multiple ITSP hosts are to be supported, a keep alive will need to be sent to each host. If this type of NAT/
Firewall is detected or manually selected, no warning will be displayed for this type of NAT.
· Port Restricted Cone NAT
A port restricted cone NAT is like a restricted cone NAT, but the restriction includes port numbers. Specifically,
an external host can send a packet, with source IP address X and source port P, to the internal host only if the
internal host had previously sent a packet to IP address X and port P. SIP packets needs to be mapped. Keepalives
must be sent to all ports that will be the source of a packet for each ITSP host IP address. If this type of
NAT/Firewall is detected or manually selected, no warning will be displayed for this type of NAT. However,
some Port Restricted have been found to be more symmetric in behavior, creating a separate binding for each
opened Port, if this is the case the manager will display NATs a warning ‘Communication is not possible unless
the STUN server is supported on same IP address as the ITSP’ as part of the manager validation.
· Unknown
Use this setting if the other settings are unsuitable
· Static Port Block
Use the RTP port range 49152 to 53246.
Norstar Version 7.0 Manager Page 116
IP Office Essential Edition
- Issue 03a (21 February 2011)