Nortel 1120E Administration Manual

Also see for Nortel IP Phone 1120E: User guide Installation and operation User guide Quick reference guide Installation and operation guide

Contents

Nortel 1120E Administration Manual Manual pdf 103 page image

103NAT firewall traversalThe objective of putting devices behind a Network Address Translator (NAT)is to protect the devices from external interruption and to extend the public IPaddress space. However, the shield to stop unsolicited incoming traffic alsohas the drawback of breaking a number of IP applications, including SIP.If a device is behind a NAT, transport addresses obtained are not publiclyroutable, and therefore, not useful in a number of multimedia applications.The limited lifetime of the NAT port mapping can also cause the SIPsignaling to fail. If a port mapping is idle, it can be released by the NATand reassigned to other applications.The STUN protocol lets an IP Phone 1120E discover the presence andtype of NATs between the IP Phone 1120E and the public Internet. Inaddition, an IP Phone 1120E can discover the mapping between theprivate IP address and port number and the public IP address and portnumber. Typically, a service provider operates a STUN server in the publicInternet, with STUN-enabled IP Phones embedded in end-devices, whichare possibly behind a NAT.A STUN server can be located using DNS SRV records using the domain ofthe service provider as the lookup. STUN typically uses the well-known portnumber 3478. STUN is a binary encoded protocol with a 20-octet headerfield and possibly additional attributes. The STUN protocol learns the publicIP addresses, and therefore, some security is necessary.To initiate a STUN lookup, the IP Phone 1120E sends one or more BindingRequest packets using UDP to the STUN server. These packets must besent from the same IP address that the IP Phone 1120E uses for the otherprotocol, because this is the address translation information that the IPPhone 1120E tries to discover.The server returns Binding Response packets, which tell the IP Phone1120E the public IP address and port number from which it received theBinding Request. The IP Phone 1120E knows the private IP address andport number it used to send the Binding Request, and therefore, it learns themapping between the private and public address space being performedby the NAT. If the Binding Response packets indicate the same addressand port number as the request, the IP Phone 1120E knows no NATs arepresent.SIP Firmware Release 1.1 for IP Phone 1120E AdministrationNN43112-300 02.03 Standard27 May 2008Copyright © 2008, Nortel Networks.