Example: Configuring the SIP Proxy in the Private Zone and NAT in the Public Zone (CLI)

With the SIP proxy server in the internal, or private, zone, static NAT on the interface to the external, or public, zone is sufficient to allow callers in the public zone to register with the proxy server.

In this example, phone1 and the SIP proxy server are on the ge-0/0/0 interface in the private zone, and phone2 is on the ge-0/0/2 interface in the public zone. You configure static NAT on the ge-0/0/2 interface to the proxy server to allow phone2 to register with the proxy, then create a policy allowing SIP traffic from the public to the private zone to enable callers in the public zone to register with the proxy, and a policy from the private to the public zone to allow phone1 to call out. See Figure 25.

To configure the SIP proxy in the private zone and NAT in the public zone:

1. Configure interfaces.
   user@host# set interfaces ge-0/0/0 unit 0 family inet address 10.1.1.1/24user@host# set interfaces ge-0/0/2 unit 0 family inet address 1.1.1.1/24
2. Configure zones.
   user@host# set security zones security-zone privateuser@host# set security zones security-zone publicuser@host# set security zones security-zone private interfaces ge-0/0/0.0user@host# set security zones security-zone public interfaces ge-0/0/2.0
3. Configure addresses.
   user@host# set security zones security-zone private address-book address phone1 10.1.1.3/32user@host# set security zones security-zone private address-book address proxy 10.1.1.4/32user@host# set security zones security-zone public address-book address phone2 1.1.1.4/32
4. Configure static NAT.
   user@host# set security nat interface ge-0/0/2.0 static-nat 1.1.1.2/32 host 10.1.1.4/32
5. Configure policies.
   user@host# set security policies from-zone private to-zone public policy outgoing match source-address anyuser@host# set security policies from-zone private to-zone public policy outgoing match destination-address phone2user@host# set security policies from-zone private to-zone public policy outgoing match application junos-sipuser@host# set security policies from-zone private to-zone public policy outgoing then permit source-nat interfaceuser@host# set security policies from-zone public to-zone private policy incoming match source-address phone2user@host# set security policies from-zone public to-zone private policy incoming match destination-address static_nat_1.1.1.2_32user@host# set security policies from-zone public to-zone private policy incoming match application junos-sipuser@host# set security policies from-zone public to-zone private policy incoming then permit

Related Topics

• Junos OS Feature Support Reference for SRX Series and J Series Devices
• Understanding SIP ALGs and NAT
• SIP ALG Configuration Overview
• Verifying SIP ALG Configurations