Configuring WatchGuard Firebox for VoIP

← Network & Firewall

Configuring WatchGuard Firebox for VoIP

Incoming calls experience intermittent no-audio or one-way audio when the WatchGuard firewall does not properly handle NAT translation for RTP media streams. Outbound and internal calls typically work fine. This guide walks through the configuration steps to resolve the issue.

Symptoms

• No audio on incoming calls (intermittent)
• Caller cannot hear the called party
• Outgoing calls work normally
• Internal calls work normally

Note

SIPSTACK centrally manages all phone configurations. This guide covers WatchGuard firewall settings only.

Prerequisites

Requirement	Details
WatchGuard Firebox	Any model with supported Fireware OS
Admin Access	Login credentials for WatchGuard Web UI
SIP ALG	Must be disabled
SIPSTACK RTP Range	UDP 10000–65535
Phone RTP Range	UDP 2222–2269 (Polycom default)

Configuration Steps

Step 1: Disable SIP ALG

Caution

This is a mandatory first step. Without it, all other configuration may fail.

1. Navigate to System > Global Settings.
2. Uncheck Enable SIP ALG.
3. Click Save.
4. Reboot the Firebox for the change to take effect.

Step 2: Configure 1-to-1 NAT for the VoIP Subnet

1-to-1 NAT ensures the firewall rewrites the phone’s private IP in SDP packets to your public IP, which is the core fix for one-way audio on incoming calls.

1. Navigate to Network > NAT > 1-to-1 NAT.
2. Click Add.
3. Configure:

Setting	Value
Name	SIPSTACK-VoIP-NAT
Enable	Checked
Type	IP Range or Network
Internal IP Range	Your phone subnet (e.g., 192.168.1.0/24)
External IP	Your public IP
Direction	Bidirectional

4. Under Advanced Options, enable NAT Reflection (if available) and Sticky Connections. Set Connection Timeout to 300 seconds.
5. Click Save.

Step 3: Configure Outbound NAT with Port Preservation

If 1-to-1 NAT is unavailable, use Dynamic NAT with these settings:

1. Navigate to Network > NAT > Dynamic NAT.
2. Click Add and configure:

Name: SIPSTACK-VoIP-Outbound
From: Internal phone network
To: Any-External
NAT Type: Dynamic NAT
NAT to: Use Interface IP

3. Enable Preserve Source Port and Sticky Connections. Set UDP Timeout to 300 seconds.

Caution

Preserve Source Port is essential. Without it, NAT changes the source port and causes RTP stream mismatches that break audio.

Step 4: Create Firewall Policies

Outbound SIP Policy

Setting	Value
Name	SIPSTACK-SIP-Outbound
From	Internal Network
To	SIPSTACK SIP server IPs
Service	SIP (or Custom UDP 5060)
Action	Allow
NAT	Use policy-based NAT (from Step 2 or 3)

Inbound RTP Policy

This policy is required for incoming audio to work correctly.

Setting	Value
Name	SIPSTACK-RTP-Inbound
From	Any-External
To	Firebox
Service	Custom
Protocol	UDP
Port Range	2222–2269 (Polycom) AND 10000–65535 (SIPSTACK)
Action	Allow
NAT	1-to-1 NAT (from Step 2)

Enable Handle as VoIP Traffic, Disable Deep Packet Inspection, and Enable Fast Path in Advanced Settings.

Outbound RTP Policy

Setting	Value
Name	SIPSTACK-RTP-Outbound
From	Internal Network
To	Any-External
Protocol	UDP
Port Range	10000–65535
Action	Allow
NAT	Use policy-based NAT

Step 5: Configure UDP Session Timeout

1. Navigate to Firewall > Firewall Settings > Global Settings.
2. Set timeouts:

Timeout Type	Value
UDP Timeout	300 seconds
UDP Stream Timeout	300 seconds
VoIP Session Timeout	3600 seconds (if available)

3. Click Save.

Step 6: Enable NAT Traversal Helper (If Available)

Some WatchGuard models include a NAT traversal helper that performs better than SIP ALG:

1. Navigate to System > Packet Handling.
2. Look for NAT Traversal or STUN Helper.
3. If present, enable it and configure:
   • Protocol: UDP
   • Ports: 3478, 5060, 10000–65535

Verifying the Configuration

Make an inbound test call, then check System Manager > Active Connections and look for:

• UDP 5060 connections to SIPSTACK IPs
• UDP connections in the 2222–2269 range (phone RTP)
• UDP connections in the 10000–65535 range (SIPSTACK RTP)

If connections appear but audio is still missing, the NAT translation is not rewriting the SDP IP correctly.

Troubleshooting

Still no audio on incoming calls?

1. Verify SIP ALG is truly disabled. In Traffic Monitor, SIP packets should not have an ALG tag.
2. Check for private IP leaks in SDP. In Traffic Monitor, filter for port 5060 and inspect SIP 200 OK packets. If you see c=IN IP4 192.168.x.x, NAT is not rewriting the SDP.
3. Try Static Port NAT. Map YourPublicIP:2222–2269 → PhoneSubnet:2222–2269.
4. Enable logging on all VoIP policies and look for denied packets during calls.

Alternative: SNAT Rules

If standard NAT does not work, try Source NAT (SNAT):

1. Navigate to Network > SNAT.
2. Create a rule:

Name: Force-VoIP-SNAT
From: Internal phone network
To: SIPSTACK IPs
Action: SNAT
SNAT to: Your Public IP
Preserve Ports: YES

Summary

Three settings are critical for WatchGuard VoIP compatibility:

1. SIP ALG must be disabled — it breaks NAT traversal.
2. 1-to-1 NAT or SNAT — ensures proper IP rewriting in SDP.
3. Inbound RTP ports open — both the phone RTP range and the SIPSTACK RTP range.

Related Resources

• Disabling SIP ALG on FortiGate Firewalls
• General Firewall Configuration for VoIP