Refer to the exhibit. You have Cisco Expressway using SIP for external calls. SIP Nat/Alg is configured on the edge firewall. The call fails with one way audio. Which problem with the configuration?

Question

Exhibit

Options

• ASIP NAT is not enabled for TLS
• BThe security certificate used by Cisco Expressway is not valid
• CSecure SIP (TLS) is not supported by the firewall.
• DThe Apache service was not restarted on Cisco Unified Communications Manager after SIP

• A
  75% (30)
• B
  10% (4)
• C
  3% (1)
• D
  13% (5)

Explanation

SIP NAT/ALG (Application Layer Gateway) works by inspecting SIP message headers and SDP body to rewrite internal IP addresses to public IP addresses for proper NAT traversal. However, when SIP is encrypted with TLS, the firewall cannot inspect the encrypted payload - it can only see the outer TCP/TLS headers. As a result, the SIP ALG cannot rewrite the IP addresses in the SDP (Session Description Protocol) body, leaving internal RFC 1918 addresses in the media connection lines. The remote endpoint then attempts to send RTP media to an unreachable private IP, causing one-way audio. The fix is to either disable SIP TLS on that leg or disable SIP ALG and use Expressway's built-in traversal instead.

No community discussion yet for this question.