> Source: [sk113573](https://support.checkpoint.com/results/sk/sk113573) # sk113573 - How to configure VoIP on a Locally Managed Spark Firewall | Property | Value | |----------|-------| | Solution ID | sk113573 | | Date Created | 2016-10-05 | | Last Modified | 2022-07-24 | | Technical Level | General | | Products | Spark Firewall (Locally Managed) | | Versions | R81.10.X | | Platform | 910 | ## Solution **Important Note: Use the VoIP Wizard to accomplish the configuration below for 1500, 1600, and 1800 Quantum Spark appliances (starting in [R80.30.35](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk174683)).** To correctly configure VoIP to work on Locally Managed 600 / 700 / 910 / 1100 / 1200R / 1400 / 1500 / 1600 /1800 appliances, the topology of the VoIP/SIP environment must be understood first. Below are the most common topologies deployed with Locally Managed 600 / 700 / 910 / 1100 / 1200R / 1400 / 1500 / 1600 /1800 appliances: 1. Only IP-Phones behind the firewall that register to an external\[cloud\] PBX/VoIP Provider. 2. IP-Phones and an Internal PBX that register/use an external\[cloud\] PBX/VoIP Provider. 3. IP-Phones and Internal PBX(s) behind multiple sites connected through VPN. 4. Soft-Phones and Internal PBX behind multiple sites connected through Client-to-Site VPN. 5. External IP-Phones that register to an internal PBX. **IMPORTANT: Read the important notes at the end of this article. The configuration below is not enough to ensure a flawless SIP deployment.** Configuration details for each case: ***First Case:* Only IP-Phones behind the firewall that register to an external (cloud) PBX/VoIP Provider** * Topology ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk113573/Internal PBX - External Trunkpbx1610032252.png) * Configuration Configure the following: * VoIP Provider IP range (if it has several signaling IP ranges - configure them all as Network Objects, then assign them all to a new network object group, ex. VoIP-Provider) * Phones IP range (configure it as Network Object, ex. IP-Phones) * Create 1 Incoming Rule: From VoIP-Provider To IP-Phones at service *SIP_UDP* (depends on the VoIP Provider Specification - this is the most common) action allow. In Gaia Portal: Access Policy -\> Policy, under 'Incoming, Internal and VPN traffic' ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk113573/sk113573-PhonesOnlyIncomingRule1610060246.png) ***Second Case:* IP-Phones and an Internal PBX that register/use an external (cloud) PBX/VoIP Provider** * Topology ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk113573/Internal PBX - InternalPBXPhones1610032302.png) * Configuration Configure the following: * VoIP Provider IP range (if it has several signaling IP ranges - configure them all as Network Objects, then assign then all to a new network object group , ex. VoIP-Provider ) * Create a Network object for the PBX (ex. Internal_PBX). * Create 1 Incoming Rule: From VoIP-Provider To This Gateway at service SIP_UDP (depends on the VoIP Provider Specification - this is the most common) action allow. * Create 1 NAT Rule: * Original Src IP: Any * Original Dst IP: This Gateway * Original Service: SIP_UDP * Translated Src: Original * Translated Dst: Internal_PBX * Translates Service: Original Incoming Rule: In Gaia Portal: Access Policy -\> Policy, under 'Incoming, Internal and VPN traffic' ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk113573/sk113573-PhonesPBXIncomingRule1610060245.png) NAT Rule: In Gaia Portal: Access Policy -\> NAT ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk113573/sk113573-PhonesPBXNATRule1610060244.png) ***Third Case:* IP-Phones and Internal PBX(s) behind multiple sites connected through VPN.** * Topology ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk113573/VoIP Under VPN1610032334.png) * Configuration No Access or NAT rules are needed in this case as long as VPN traffic between the sites is allowed. Make sure you are aligned to firmware [R77.20.80](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk123294&partition=General&product=Branch) and above for Site-to-Site VPN cases. ***Fourth Case:* Soft-Phones and Internal PBX behind multiple sites connected through Client-to-Site VPN** * Topology ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk113573/VoIP Under VPN - C2S1610300242.png) * Configuration Clients in this topology are located behind a normal ISP router/modem and are using a VPN client \[ Check Point Endpoint Security VPN client\] or other L2TP connection that ensures a VPN office mode network assignment from the firewall's side. Configure the following on the site's firewall: * Enable 'VPN Remote Access - Back connections enable' parameter from Device -\> Advanced Settings. * Create a Network object for the PBX (ex. Internal_PBX). * VPN Office Mode IP range (configure the office mode network assigned in VPN -\> Remote Access Advanced as Network Object, ex. office) * Create 1 NAT Rule: * Original Src IP: Internal_PBX * Original Dst IP: office * Original Service: Any * Translated Src: Original * Translated Dst: original * Translates Service: Original Back Connection parameter, from Device -\> Advanced Settings: ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk113573/C2S-NAT-Adv1610300255.JPG) NAT Rule: In Gaia Portal: Access Policy -\> NAT ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk113573/C2S-NAT-resize1610300257.jpg) ***Fifth Case:* External IP-Phones that register to an internal PBX** * Topology ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk113573/Internal PBX - External Phones1703062348.jpg) * Configuration Create an Incoming Rule: From IP-Phones (or "Any") to "This-Gateway" at service "SIP", Action: "Accept" ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk113573/Untitled202110191056271.png) Create a Nat Rule: Original Src IP: IP-phones (or "Any") Original Dst IP: This Gateway Original Service: SIP Translated Src: Original Translated Dst: Internal_PBX Translates Service: Original ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk113573/Untitled2202110191056402.png) #### Important Notes relevant to all cases: * Make sure you're running firmware version R77.20.80 or higher. * Make sure that you're using standard RFC SIP ports (5060 UDP for source and destination ports) especially in clear text cases (not crucial in VPN cases). * If the source port the VoIP setup is using \[local SIP port\] is something other than 5060, make sure to modify the system defined SIP_UDP/SIP_TCP service to include this port, from Gaia Portal -\> Users \& Objects -\> Services, search for SIP_UDP/SIP_TCP then edit 'Ports' field. * In case the destination port the VoIP setup is using is something other than 5060, **then please make sure you are aligned to firmware version R77.20.80 or higher**. * In case the **service group 'SIP'** \[which contains both SIP_TCP \& SIP_UDP\] is used in the access rules while the standard ports were modified \[ports used other than 5060\] , **then please make sure you are aligned to firmware version R77.20.80 or higher.** * Disable STUN server or remove any external IP configured on the phones/PBX/trunk. * Make sure SIP inspection is enabled: from Gaia Portal -\> Users \& Objects -\> Services, search for *SIP_UDP* (make sure that the '**Disable inspection for this service** ' checkbox is *cleared*). ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk113573/SIPInscpectionWindow1610032347.png) --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content