This Best Practice describes how to enable and configure NAT Traversal within the SBC Edge, including guidelines for usage.
NAT Traversal (also known as RTP Latching) allows the SBC Edge to register and communicate with SIP endpoints that are behind NAT routers. The most common example of using NAT Traversal is a SIP phone or soft-client behind a home gateway, communicating with an SBC on the public internet. In this scenario, the SIP Phone behind the NAT cannot properly communicate with the SBC Edge because the client used a local private address in SIP; the SBC cannot directly access the private address. NAT Traversal allows the SBC to communicate with SIP endpoints behind NATs regardless of the client's IP address.
The SBC Edge integrates Microsoft Teams clients by acting as an ICE-Lite agent endpoint for SIP calls that involve a NAT. Microsoft Teams Clients act as controlling ICE agents (using Full ICE) and use the Session Traversal Utilities for NAT (STUN) protocol to overcome network address translation issues that can occur when an endpoint is behind a NAT device. Other NAT media-related features enabled in the SBC Edge configuration are overidden and do not operate to prevent conflict with ICE-Lite agent operation.
As an ICE-Lite agent, the SBC Edge connects to the public Internet with a single IPv4 address. The ICE-Lite functionality of the SBC Edge enables the controlling agent (Full-ICE communications client) to connect on the public address; pinholes punched in the NAT allow media exchange. This operation works with the firewall in front of the controlling ICE agent and supports opening NAT pinholes for UDP traffic in a Full-Cone, restricted, or symmetric NAT. The SBC Edge responds to connectivity checks using STUN bind requests to establish and verify connectivity so that the media session can progress.
The SBC Edge does not support ICE restarts or TURN server operation. If the full-ICE agent requires TURN server operation to traverse a NAT, the SBC Edge is unable to establish connectivity between endpoints in topologies for which an SBC-side TURN server is required.
For information about the configuration parameters for enabling ICE or ICE-Lite, refer to Working with the SBC Edge and SWe Lite as an ICE-Lite Agent.
In a typical network layout (see below), an SBC Edge has both a public interface connected to the internet, and a private interface connected to the corporate network. A user's home network is also attached to the network with a NAT router and a SIP phone behind it. In this example, SIP requests arrive at the SBC from the Home SIP Phone wih the SIP Phone's private IP address (i.e., 192.168.10.2). With Inbound NAT Traversal enabled, the SBC Edge can detect the public IP address (i.e. 184.108.40.206). Once this detection is made, all communication to this endpoint is sent to the public IP, rather than the private IP from the Home SIP Phone.
These instructions assume you are logged into the SBC Edge WebUI.
In the left navigation pane, go to SIP > NAT Qualified Prefix Tables.
Access the Inbound NAT Traversal options.
Do not confuse the Inbound NAT Traversal fields with the Outbound NAT Traversal fields in the SIP IP Details section. The Outbound NAT Traversal fields are used when the SBC is on the private side of a NAT device.
From the Detection drop down list, select Enable.
Configure optional fields (i.e, Secure Media Latching, Secure Media Netmask and Registrar Max. TTL Enabled). For field definitions, refer to Creating and Modifying SIP Signaling Groups.
The following are guidelines/recommendations for configuring and using the NAT Traversal feature.
Ribbon recommends to disable SIP ALG in the connecting NAT routers to ensure NAT traversal functions properly.