> Source: [sk115038](https://support.checkpoint.com/results/sk/sk115038)

# sk115038 - Audio in SIP call is only in one way on SNX client / Remote Access VPN client when Office Mode IP address is hidden behind the Static NAT

| Property | Value |
|----------|-------|
| Solution ID | sk115038 |
| Date Created | 2016-12-19 |
| Last Modified | 2023-11-23 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R81.20, R81.10 (EOS), R81 (EOS) |

## Symptoms

- * Audio in a SIP call is heard only in one way in the following specific scenario:

  1. User logs on to a computer with the Check Point SNX client / Remote Access with the VPN client
  2. Check Point SNX client / Remote Access with the VPN client connects to the Check Point Security Gateway to the interface that is defined as "External" in the Security Gateway's Topology
  3. Check Point SNX client / Remote Access VPN client (when connected to the Check Point Security Gateway) receives its IP address from an Office Mode network that is hidden behind the Static NAT (defined in the object of the Office Mode network)
  4. Office Mode network is configured with a public (routable) IP address
  5. User starts Cisco Jabber on the remote computer
  6. VoIP SIP call is established, but user hears audio only in one way

  Specific Topology:
  `PC with Cisco Jabber and Check Point SNX client / Remote Access VPN client --- (VPN) --- {interface defined as "External"}[Check Point Security Gateway that assigns Office Mode IP address behind Static NAT to the SNX client] --- VoIP SIP Server`
* Traffic capture on the Check Point Security Gateway shows:

  1. Cisco Jabber sends SIP "Register" message to the VoIP SIP server
  2. In the SIP "`Register`" message, the Source IP address in the "`Contact`" field is the NATed IP address of the Office Mode network
  3. In the SIP "`Invite`" message, the Source IP address in the "`Contact`" field is the real IP address of the computer with SNX client (i.e., NAT is not applied to this SIP message)
  4. The SIP call is established, but audio in the call in heard only in one way
* Without the Static NAT in the Office Mode network object, the SIP call works as expected (the audio is heard in both ways).

## Cause

When SIP "Invite" message is sent in this specific topology (SIP phone is connected to the interface that is defined as "External" in the Security Gateway's Topology), Security Gateway does not expect a Static NAT on an "External" interface, and treats this SIP "Invite" message in the following way:

* The "`To`" IP address is the SIP phone that is being dialed (and SIP phone is not registered in the Security Gateway tables)
* The "`From`" IP address is identified as external, because it is seen on an "External" interface

Security Gateway considers this SIP connection as an *incoming* call.  
As a result of all this, the Security Gateway's logic implies that SIP phone and SIP server are located on the same network.  
After calculations, Security Gateway determines that NAT is not needed.

*Example Topology*:

`PC with Cisco Jabber and Check Point SNX client / Remote Access VPN client [IP X.Y.221.120] --- (VPN) --- {interface defined as "External"}[Check Point Security Gateway that assigns Office Mode IP address X.Y.221.112/28 behind Static NAT 192.168.100.113] --- [A.B.145.4] VoIP SIP Server`

* SNX client's / Remote Access VPN client's real IP = X.Y.221.120
* Office Mode network's real IP = X.Y.221.112/28
* Office Mode network's Static NAT IP = 192.168.100.113
* SIP server's IP = A.B.145.4

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content