FireBrick SIP Configuration

Also see: FireBrick VoIP Page which has more details about the feature.

(This is a first draft and may need updating. - 10 October 2010)

The FireBrick can be used for VoIP by being a VoIP gateway. Your local (or remote) SIP devices register against the FireBrick, and the FireBrick registers to your SIP provider, in a sense the Firebrick acts as a back-to-back SIP gateway.

You can have multiple SIP provider (carrier) accounts, and incoming calls can be routed to internal extensions and these extensions can be individual phones or a group which can then ring multiple phones in various ways. An advantage of using the FireBrick in this way is where you are forced to use RFC1918 IP addresses (private) on your LAN and the FireBrick is NATing traffic. Typically the FireBrick will be connected to the ISP by PPP itself and will have a public IP address, therefore the SIP is not being put through NAT. (SIP and NAT don't work well together)

Taking an example of a single SIP account with AAISP, and a couple of SIP phones, a FireBrick can be configured as follows.

We'll set this up so that incoming calls route to a 'ring group', which in turn will route to a number of internal extensions. Outgoing calls from the local phones will all go out via the single SIP account with the service provider.

SIP and NAT

First, a few comments about SIP, NAT and the FireBrick... The FireBrick maps ports and IPs for NAT but provides no ALG for SIP or any other protocol. SIP is notoriously difficult with any sort of NAT, with or without ALGs.

We have seen SIP work with FireBricks in this case, where the end device and the SIP call server both do things in just the right strange and non standard way to cope with the mapping, but it is rare. It also usually requires that UDP sessions be configured to be open for a long time on the FireBrick (ongoing-timeout setting on the firewall rules).

In general we would never suggest using SIP with NAT for this reason, and it is partly why the FireBrick itself includes a full back to back SIP gateway allowing SIP registrations in and out and a-law RTP via the

FireBrick. Used in this way it can avoid any NAT issues, but does specifically need configuring to meet your needs.

Prioritising VoIP Traffic

The FireBrick has built in configuration to give priority to small packets. This would include RTP as well as DNS, SSH and other real time protocols that send small packets.

Normally there is no need to add any extra shaping to improve VoIP through a FireBrick.

Set-up

Go to Config - Edit - Setup - Edit VoIP config.

Add a carrier

This is the SIP account that you're connecting to:

name	AASIP
Comment	Main Office Number
username	SIP account name (Phone number)
password	SIP account password
registrar	SIP Registrar server: registrar.aasip.co.uk
proxy	SIP Proxy server, proxy.aasip.co.uk
extn	Internal extension number to call for incoming calls, 100
allow	IPs that are allowed to talk SIP to us (ie providers IPs), 81.187.30.110-119
display-name	Name shown on phones, Office}

Click Save. xml:

<carrier name="AASIP" display-name="Main" allow="81.187.30.110-119" registrar="registrar.aasip.co.uk" proxy="proxy.aasip.co.uk" username="01234567890" password="secret" extn="100" comment="Main Office Number"/>

If you go to Status - VoIP, you should see the Carrier listed with an expiry - this shows that the FireBrick is registered to the server

Next create some users:

These will be your local SIP user accounts that your telephones use to register against the FireBrick with. Go to: Config - Edit - Setup - Edit VoIP config Add new VoIP user:

name	John
display-name	John
username	john
password	*******
allow	IPs that are allowed to register, put in your LAN ip addresses, eg, x.x.x.x/27
ddi	The full number for this user, ie same as the carrier's number assigned to you.
extn	John's internal extension number, eg 101
carrier	Pick AASIP, this will be the carrier John uses to dial out on
max-calls	1, if you just want to make 1 call at a time with this account

Click save.

xml:

<telephone name="John" display-name="John" username="john" password="secret" allow="192.168.1.0/24" ddi="+441234567890" extn="101" carrier="AASIP" max-calls="1"/>

You can repeat this process for your other users, changing the extn each time, eg 102, 103 etc. At this point you can configure your SIP phones to register to the FireBrick with the credentials you've specified above. You can then test by calling each other using the extn numbers assigned. You will also be able to dial out. If you go to Status - VoIP, you should see the Telephones listed with an expiry, IP and the SIP user agent details - this shows that the SIP phones have registered to the FireBrick. Incoming calls will not work yet, as the Carrier above is set to send calls to extension 100, which we've not created... yet...

Create a Ring Group

This will be our ring group for incoming calls

Go to: Config - Edit - Setup - Edit VoIP config Click Add New

name	Main
display-name	The name that will display on the phone, eg Main
extn	100 - this is the extension number used in the Carrier section above
ddi	the telephone number.
ring	space separate list of the internal extension numbers to ring, eg 101 102 103
type	This is the ring type, eg to ring all at once etc.

Click save.

xml:

<group name="Main" display-name="Main" extn="100" ddi="+441234567890" ring="101 102 103" type="all"/>

Firewall

SIP and RTP traffic will need to be allowed in to the FireBrick. This will need to be from the carrier, but also from external SIP phones if you have any. Take a look at this wiki page for more info: FireBrick and VoIP Firewall