VoIP General Network Requirements

The below requirements apply to all VoIP solutions and should be reviewed before proceeding with any implementation of VoIP Services.

Packet Inspection

All traffic to and from these VoIP systems and clients must be allowed and unmodified.  This includes both hosting and client sites.  Many firewalls have features that inspect, filter, other otherwise alter packets passing through for security purposes.  These features must be disabled for the VoIP services provided to function correctly.  Especially when relating to SIP, H323, or H225.  These features can have different names depending on the firewall manufacturer.  Below is a list of some of the names from popular manufacturers:

• Application-Level Gateway
• ALG
• Application Layer Gateway
• Application Gateway
• Application Proxy
• Application-Level Proxy
• Firewall Proxy
• Inspection
• Application Control
• Web Filtering (ESP Streaming Media)
• Deep Packet Inspection
• Session Helper

Outbound Traffic

All traffic from the client (IP phone, softphone, smartphone) to the server(s) is defined as outbound traffic.  If outbound port filtering/whitelisting is a requirement of your organization, the outbound traffic will match the port definitions specified and will only need to be allowed to the destination server(s).  See specific requirement documents for a list of ports in the tabs below.

It is assumed that the local firewall or router allows all outbound traffic from the office or home network to pass through and allows all symmetric traffic.  That is, if the phone sends RTP/RTCP to a public IP address and port, it will be able to receive RTP/RTCP from that same IP address and port.  If this is not the case, any configuration required of the user's router to support that is not covered by this documentation.

Multi-WAN / SD-WAN

When using multiple external circuits, all traffic from the client must originate from the same IP address.  If any of the traffic from the client starts originating from another external IP address, the voice services may behave unexpectedly or not work at all.

In the event of a fail-over (the primary circuit goes down, and traffic must come from a backup circuit for a period of time), clients may need to re-register to the server from the new IP address to regain functionality, depending on the solution.  For phones, this can be accomplished via a reboot if required.  In these situations, failing back to the primary may also require re-registering due to the IP change.

Vulnerability Scanning

We recommend that vulnerability scanning tools on your network are not configured to scan VoIP phones directly. In our experience, including VoIP devices in automated vulnerability scans can lead to degraded performance such as registration loss, general connectivity issues, or even unexpected reboots of the phones.

If scanning these devices is required as part of your organization’s security posture, we suggest configuring a single test phone on the network and scanning only that device. This approach helps validate security requirements while preserving service stability across all other phones.

Registered SIP Trunks can be provided upon request.