Full Cone NAT via FLEX H

fedebros · June 5

Hi, I replaced an ATP200 with a USG FLEX 100 H on a network with a public IP address and a PBX in LAN.

Some public ports were mapped via NAT to the internal PBX. With ATP200 was all ok, with FLEX H clients can start VoIP calls, but the voice didn't pass via NAT.

PBX Technincian spoke about Full Cone NAT, Restricted Cone NAT and Symmetric NAT… he wasn't able to explain exactly how it works, but checking some RFC about STUN Protocol, seems that ATP and USG FLEX H works different.

My environment seems to need Restricted Cone NAT instead of Symmetric NAT.

The following image was the instruction he gaves to me in 2020.

I found the PBX manual here https://wiki.unify.com/images/d/de/How_To_Configure_System_Device%40Home.pdf

page 15.

Could you address how to configure USG FLEX H to restore VoIP softphones?

Thank you

Federico

PeterUK · June 5

You might have to enable SIP then again maybe not.

Best way to find what needs to be allowed is to packet capture LAN and WAN as you start a VoIP call to then look what is blocked so if you have like many (I don't) Have LAN to WAN allow any then your looking on the WAN side for traffic you need to allow that if your not behind another NAT unless you know that is not a problem by testing without FLEX H.

With some logic thinking when looking at a packet capture you should be able to work out traffic you need but may take some attempt.

Zyxel_Melen · June 8

Hi @fedebros

Could you share your topology and the configurations(ATP and USG FLEX H) so we can better check this issue? You may send the information to me by private message. Additionally, what firmware version is your ATP using?

Full Cone NAT via FLEX H

All Replies

Categories

Security Help Center