How to troubleshoot common VoIP issues?

While commonly playing the role of a Forwarder for VoIP traffic, there are possible issues that can arise from putting a firewall in line for SIP or H.323 Sessions.

This article will detail the common issues as well as how to resolve them on the SonicWall.

Issue - One Way Audio or No Audio

TIP: If the Public Branch Exchange (PBX) that the SIP Server communicates with is located behind the SonicWall then SIP transformations should be disabled in most deployments. Consult with your VoIP vendor.

TIP: If the PBX is located outside the SonicWall, usually on the public Internet, then SIP transformation should be enabled in most deployments. Consult with your VoIP vendor.

Resolution for SonicOS 7.X

This release includes significant user interface changes and many new features that are different from the SonicOS 6.5 and earlier firmware. The below resolution is for customers using SonicOS 7.X firmware.

• In order to enable or disable SIP transformations navigate to Network | VoIP, click Settings and examine the Enable SIP Transformations setting. 
  
  

Issue - Audio Quality Degradation

NOTE: Both SIP and H.323 have poor tolerance for latent connections. Because of this it is often necessary to optimize latency related settings on the SonicWall and other in-line network devices.   

• Perform an MTU Test on all WAN Interfaces that VoIP Traffic flows over. For information on how to do so please see: How to Test and Change the MTU Size of WAN Interfaces.
• Exempt the PBX and all IP Phones from Content Filtering.
             o Navigate to Policy| Security Services | Content Filter and exclude the necessary IP address ranges from Content Filtering.
• Exempt the PBX and all IP Phones from Single Sign-On.
             o Navigate to Device| Users | Settings and click Configure SSO.
             o On the pop-up window navigate to Enforcement. Click Add Bypass and include address object or service object for exclusion from SSO.
             TIP:  It may be necessary to utilize an address or service object group in many deployments.
  
             o Select Full Bypass (Don't Trigger SSO) and Save. This will populate the entry in the SSO Bypass field.
                  NOTE: It is also possible to Bypass SSO for an entire Zone, this is appropriate for deployments with a dedicated VoIP subnet.
  
  
• Ensure that all VoIP Traffic flows over a single WAN Interface.
             o If multiple WANs are in use along with WAN load balancing, navigate to Network| System | Failover & LB. On the default load balancing group ensure that Source and Destination IP Address Binding is selected.
             o If multiple routes are used for VoIP Traffic, ensure that all routes are setup with appropriate probes to denote when the relevant route is up or down.
• Configure Bandwidth Management and Quality of Service on the SonicWall
             o For information on bandwidth management see: Configuring Bandwidth Management.
             o For information on quality of service see How to Configure Quality of Service Settings.

Issue - Packet Loss or Quality Issues for VoIP over VPN

• Navigate to Network| IPSec VPN | Advanced ensure Enable Fragmented Packet Handling is checked while Ignore DF Bit is unchecked. Ensure Enable NAT Traversal is also checked.
• Navigate to Network| IPSec VPN | Rules and Settings and Configure the VPN policy for the VoIP traffic. Under the Advanced tab, check the option for Disable IPSec Anti-Replay.

Resolution for SonicOS 6.5

This release includes significant user interface changes and many new features that are different from the SonicOS 6.2 and earlier firmware. The below resolution is for customers using SonicOS 6.5 firmware.

• In order to enable or disable SIP transformations navigate to Manage | VoIP | Settings and examine the Enable SIP Transformations setting. 

Issue - Audio Quality Degradation

NOTE: Both SIP and H.323 have poor tolerance for latent connections. Because of this it is often necessary to optimize latency related settings on the SonicWall and other in-line network devices.

• Perform an MTU Test on all WAN Interfaces that VoIP Traffic flows over. For information on how to do so please see:  How to Test and Change the MTU Size of WAN Interfaces.
• Exempt the PBX and all IP Phones from Content Filtering.
  • Navigate to Security Services | Content Filter and exclude the necessary IP address ranges from Content Filtering.

• Exempt the PBX and all IP Phones from Single Sign-On.

•  Navigate to  Manage | Users | Settings and click Configure SSO.
• On the pop-up window navigate to Enforcement. Select Add and include address object or service object for exclusion from SSO.
  TIP: It may be necessary to utilize an address or service object group in many deployments.
• Select Full Bypass (Don't Trigger SSO) and Add. This will populate the entry in the SSO Bypass field.
  NOTE: It is also possible to Bypass SSO for an entire Zone, this is appropriate for deployments with a dedicated VoIP subnet.

• Ensure that all VoIP Traffic flows over a single WAN Interface.
  • If multiple WANs are in use along with WAN load balancing, navigate to  Manage | Network | Failover & LB. On the default load balancing group ensure that Source and Destination IP Address Binding is selected.
  • If multiple routes are used for VoIP Traffic, ensure that all routes are setup with appropriate probes to denote when the relevant route is up or down.

• Configure Bandwidth Management and Quality of Service on the SonicWall
  • For information on bandwidth management see: Configuring Bandwidth Management.
  • For information on quality of service see How to Configure Quality of Service Settings.

Issue - Packet Loss or Quality Issues for VoIP over VPN

• Navigate to Manage | VPN | Advanced ensure Enable Fragmented Packet Handling is checked while Ignore DF Bit is unchecked. Ensure Enable NAT Traversal is also checked.
• Navigate to  Manage | VPN | Settings and Configure the VPN policy for the VoIP traffic. Under the Advanced tab, check the option for Disable IPSec Anti-Replay.