PCNSE · Question #710
After implementing a new NGFW, a firewall engineer sees a VoIP traffic issue going through the firewall. After troubleshooting, the engineer finds that the firewall performs NAT on the voice packets p
The correct answer is D. Disable ALG under SIP application. The behavior described-the firewall modifying the VoIP packet payload and opening dynamic pinholes for media ports-is the Application Layer Gateway (ALG) function. ALG for SIP inspects SIP signaling messages, rewrites embedded IP addresses in the SDP payload to reflect NATed addr
Question
After implementing a new NGFW, a firewall engineer sees a VoIP traffic issue going through the firewall. After troubleshooting, the engineer finds that the firewall performs NAT on the voice packets payload and opens dynamic pinholes for media ports. What can the engineer do to solve the VoIP traffic issue?
Options
- ADisable ALG under H.323 application
- BIncrease the TCP timeout under H.323 application
- CIncrease the TCP timeout under SIP application
- DDisable ALG under SIP application
How the community answered
(21 responses)- A5% (1)
- B5% (1)
- C14% (3)
- D76% (16)
Explanation
The behavior described-the firewall modifying the VoIP packet payload and opening dynamic pinholes for media ports-is the Application Layer Gateway (ALG) function. ALG for SIP inspects SIP signaling messages, rewrites embedded IP addresses in the SDP payload to reflect NATed addresses, and dynamically opens pinholes for RTP media streams. If this is causing issues (e.g., interoperability problems with SIP endpoints that handle NAT traversal themselves via STUN/ICE), disabling ALG under the SIP application resolves the conflict. H.323 (A, B) is a different VoIP protocol and would not address a SIP traffic issue. TCP timeout adjustments (B, C) do not affect ALG behavior.
Topics
Community Discussion
No community discussion yet for this question.