ISA550 DMZ for VOIP

Question

Hi !
I have a ISA550 and I want to make a DMZ LAN with VOIP SIP Phones ! This DMZ Subnet schould not be patet and should ve accessed from the Internet only form a certian Subnet !
The DMZ Network is statc routed to the ISA 550 WAN Interface from outside !
Here my Config:
ACL Rule
From WAN to DMZ  Services any  Source Managment  Destination Address DMZ-Network   enable
Dynamic PAT
disable DMZ
Advanced NAT:
From DMZ to WAN1 Original DMZ to WAN1 Orgnal Source DMZ-Network  Orginal Destination any any Translatated Source DMZ-Network any any
The config above not work !  What is wong ?
Also I want to use QOS with strict priority Queuing for this Network  -> How should I do this -> Protocol RTP and SIP
Thanks !
kind regards
kristoferus

Answer 1

Kristoferus,
To accomplish what you are wanting shouldn't require any special ACL Rules or NAT configuration.  The reason for this is because all communications are initiated from the SIP Phones to the VoIP provider.  Once the SIP Phone connects to the VoIP provider's network, all traffic is managed over that established connection.  So the VoIP provider's network will never actually initiate a connection into your network and thus you don't need any special NAT configuration to allow them access.
Since the VoIP provider is in a lower security level Zone (WAN), the VoIP DMZ will have, by default, unlimited access to the WAN, and by default the WAN will explicitly allow back through any traffic initiated from a higher security level Zone (VoIP DMZ).  So this is what I would suggest doing.
Assumptions
You mentioned source Management in your ACL Rule.  I'm assuming Management is the Address Group that contains the VoIP provider's subnet.
Steps to complete
Delete the ACL Rule you created and referenced above
Delete the Advanced NAT statement you created and mentioned above
Under Dynamic PAT, enable for the VoIP DMZ as well
Under Application Level Gateway, ensure SIP Support is unchecked
Under Networking -> Ports -> Physical Interface, ensure the DMZ VoIP VLAN is applied to the appropriate interface
If the only thing attached to this port is an external switch that only phones plug into, then ensure the mode is set to Access and that the only VLAN on this port is the VoIP DMZ.
If a switch is connected to this port and that switch is shared by both phones and devices in other VLANs...
Ensure the external switch supports VLANs
Set the Mode to Trunk and add the appropriate VLANs to the port
Configure the external switch ports to include the correct VLANs on the associated ports to ensure that phones are being placed in the VoIP DMZ VLAN and not the default.
Once you have all of this setup, test the phones and they should be working.  If they are proceed to the next step to lock down security.  If not, do not proceed to the next step as it will only add complexity to troubleshooting.
Limit SIP Phones to only have access to VoIP provider
Create an ACL Rule...
From Zone:  VoIP DMZ
To Zone:  WAN
Services:  ANY
Source Address:  VoIP DMZ Network
Destination Address: Management (Based on my assumption above)
Log:  On
Match Action:  Permit
Create an ACL Rule...
From Zone:  VoIP DMZ
To Zone:  WAN
Services:  ANY
Source Address:  ANY
Destination Address: ANY
Log:  On
Match Action:  Deny
Once both ACL Rules are created, ensure the first ACL Rule is before the second ACL Rule.
The combination of these rules in the correct order will allow traffic from the SIP Phones to the VoIP provider and then block the SIP Phones from accessing anything else.
You should be done and working at this point.  If so, let me know and we can move on to QoS.