VoIP Network Requirements

VoIP Network Requirements

Purpose
Application Protocol
Domain / IP Address
Destination Ports
Media
RTP/SRTP
proxy.d14e.io
UDP: 16384 - 32768
 Signaling
 SIP
 proxy.d14e.io
 UDP: 5060
 Signaling Secured
 SIP/TLS
 proxy.d14e.io
 TCP: 5061
 Directory Services
 HTTPS
 *.digitalconcierge.io
 TCP: 443
 Yealink Provisioning
 HTTPS
 dm.yealink.com
 TCP: 443
 Algo Provisioning
 HTTPS
 api.d14e.io
 TCP: 443


In order to maintain high quality phone calls, it is imperative that your network is configuration properly for Voice over IP (VoIP). One setting in particular that can be very problematic to VoIP is SIP ALG. It is reference with different names depending on the firewall manufacturer. Below is a collection of links, notes and configuration guides for various brands and models of devices.

Brand
Link
Sonicwall 

Disable SIP Transformations (ALG) 
Enable Consistent NAT
Increase UDP session timer from 30 to 90 or 120 seconds
Reboot the Sonicwall
Netgear/Netgear Orbi
https://kb.netgear.com/30796/How-do-I-disable-SIP-ALG-on-my-NETGEAR-device-using-the-router-web-interface

Meraki MX
MX Devices have a UDP session timer that cannot be changed
Meraki recommends voice traffic be put on a separate VLAN
 Netgate pfSense 
Set firewall optimization mode to: conservative
pfsense by default only allows one sip registration to be active at a time on a protected LAN
siproxd is not necessary to have multiple VoIP devices active on the same LAN

Set the Firewall to:
Rules: WAN = none for SIP or RTP
NAT: Port Forward = none
NAT: Outbound = Manual Outbound NAT with the default rule and no static port mapping
 Mikrotik
SIP Helper  is located under Firewall -> Service ports, run command:  /ip firewall service-port disable sip
In Winbox  navigate to IP -> Firewall, click on the Service Ports tab and disable it
 Fortinet/Fortigate
Be sure the Fortigate device is rebooted after disabling the SIP ALG/updates
 D-Link
 Peplink
In the Peplink router's Web Admin page, navigate to Network -> Service Passthrough Support -> SIP
Change the setting from Standard Mode to Compatibility Mode to disable the SIP ALG
 Asus

Notes:
  1. SIP ALG (a.k.a SIP Helper) cannot inspect SIP TLS packets (due to encryption), however, leaving the SIP ALG active can break secure TLS handshakes due to the router trying to modify encrypted VoIP data it is unable to read.