Using a SonicWall with VoIP

Using a SonicWall and VoIP can be a challenging endeavor, so much so, that many VoIP providers will simply say that they will not support their service for a customer using a SonicWall.  To understand the complexities of why VoIP becomes such an issue for the Sonicwall to handle correctly one must understand that the SonicWall firewall router will NAT outbound port numbers to different values.  The SonicWall does provide a "Consistent NAT" option to help resolve this issue, but this does not correct the fact that port numbers are actually changed.  Changing outbound port numbers will cause issues with the VoIP traffic.  These issues can result in one-way audio and dropped calls.

Some background about the SonicWall

The SonicWall has a setting, SIP Transformations which transforms SIP messages between the LAN (trusted) and WAN/DMZ (untrusted).  According to SonicWall; If your SIP proxy is located on the public (WAN) side of the SonicWall (which is most always the case) and SIP clients are on the LAN side, the SIP clients by default embed/use their private IP address in the SIP/Session Definition Protocol (SDP) messages that are sent to the SIP proxy, hence these messages are not changed and the SIP proxy does not know how to get back to the client behind the SonicWall.  Selecting Enable SIP Transformations enables the SonicWall to go through each SIP message and change the private IP address and assigned port.  Enable SIP Transformation also controls and opens up the RTP/RTCP ports that need to be opened for the SIP session calls to happen. NAT translates Layer 3 addresses but not the Layer 7 SIP/SDP addresses, which is why you need to select Enable SIP Transformations to transform the SIP messages.  You need to check this setting when you want the SonicWALL security appliance to do the SIP transformation.
But, what is found most of the time is that; You Do Not Want SIP Transformations Enabled. 

SonicWall Settings for VoIP

Having SIP Transformations Enabled creates issues with the VoIP signaling as well as the RTP voice traffic.  For a recommended approach to try:

• Uncheck Enable SIP Transformations.
• Create inbound firewall/NAT rules for the ports you need.
• Try turning off Consistent NAT and configuring outbound NAT policies for your traffic, using the same port numbers as for the inbound traffic, for example, UDP 5060 for SIP Signaling.