Interoperability

Loose routing

The firewall uses the parameter "lr" in its SIP signaling to announce to other SIP devices that it uses loose routing. Some other SIP implementations incorrectly expect the lr parameter to be followed by a value, i.e. "lr=true". If you select that the firewall should add this value to its SIP signaling, it will work with these implementations, too. This could affect its interaction with other SIP devices that conform to the SIP standard very strictly.

Select to use "lr=true" (On) or not (Off).

Relaxed Refer-To

The SIP standard requires that a Refer-To header with a question mark in it must be contained within angle brackets. Some clients do not honor this.

Select whether the firewall should accept Refer-To headers without angle brackets, but containing question marks. The recommended setting is Off; not to accept them.

Remove VIA headers

Some SIP servers won't accept requests with more than one Via header. To be able to communicate via these servers, you can select to remove all Via headers but one in requests to those servers. The Via headers are added again when the reply passes the firewall.

Here, list servers that won't accept more than one Via header in SIP requests.

Preserve username

When registering a SIP client on one side of the firewall to a SIP server on the other side, the Contact header is normally rewritten. By doing this, we make it possible for the SIP server to track when the same user is registering multiple times from different places. It is possible to turn this rewriting off and preserve the username in Contact headers passing through the firewall, but that makes it impossible for the SIP server to tell if registrations for a certain user belong to one or several clients (if a user has two registrations from different clients and deregisters one of them, the SIP server will delete its only registration for him).

Select if usernames should be preserved (On) or not (Off). It is recommended to keep this setting off.

Translation exceptions

Usually, the firewall rewrites IP addresses in the SIP signaling to hide it for the receiver. For some reasons, you might want to except certain IP addresser from being rewritten. Enter those IP addresses in the table.

Note: This feature is experimental and may be removed in future versions.

Loose username check

Normally, the firewall checks that the authentication username equals the username in the From header. Some clients use their whole address as authentication username (ie: user@host.com), which means that the username "user" in the From header is compared with the authentication username "user@host.com". This authentication will fail. With this function, "@host.com" is stripped from the authentication username.

Select if usernames should be checked loosely (On) or strictly (Off).

SIP URL encryption

In some situations some SIP URLs are encrypted and signed. When an invitation to a call is sent out, the address that the callee is to send its answer to is encrypted, if the outgoing packet is NAT:ed. When the answer from the callee comes in, the firewall checks that the encryption and signing is correct before the address is used to send the information onwards.

The encryption and signing makes the SIP packets slightly larger. This might lead to SIP packets being fragmented. By turning encryption off, fragmentation can be avoided in some cases, and since some equipment has trouble with fragmented packets this can sometimes be necessary.

Please note that when encryption is turned off, the firewall maked no checks of incoming SIP URLs. It becomes possible in theory to trick the firewall to send SIP packets anywhere, which means that security is drastically reduced if encryption is turned off.

If Remote NAT Traversal is used, the URL encryption must be turned on.

Here, you select to turn SIP URL encryption On or Off.

Expires header

Some SIP clients don't understand the expires: parameter in the Contact header. To set the expiration time for those clients, you can make the firewall add to REGISTER request replies an Expires header with the expires value in it.

Select to Always add Expires header, Never add Expires header, or Add Expires header if the request contained one. The last means that the firewall will add an Expires header to the response if the request from the client contained one.

Allow RFC 2069 authentication

Some SIP units can't handle Digest authentication as described in RFC 2617, but they still do authentication. Ingate Firewall can allow the simpler form of authentication described in RFC 2069 to be able to interoperate with these units.

To allow this can decrease security. Use it only if units in your system need it.

Select if authentication according to RFC 2069 should be allowed (On) or not (Off). It is recommended to keep this setting off.

Force remote TLS connection reuse

Enter SIP servers to which the firewall connects using TLS. For the listed servers, the firewall will use the actual source port for the TLS connection instead of port 5061.

This is useful in the SIP signaling, where port numbers are used in Via and Route headers.

Force Record-Routing of outbound requests

Here, you select if the firewall should add a Record-Route header to all requests received by the firewall, but whose Request-URI indicates another SIP device;.

The Record-Route header makes all subsequent SIP signaling for this session to be routed via the firewall even if it is not the shortest route.

Here, you select to turn Force Record-routing On or Off.

Open port 6891 for file transfer

Messenger clients do not always use the ports that are negotiated in the SIP signaling. In particular, the File Transfer function always uses the same port, regardless of what is negotiated. To make File Transfer work through the firewall you must open port 6891, the Messenger File Transfer port.

You only need to do this if File Transfers are made between clients on different networks; if transfers are always only made between clients on the same network, no extra ports need to be opened.

Note: If more than one Messenger client performs file transfer through the firewall at the same time, they could end up sending to each other's peers instead of their own. An attacker could possibly use this to intercept transfered files; don't use this mechanism to transfer sensistive data.

Here, you select to turn Open port 6891 On or Off. Recommended setting is Off.

Timeout and retransmission values

You can configure timeouts for the different functions of the firewall SIP module here. It is not recommended to change from the default values unless you really know what you're doing.

Save

Saves the Interoperability configuration to the preliminary configuration.

Undo

Reverts all of the above fields to their previous configuration.

Look up all IP addresses again

Looks up the IP addresses for all DNS names on this page in the DNS servers you entered on the Basic Configuration page.