Motorola ATA behind Cisco Pix 501 firewall

Posts: 12

Any of you running your Vonage ATA box behind a Pix 501? I can't even get the Pix to issue a DHCP address to the ATA, and wondered if you had any mojo you'd like to share before I delve into some sniffer traces.

Even though the ATA offers QoS, I think I'll forgo that since it opens lots of strange ports to the outside world - I'd like mine behind a real firewall.

Thanks in advance,

Posts: 2 · New Forum Member Joined: Dec 31, 2003 Posts: 2

I tried placing the Motorola VT-1000 behind my Cisco PIX 501 and I could not get things running too. The Motorola ATA would not pick up a DHCP Address. I have been working with Customer Care, but they suggested that I place the ATA in front of the PIX... Not my preference either.

Posts: 12

I placed the Motorola ATA right behind the cable modem and forwarded port 23 to a non-existent IP address (the only port that would indiscriminately accept connections).

I did it because it gives me QoS, which is nice I spose.

I think the ATA behind the Pix would work if you assign the ATA a static IP and set the DNS entries to the ones on your cable modem network.

-Martin

Posts: 2 · New Forum Member Joined: Dec 31, 2003 Posts: 2

Placing the ATA directly behind the Broadband Modem works fine. However, I did encounter days in which I would have to reset the ATA to get the phone to work. At least it was my experience...

The Motorola ATA doesn't seem to like the Cisco PIX's DHCP Server setup. If enabled, the ATA would not pick up an address from the lease pool. When I tried to manually assign the static IP Address. The ATA would not retain the configuration. So I ended up temporarily disabling the DHCP Server on the PIX and manually configuring the ATA for the internal static address and it worked. I assigned the NAT and set the Access List with the necessary ports open and the ATA was able to pickup the configuration and thus get a dial-tone. At the end... I enabled the DHCP Server on the PIX and rebooted the ATA to make sure that things still worked and it did.

I am experiencing some echo and distortion... but I had that all day after talking to tech support the day before. I am not sure if it is because the lack of QoS... or some tweaks that may have been applied by tech support.

As said and done... the ATA does seem to work behind a PIX 501.

Regards,
Matthew

Posts: 2 · New Forum Member Joined: Jan 12, 2004 Posts: 2

When I had my ATA outside of my Pix, I could not keep a VPN connection to work. I moved the ATA inside my Pix and reconfigured it to have a static IP, opened the dozen or so ports that the book said were required, setup the PATs in the Pix configuration, and everything is working.

Does anybody know exactly what ports are required? The Motorola manual lists UDP 10000 thru 10011, along with 5061. The Vonage manual lists UDP 10000 thru 20000, 5060 and 5061. I went with what Motorola says and everything appears to be working. I just don't want to miss something that may be required.

Matt

Posted: Wed Jan 28, 2004 9:11 am Post subject:

Shouldn't the fixups work such that you _shouldn't_ have to open any ports?

Posts: 15 · Vonage Forum Associate Joined: Jan 23, 2004 Posts: 15

I also had trouble with my Vonage box outside my router. I only ran it that way for a couple of days but I found it needed about a reset a day. I settled for putting it behind my router for now.

Posts: 6 · New Forum Member Joined: Jun 02, 2005 Posts: 6

I have my ATA behind a Checkpoint firewall that also does my routing.
I assigned the ATA a private IP on my DMZ and opened all outbound access.
On the firewall I created a bunch of service (port) redirects for inbound traffic.
Not only do I not get any dial tone, and of course I have no Voip led on the ATA. The mystery in this whole thing is that the only traffic I see coming from the traffic is DNS (udp 53) traffic. Isn't it supposed to be imitating a lot of SIP traffic????

The service ports I was told to open were the following:
TCP&UDP:1024 1026 1028 1030 5060 9060 9065 10000-20000

I set everything up in the WAN configuration section:
I set the gateway to the DMZ interface and entered GE's 4.2.2.2 and 4.2.2.3 as DNS servers

I think the DNS traffic I see comes from my console plugged in the ATA's management interface.

Could anyone provide any insight or recommendations?