NB! Changing these settings requires in depth knowledge!

Get default values - Restore all settings to default (as when new from package).

NOTE! Press "Apply" after your settings!

Far End Nat Traversal (FENT)

This unit can enable SIP connectivity for remote users that use NAT devices without SIP support. With these settings you can adapt to characteristics of the remote NAT device(s).

Keep-alive packets interval - Enter timeouts that are lower than what the remote NAT uses for UDP and TCP connections respectively.

Type of keep-alive packets - Enable or disable different types of SIP messages used for keeping connection through remote NAT alive. Enabling REGISTER means that the REGISTER expiration timeout is lowered to make SIP client behind remote NAT to REGISTER often enough for keeping connection alive. Enabling OPTIONS means this unit will send OPTIONS messages on the connection at regular intervals to keep connection alive. Enabling both means the REGISTER method is tried first and if it does not work properly the OPTIONS method is used.

Detect endpoints behind same NAT (for shortest media path) - If caller and callee are located behind the same NAT this setting will make media flow directly between endpoints.

NOTE! Press "Apply" after your settings!

Authorized Users

Define rules for limiting what SIP users are allowed to do. When a SIP message is received, this table is scanned top to bottom and the first row defining a rule that matches the method, URI and direction of the SIP message is used.

Method - SIP method (e.g. REGISTER, INVITE or BYE) that this rule should apply to.

URI - URI, destination SIP address, that this rule should apply to (wildcard '*' may be used).

Direction - Classification of SIP message by direction that this rule should apply to:
outbound - SIP messages addressed to other SIP servers.
inbound - SIP messages addressed to this SIP server.
both - All SIP messages.

Authentication User IDs - Define the users that are authorized by this rule. Specify the authentication user IDs separated with comma or space (wildcard '*' means all user IDs).

NOTE! Press "Apply" after your settings!

TLS settings

Configure SIP/TLS options for an IP interface that shall be used for SIP/TLS communication. Certificate files refers to files stored in this unit that has been created or imported by using the Certificate configuration page.

Act as TLS Client towards Server IP address(es) - When connecting to servers that require the TLS connection to be kept alive during all communication to/from the server, use this setting and enter the IP address of such a server. An example of when this is useful is when you run a TLS server locally and also connect to a remote TLS server, but the remote server is not able to verify this units certificate (it does not have your certificate or CA (Certificate Authority) installed).
Network interface - Select IP interface of this unit the row applies to and that should be used for SIP signaling over TLS and/or SSL.
Certificate - Select the server certificate to use for this IP interface. Can be empty if this IP address should only be used as a TLS client, connecting to other servers.
Trusted certificates - Select Trusted Certificates that should be used for verifying certificates of units this unit will connect to. Can be set to "None", which means that the unit can only be used in server mode, accepting connections from other clients. If you want to connect to servers that you don't have a trusted certificate for you can choose "don't verify peer cert" but this is less secure and means that the identity of the unit you connect to is not cryptographically verified, but still you will get an encrypted connection.
Server methods -
Any = SSLv23,TLSv1:SSLv23,TLSv1
SSLv3 or TLSv1 = SSLv23,TLSv1:SSLv3,TLSv1
TLSv1 (backwards compatible) = SSLv23,TLSv1:TLSv1
SSLv3 = SSLv3:SSLv3
TLSv1 (strict) = TLSv1:TLSv1
This defines the methods that the TLS server uses. It contains two parts, separated by a colon. The first part describes which versions of the client hello message that the server will accept. The second part specifies which protocols that may be used for the rest of the session.
Client methods -
Any (v2 hello)
SSLv3 or TLSv1 (v2 hello)
TLSv1 (v2 hello)
SSLv3 (v3 hello)
TLSv1 (TLSv1 hello)
This defines the methods that the TLS client uses. You can choose which version of the client hello message that the client will send and what SSL/TLS protocols that may be used for the rest of the session.
MTLS - Require Mutual TLS. If enabled, in addition to verifying server certificates, all connecting clients will be required to present a certificate that can be verified using trusted certificates (The TLS client in this unit will always be prepared to present a certificate; this setting only affects the TLS server.)
Interop. - Enable all bug workarounds that don't reduce the security of TLS too much. See SSL_OP_ALL in SSL_CTX_set_options(3) (opensssl doc) for the details.

NOTE! Press "Apply" after your settings!

SIP Proxy

Here are more advanced settings for how the SIP server will forward SIP messages.

Maximum number of active sessions - Shows the maximum number of active SIP sessions that this product is licensed to handle. Click the "Buy More" link to get more licenses.

Maximum number of registrations per user - Max number of registrations (number of simultaneous different locations) for a user.

Timeout before registration expires - The registration must be refreshed within the stated time period, or it is removed. (SIP-clients manage re-registering automatically)

Call time out - A SIP session must be refreshed within the stated time period, or it is closed. Used to finish SIP-sessions there both parts have crasched. (SIP-clients can manage refreshing automatically).

Enable SIP session timer - Negotiate a SIP session timer value. The value used in the negotiation is the "Call time out"

Default ring timeout - Used if the SIP INVITE message has not specified any expires value (ring timeout).

Maximum ring timeout - The maximum allowed ring timeout value for SIP INVITE.

SIP Server UDP/TCP/TLS port numbers - The SIP server listening port numbers for protocol UDP/TCP/TLS. (Recommended value: 5060 or 5061 for TLS)

NOTE! Press "Apply" after your settings!

Static domain forwarding

Domains which should override (bypass) DNS-lookups. Use 127.0.0.1 as IP address to specify that this unit should be used as SIP server for the given domain. If a domain in DNS points at this unit's IP address, but you want to use another SIP server you can enter it's IP address here.

Domain - Name of the domain in a SIP request.

Forward to - The IP address that SIP messages matching the domain shall be forwarded to, or 127.0.0.1 to specify a domain to host.

Modify URI - If the box is checked the domain in the request-URI of the SIP message will be modified to the value of the previous column. Use this if domain is an IP address or if you want to change a domain name to another rather than using this setting as a replacement for DNS lookup.

Authenticate - If the caller should be authenticated and authorized before this setting is used. When forwarding calls from Internet to LAN based on domain only, it may be important to filter out unwanted users. For example, if the call is forwarded to a SIP Server or PBX with ability to make outgoing PSTN calls you probably don't want anyone to exploit this function (as the number called could be a pstn number).

NOTE! Press "Apply" after your settings!

Allowed Codecs

This table can be used to specify codecs (media coding format) you allow for SIP calls. When this unit is used in b2bua mode (with operator accounts or call transfer settings below) call transfers may not work unless a single codec is allowed for all voice communcation. Recommended codecs for these cases are "pcmu" or "pcma", which are the most common codecs supported by SIP phones.

Enable Codec Filtering - Enable/disable usage of this table.

Codec Name - Name of the codec to allow, e.g. "pcmu" or "pcma". Wildcard '*' can be used.

Media - The media type allowed for the codec, e.g. "audio" or "video".

Codec Manipulation - This is an interop setting for systems not accepting calls without out-of-band DTMF information in SDP. Select for example "101" as payload type and the IP address of the SIP system requiring out-of-band DTMF.

NOTE! Press "Apply" after your settings!

Proxy rules

Rules that limit access to the SIP server by matching the source IP address of the SIP message. With these rules you can black list users (or white list) based on source IP address. The list is scanned from top to bottom and the first match found is selected.

Proxy default access limit - Access limit for SIP messages that do not match a specific rule:
unlimited - Accept all SIP requests.
limited - Accept only SIP requests addressed to this unit (unit not usable as outbound proxy).
no access - The SIP request will be rejected.

IP address - The IP address that is used together with the subnet mask to match the source IP address of a SIP message.

Subnet Mask - The subnet mask that is used together with the IP address to match the source IP address of a SIP message.

Access limit - Access limit of a SIP message matching the rule:
unlimited - Accept all SIP requests.
limited - Accept only SIP requests addressed to this unit (unit not usable as outbound proxy).
no access - The SIP request will be rejected.

NOTE! Press "Apply" after your settings!

Advanced

SIP (3xx) redirection handling - How to handle SIP 3xx responses, redirecting to a new SIP URI:
Handled by the caller - Let the caller perform the redirection. Send 3xx responses to the caller.
Handled by this unit - Let this unit perform the redirection locally. Do not forward 3xx responses.

TCP connection timeout - TCP connections to the SIP server not transmitting valid SIP messages are closed after the timeout.

Max number of media streams per SIP request - Max number of data streams allowed to be set up between two users with a single SIP request.

Accept - MIME-types in SIP messages allowed to pass without restrictions. Multiple types can be entered, separated by comma. Wildcards are allowed.

Log settings (verbosity) - Select the volume of SIP information in the system log. Log messages with the selected error code and "higher" is displayed
Mediastream log code - Select the error code that should be used by log messages related to media streams. Error codes:
"emergency" - system is unusable
"alert" - action must be taken immediately
"critical" - critical conditions
"error" - error conditions
"warning" - warning conditions
"notice" - normal, but significant, condition
"info" - informational message
"debug" - debug-level message

Forward to syslog server - Send each SIP Log entry to the syslog server. You can use a specific syslog server for SIP by entering the IP address here, otherwise the syslog server on the Administration page is used.

Log SIP header fields (e.g. From, To) - Enter the name of the SIP header fields you want to display in the SIP Log (Log Settings should be "info" or "debug" to use this feature). '*' can be used to show the complete SIP message with all headers.

Log only communication with IP addresses - Filter the logging of SIP messages. Only SIP messages sent or received to the given IP addresses are shown in the SIP Log.

Music on Hold URI - Enter a SIP URI that routes to a device that plays music suitable for music during a held call.

Relay media for calls over VPN - For calls received or sent over a VPN of this unit, act as a media relay so that the media stream also can go over the VPN regardless of where the caller and callee are located. For example, if a call is received over VPN and forwarded to some ITSP this setting will make the media go from the ITSP to this unit and then forwarded into the VPN to reach the caller. If this setting is disabled media may go directly to the caller, not in the VPN. For users local to this unit, media will always be sent over VPN if the call was received over VPN, regardless of this setting.

RTP media port range - ports used by the RTP media streams.

Allow multiple RTP media senders - When the firewall is opened to let the media streams of the session pass through the IP adress from which the media is sent is not allowed to change unless this setting is enabled.

Reuse port numbers within session - Interoperability setting, if a client changes port number for media mid-session, the other end may not support it and keep sending media to old port number. This setting makes this unit keep port numbers unchanged for port numbers set up to redirect media into LAN.

Reuse port numbers when changing media - With this setting off a new port number will be used for media port redirection when media type changes in a session. Enabling this setting will make this unit continue using same port number. Try this if T.38 FAX transmissions is not working.

Spoof protection - Spoofing is when an intruder pretends to have a false IP address.

RFC 3261 Loose routing - Some SIP units does not accept URI parameters without values. The loose routing parameter, "lr", is such a parameter and this unit therefore uses "lr=true" by default for loose routing. With this setting you can enforce strict RFC 3261 behaviour (using ";lr").

Disable username encoding (registrations) - To be able to differentiate between two users with same username, for example bob@foo.com and bob@bar.com, this unit encodes the registration information (Contact header field) to make the registration unique (e.g. sip:zXc2Vbfdf@1.2.3.4). However, some SIP servers seem to implement the SIP standard poorly in that they don't copy the exact information from the Contact URI of the REGISTER to the request-URI of the incoming INVITE message. Try this setting if you have trouble with incoming calls.

Allow RFC 2069 authentication - Allow authentication requests from a client that supports RFC 2069 authentication only (i.e. without qop as defined in RFC 2617).

Preferred QOP (authentication) - Select preferred Quality Of Protection when a SIP client of this unit authenticates to a server which presents multiple choices (see RFC 2617).

URI Encoding - When a SIP message is sent through this box, SIP URI:s may be rewritten in encoded form to solve NAT problems with the SIP protocol (i.e. make the URI globally routable) and also to hide network topology information. With this setting you can select the type of encoding used to be able solve possible problems with systems intolerant to this.
"Encryption" - This will make the original URI be encrypted so that the original URI is hidden to other users, but still usable to all users. This is the recommended setting unless you communicate with systems that does not accept large URI:s.
"Escaping" - Encodes the URI by applying SIP escaping procedures. This can be used if the URI:s get too long with the above setting. Does not hide network topology information.
"Use registration" - No encoding, modifies the URI to the URI registered by the user. This will make the URI even shorter and hides network topology, but is also a setting for compatibility with system not accepting encoded URI:s. This setting requires that the caller is registered with same identity as used when calling.
"GRUU" - Self-made GRUUs (Globally Routable UA URI, see RFC 5627) will be created to replace URIs that are not globally routable. This setting hides network topology information by encryption. The advantage with this setting is that it hides only the information needed for routing, numbers and other parameters are in clear text and can be interpreted by other systems.

Hide Via headers on requests to IP addresses - This unit adds a Via header to SIP requests since it has the role of a SIP proxy. This setting is intended for interoperability with systems that does not allow an extra SIP proxy in the call path. Enter IP addresses to units to which we should hide any additional Via headers.

Ignore required extensions - SIP extensions may define functions that require support by all devices involved in SIP signaling. Since this unit often is used as an additional SIP proxy there may be extensions that is required by a SIP proxy, but not all SIP proxies in the call path. Enter the name of an extension that this unit should ignore that it does not have support for instead of issuing a 420 "Bad Extension" SIP response as mandated by the SIP RFC 3261. Several extension names can be entered, comma or space separated.

Trusted IP addresses (treated as inside) - IP addresses located outside of the firewall (WAN) can be regarded as trusted with this setting. This means they will be treated the same way as inside IP addresses (LAN).

Failed registration retry timeout - If a registration from this unit fails, retry it after this timeout expires.

Find SIP URI locally - Try find the SIP URI identity locally instead of forwarding the SIP request to the server responsible for the domain in the SIP URI.

Strip route information from 180 responses - Interop setting for systems that fail to send correct CANCEL request to terminate ringing phone. Try this if phones don't stop ringing after hangup.

NOTE! Press "Apply" after your settings!

Trusted networks (RFC 3325)

Support for RFC 3325 P-Asserted-Identity header. This means that SIP requests arriving from a trusted network will be regarded as properly authenticated if they contain P-Asserted-Identity header. It also means that P-Asserted-Identity will be added to requests successfully authenticated by this unit. 127.0.0.1 (internal address) is always regarded a trusted "network".

Use the table to add more networks (IP addresses) that should be regarded as trusted. The protocol field refers to the protocol over which the SIP request was received.

NOTE! Press "Apply" after your settings!

Handling of Call Transfer

In SIP, call transfers should be performed by the endpoints (SIP UA), but handling this is not a mandatory requirement according to the standard so some SIP UA:s may not support it. For this reason, if you have problems with call transfers, this section lets you specify that the call transfer should be performed locally by this unit on behalf of a endpoint.

To achieve this, the SIP signalling is broken up in two parts (dialogs) connected together using B2BUA (Back-to-back User Agent) software. This is not standard SIP and has the drawback that this unit is not as transparent to sip as it is without this mode enabled. However, it usually works well.

The settings here are intended to filter out the devices that cannot transfer calls to let this unit enter B2BUA mode only when needed. Try the "always" setting to see if it solves a problem you have with call transfer, if it does, you should consider to filter harder to only enter this mode on behalf of a specific endpoint.

Always - Handle call transfer locally for every SIP telephony call.

For clients not supporting REFER - Handle call transfer locally when the calling endpoint explicitly says it does not support REFER (SIP message used for blind and attended tranfers).

For clients not supporting replaces - Handle call transfer locally when the calling endpoint explicitly says it does not support replaces (SIP header field used for attended tranfers).

For clients with From-URI - Handle call transfers locally if the callers SIP URI (SIP identity) matches a pattern specified here. Several URI patterns may be entered space or comma separated. Wildcards *, ? and ! are supported. ? represents any single character while * represents a string of characters of any length. * is only allowed first, last and just before or after @. ! is allowed only as the first character of a pattern and means that a potential match has the inverse effect, that is callers not matching the pattern activates the function.

For clients with User-Agent field - Handle call transfers locally if the callers User-Agent field matches a pattern specified here. The User-Agent field contains information about the software name and version used by the caller. Useful if you know that SIP devices of a certain brand does not support call transfer. Wildcards and multiple patterns allowed like previous setting.

NOTE! Press "Apply" after your settings!

Quality of Service

Two QoS methods are provided. The first controls the "DiffServ" bits in the IP packet and gives priority to SIP traffic that needs to go fast (RFC 2474). To be effective, the network of the Service Provider must support DiffServ. The second method requires no special support from the network It prioritizes voice (media) and SIP traffic internally and also controls external data streams to allow voice streams to coexist on a limited outside bandwidth. There is a also a setting for internal task prioritization for cases when the CPU load of the device is very high.

Set DiffServ bits in all SIP media streams - If checked, the SIP traffic will get the DiffServ values as entered. Check with your Service Provider for suitable values or use the default for audio, video and data. The values are six binary digits (e.g. 101110).

Strip DiffServ bits from other applications - Check this to lower priority for non-SIP traffic, thus enabling SIP to go faster.

Upstream prioritization (QoS) - Packets belonging to SIP initiated media streams (and those matching the DiffServ audio setting above) are prioritised over other traffic. NB! Enabling this feature can affect performance, e.g. throughput.

Link capacity - Limit the upstream sending rate to your subscribed rate to avoid building up queues in upstream equipment, which can happen if the physical link capacity is higher than the subscribed rate.
NB! Mind the unit "kbps", 1 megabits/sec = 1000 kbps.

Internal Task Prioritization - When CPU load is very high, this setting lets you choose what to prioritize. If call control is prioritized a call can be hanged up or started quickly, but voice quality on other calls may suffer. If voice quality is prioritized it may take long time to hang up a call, but voice quality is good while disconnecting or connecting other calls. Recommended setting is same priority.

NOTE! Press "Apply" after your settings!

Call Admission Control

Allows you to deny SIP calls if there is already too heavy load on the unit. Prevents unit from being overloaded.

Deny calls if any of the following is exceeded - Deny further SIP connections if ANY of the following criterias are met. Fill in the fields you whish to supervise, leave the others blank.
Audio calls - Number of audio calls in progress. If this amount of audio calls are already in progress through the unit, further SIP calls will be denied. Leave blank to ignore.
Video calls - Number of video calls in progress. If this amount of video calls are already in progress through the unit, further SIP calls will be denied. Leave blank to ignore.

NOTE! Press "Apply" after your settings!

Read more online:
Advanced SIP Settings