Adtran 908e Behind NetVanta 4430 Firewall

[jamesw]

Customer has a gig internet connection and wants the 4430 as the firewall for everything. Adtran 908e (esbc enabled) sits behind it with a private IP. 908 is SIP to PRI for a PBX. I have the 4430 sending all traffic from SIP provider to the 908e. Calls establish but there is no audio. in the 908e I had to add the 4430's public IP as outbound-proxy secondary, otherwise I would get SIP CLDU errors and calls would not go through. Currently has only 1 public IP address and doesn't want more. Anyone have any configuration suggestions. Sorry this is so brief please let me know if you need further info.

[jayh]

It isn't a good idea to run an SBC behind a NAT. Can you put the TA908e in front of the 4430 and either use the firewall function in the 908 for your data traffic or NAT the feed to the 4430 within the TA908e?

[dmac]

Why not use the 4430 as the SBC also. The issue with the 908 probably has to do with using a private IP not being able to anchor the call with a public IP. I am using 4430's as my SBC in 3 locations with 908s's and 924's behind them along with 7100's. Either way, if you move the 908e to the outside or use the 4430 be sure to turn on call anchoring.

        Doug 

[jamesw]

Thanks for the reply. Unfortunately putting the 908 on a public IP isn't an option at this point. I would prefer that myself as that is how I am used to doing this.

[jamesw]

The 4430 I am working with doesn't appear to have the 'ip rtp media-anchoring' command so I am guessing the sbc features are either not licensed on the 4430 or different? I've tried various different configurations including sip proxy while removing the NAT, however, the NAT seems to be the only thing that even comes close to working. I'm probably doing something wrong with the SIP proxy setup. Hoping someone can point me in the right direction here.

[dmac]

James,

     You should be able to purchase an upgrade license to an SBC, check with Adtran. I think that would be the best way to go in order to use 1 IP address.

    Doug