SIP NAT Function

This section explains how to configure the optional SIP NAT function. You can configure the SIP NAT function if you need to translate IP address and UDP/TCP port information. The SIP NAT function also prevents private IP addresses in SIP message URIs from traveling through an untrusted network.

Overview

TheOracle® Enterprise Session Border Controller is an intermediary device that provides NAT functions between two or more realms. It translates IP addresses between untrusted and trusted networks using NAT. A trusted network is inside the NAT, and a untrusted network is outside the NAT. A NAT also lets a single IP address represent a group of computers.

For SIP, the SIP NAT function on the Oracle® Enterprise Session Border Controller does the following:

routes SIP packets between the Oracle® Enterprise Session Border Controller’s SIP proxy (B2BUA) and external networks (or realms), including the translation of IP address and UDP/TCP port information.
prevents private IP addresses in SIP message URIs from traveling through the untrusted network. SIP NAT either translates the private address to one appropriate for an untrusted address or encrypts the private address into the URI.

Packets arriving on the external address (at port 5060) are forwarded to the Oracle® Enterprise Session Border Controller’s SIP proxy with the source address changed to the home address (at port 5060). When the Oracle® Enterprise Session Border Controller’s SIP proxy sends packets to the home address (at port 5060), they are forwarded to the external proxy address (and external proxy port), with the source address changed to the external address (at port 5060).

Note:

The SIP config’s NAT mode parameter works in conjunction with the SIP NAT function configuration. It identifies the type of realm in which the SIP proxy is located (public or private) and affects whether IPvr addresses in SIP messages are encoded.

The translation of URIs in the actual SIP message occurs as messages are received and sent from the Oracle® Enterprise Session Border Controller’s SIP proxy. For the messages being sent to the external network, the contents of the SIP message are examined after the translation to determine if the destination needs to be changed from the external proxy address to an address and port indicated by the SIP message. This process takes place so the request is sent to where the Request-URI or the Route header indicates, or so the response is sent to where the Via indicates.

NAT Modes

The specific addresses used in translating URIs in the SIP message depend on whether the Oracle® Enterprise Session Border Controller is performing NAT functions for a trusted or untrusted network. This condition is determined by the NAT mode value you enter when you configure the SIP config element. The NAT modes are:

untrusted—The SIP proxy is associated with an address for an untrusted network (the address value you entered when you configured the SIP interface’s SIP port parameter), and the home address in the SIP NAT is the address of the external realm/network. When the URI contains the external address, it is translated to the SIP NAT’s home proxy address (or to the SIP port address if the home proxy address field is empty). When a URI contains the external proxy address, it is translated to the home address.
If the URI contains any other private address (matching the realm’s address prefix, identified in the SIP NAT’s realm ID), it is encrypted and the address is replaced with the home address value. If the URI contains a user part, a suffix consisting of the user NAT tag and the encrypted address is appended to the user part. For example, with a user NAT tag value of -private-, the private URI of sip@123192.169.200.17:5060 will become the public URI of sip:123-private-eolmhet2chbl3@172.16.0.15.

If there is no user part, the host consists of the host NAT tag followed by the encrypted address and the domain suffix. A maddr parameter equal to the home address (or received in the case of a Via header) is added to the URI. For example, with a host NAT tag value of PRIVATE- and a domain suffix value of private.com, the private URI of sip:192.168.200.17:5060 will become the public URI of sip:PRIVATE-eolmhet2chbl3.private.com:5060;maddr=172.16.0.15.
trusted—The SIP proxy is on a trusted network (the address value you entered when you configured the SIP interface’s SIP port parameter), and the SIP NAT’s external address is the public address of the external realm/network. When the URI contains the home address value, it is translated to the value set for the external proxy address. When the URI contains the SIP proxy’s address, it is translated to the external address. If the URI contains any other private address (matching the realm’s address prefix, identified in the SIP NAT’s realm ID), the private address is encrypted and the address is replaced with the external address.

Note:
Do not use the home proxy address value with private NAT functioning.

Adding a maddr Parameter to a URI

When you configure a SIP interface, you can configure the contact mode. The contact mode sets the contact header routing mode, which determines how the contact address from a trusted network is formatted. You set the contact mode to add a maddr parameter equal to the SIP proxy to the URI in the Contact header. For example, the URI from the prior example (sip:192.168.200.17:5060) becomes sip:123-trusted-eolmhet2chbl3@172.16.0.15;maddr=172.16.0.12.

Note:

For SIP elements that do not support the maddr parameter, configure a Contact mode as none.

You might require this encryption to cause other SIP elements in the untrusted network to send requests directly to the SIP proxy. Otherwise, the requests are sent to the home address. However, responses sent by the SIP proxy will have the SIP proxy’s source address, rather than the home address. Some SIP elements might drop responses that come from a IP address different from the one to which the request is sent.

About Headers

You can specify which SIP headers you want effected by the SIP NAT function. The URIs in these headers are translated and encrypted, the encryption occurs according to the rules of this SIP NAT function.

You can enter header values by using either the full header name or its corresponding abbreviation, if applicable. The following table lists the available headers and their corresponding abbreviations.

Header	Abbreviation
Call-ID	i
Contact	m
From	f
Record-Route	none
Route	none
Ready-To	none
Replaces	none
Refer-To	r
To	t
Via	v

SIP sessions are terminated and re-originated as new sessions as they are routed through the Oracle® Enterprise Session Border Controller. Among the actions performed, SIP headers are modified to prevent the transmission of IP address and route information.

Replacing Headers

In the SIP signaling message, any Via headers are stripped out and a new one is constructed with the Oracle® Enterprise Session Border Controller’s IP address in the sent-by portion. If a Contact header is present, it is replaced with one that has the Oracle® Enterprise Session Border Controller’s IP address. All other headers are subject to NATing based on the following rules:

The Request-URI is replaced with the next hop’s IP or FQDN address.
All other headers are replaced based on the two SIP NAT function SIP NAT function rules

Mapping FQDNs

The Oracle® Enterprise Session Border Controller maps FQDNs that appear in the certain headers of incoming SIP messages to the IP address that the SBC inserts in outgoing SIP contact headers. The mapped FQDNs are restored in the SIP headers in messages that are sent back to the originator.

This feature is useful to carriers that use IP addresses in the SIP From address to create trunk groups in a softswitch for routing purposes. When the carrier’s peer uses FQDNs, the carrier is forced to create trunk groups for each possible FQDN that it might receive from a given peer. Similarly, this can apply to SIP Contact and P-Asserted-Identity headers.

SIP NAT Function Cookies

Cookies are inserted to hide that information is coming from a realm external to the home realm. They are used when information needs to be placed into a given element of a SIP message that must also be seen in subsequent SIP messages within a flow. When forwarding a SIP message, the Oracle® Enterprise Session Border Controller (E-SBC) encodes various information in the outgoing message, which is passed from one side to another in SIP transactions.

SIP NAT function cookies let the E-SBC hide headers, IPv4 addresses, and SIP URIs. These cookies are included when certain conditions are present in E-SBC SIP transactions.

Oracle’s SIP NAT function cookies can be used in the userinfo, host, URL parameter, and tel URL parameter portions of the SIP message.

userinfo

The Oracle® Enterprise Session Border Controller places a cookie in the userinfo portion of a SIP URI when a SIP header contains a SIP URI, and includes that header type in the list of headers to be hidden (encrypted) in the associated SIP NAT function. The cookie for the userinfo portion is the following:

[user nat tag][encrypted 13-byte host IP][encrypted 13 byte maddr IP (if present)]

where:

[user nat tag] refers to the SIP NAT function’s original user NAT tag field.
[encrypted 13-byte host IP] refers to the host IP encryption.
[encrypted 13 byte maddr IP (if present)] refers to the maddr IP encryption, if it exists.

With a user NAT tag of -acme, the following SIP-URI:

sip:6175551212@192.168.1.100

might be translated into:

sip:6175551212-acme-pfi1s7n2pstna@172.16.1.10

Note:

Multiple additional cookies might be appended with each hop (for example, from the external proxy to the home proxy and back).

host

When hiding IP addresses in a SIP message, the SIP NAT function generates the following cookie for a SIP-URI with no userinfo portion:

[host nat tag][encrypted 13-byte host IP][encrypted 13 byte maddr IP (if present)][domain suffix]

where:

[host nat tag] refers to the SIP NAT function’s host NAT tag.
[encrypted 13-byte host IP] refers to the host IP encryption.
[encrypted 13 byte maddr IP (if present)] refers to the maddr IP encryption, if it exists.
[domain suffix] refers to the SIP NAT function’s domain suffix field.

With a SIP NAT function’s host tag of ACME- and a domain suffix of .acme.com, the following SIP header:

Via: SIP/2.0/UDP 192.168.1.100:5060

might be translated into the following:

Via: SIP/2.0/UDP ACME-pfi1s7n2pstna.acme.com

URL Parameter

If the SIP NAT function’s use url parameter field has a value of from-to or all, the SIP NAT function places all cookies generated to hide SIP URIs in a custom tag appended to the header. Setting the use url parameter field to:

from-to only affects the behavior of the SIP NAT function’s cookies in the From and To headers.
all affects all SIP headers processed by the SIP NAT function

The cookie is the following:

[;url-parameter]=[host nat tag][encrypted 13-byte host IP][encrypted 13-byte maddr IP]

where:

[;url-parameter] refers to the SIP NAT function’s parameter name field.
This cookie type is associated with the all and from-to field value options of the SIP NAT function’s use url parameter field.
[host nat tag] refers to the SIP NAT function’s host NAT tag field.
[encrypted 13-byte host IP] refers to the host IP encryption.
[encrypted 13 byte maddr IP (if present)] refers to the maddr IP encryption, if it exists.

With a host NAT tag of ACME- and a parameter name of acme_param, the following SIP-URI:

sip:6175551212@192.168.1.100

might be translated into the following:

sip:6175551212@172.16.1.10;acme_param=ACME-pfi1s7n2pstna.

tel URL

The SIP NAT function cookie is used when devices in your network are strict about the context portion of SIP messages regarding the conversion of tel URLs. This cookie for the tel URL parameter portion of a SIP message is the following:

tel URL parameter-[13-byte host IP][13 byte optional maddr IP]domain suffix

where:

tel URL parameter refers to the SIP NAT function’s use url parameter.
This cookie type is associated with the use url parameter’s phone field value for the SIP NAT.
[13-byte host IP] refers to the host IP encryption.
[13 byte optional maddr IP] refers to the maddr IP encryption, if it exists.
domain suffix refers to the SIP NAT function’s domain suffix field.

Configuration Overview

Configuring the SIP NAT function falls into two areas, the SIP NAT interface parameters and the SIP NAT policies.

SIP NAT Interface

The following tables lists the SIP NAT function interface parameters you need to configure on the Oracle® Enterprise Session Border Controller (E-SBC).

Parameter	Description
realm ID	Name of the external realm. The realm ID must be unique; no two SIP NATs can have the same realm ID. This realm ID must also correspond to a valid realm identifier entered when you configured the realm.
external proxy address	IPv4 address of the SIP element (for example, a SIP proxy) in the external network with which the E-SBC communicates. Entries must follow the IP address format.
external proxy port	UDP/TCP port of the SIP element (for example, a SIP proxy) in the external network with which the E-SBC communicates. Minimum value is 1025, and maximum value is 65535. Default is 5060.
external address	IPv4 address on the media interface in the external realm. Enter a value that ensures any packet with an external address value as its destination address is routed to the E-SBC through the media interface connected to or routable from the external realm. Entries must follow the IP address format. To specify whether the external realm referenced in this field is private or public, configure the SIP config’s NAT mode.
home address	IPv4 address on the media interface in the home realm. Enter a value that ensures any packet with a home address value as its destination address must be routed to the E-SBC through the media interface connected to or routable from the home realm. Entries must follow the IP address format. The value entered in this field must be different from the IP address value of the home realm’s network interface element. The home realm network interface is associated with this SIP NAT by its realm ID and the realm’s identifier and network interface value you entered when you configured the realm. The realm’s network interface identifier value corresponds to this SIP NAT’s realm ID, the SIP config’s home realm ID, and the media manager’s home realm ID.
home proxy address	Sets the IP address for the home proxy (from the perspective of the external realm). By default, this field is empty. An empty home proxy address field value signifies that there is no home proxy, and the external address will translate to the address of the E-SBC ’s SIP proxy. Entries must follow the IP address format.
home proxy port	Sets the port number for the home realm proxy. Value can be set to zero (0). Minimum is 1025 and maximum is 65535. Default is 5060.
route home proxy	Whether to route all inbound requests for the SIP NAT to the home proxy. enabled adds route if Request-URI is not the E-SBC disabled does not route inbound requests to the home proxy forced always adds route

SIP NAT Function Policies

The following tables lists the SIP NAT function policy parameters you need to configure on the Oracle® Enterprise Session Border Controller (E-SBC).

Parameter	Description
domain suffix	Domain name suffix of the external realm. The domain name suffix refers to and must conform to the hostname part of a URI. In combination with the user NAT tag and host NAT tag values, this value is used to help the E-SBC identify an encoded URI that it needs to translate when moving between public and private realms. This suffix is appended to encoded hostnames that the SIP NAT function creates. For example, if the encoded hostname is ACME-abc123 and the domain-suffix value is .netnetsystem.com, the resulting FQDN will be ACME-abc123.netnetsystem.com.
address prefix	Defines which IPv4 address prefixes from incoming messages require SIP-NAT encoding (regardless of the realm from which these messages came).
tunnel redirect	Controls whether Contact headers in a 3xx Response message received by the E-SBC are NATed when sent to the initiator of the SIP INVITE message.
use url parameter	Establishes whether SIP headers will use the URL parameter entered in the parameter name for encoded addresses that the SIP NAT function creates. Also, if SIP headers will be used, which type of headers will use the URL parameter. For example, all headers or just the From and To headers. Enumeration field.
parameter name	Indicates the name of the URL parameter when use url applies. This field value will be used in SIP NAT encoding addresses that have a use url parameter value of either from-to or all.
user NAT tag	Identifies the prefix used when an address is encoded into the username portion of user@host;name=xxxx; where name = parameter name. The user NAT tag values can consist of any characters that are valid for the userinfo part of a URI. In combination with the domain suffix and host NAT tag field values, this value is used to help the E-SBC identify an encoded URI that it needs to translate when moving between public and private realms.
host NAT tag	Identifies the prefix used when encoding an address into the hostname part of the URI or into a URL parameter. The host NAT tag values refer to domain labels and can consist of any characters that are valid for the hostname part of a URI. In combination with the domain suffix and user NAT tag values, this value is used to help the E-SBC identify an encoded URI that it needs to translate when moving between public and private realms.
headers	Lists the SIP headers to be affected by the E-SBC SIP NAT function. The URIs in these headers will be translated and encrypted, and encryption will occur according to the rules of this SIP NAT.

SIP NAT Function Configuration

To configure the SIP NAT function on an Oracle® Enterprise Session Border Controller (E-SBC):

In Superuser mode, type configure terminal and press Enter.
```
ORACLE# configure terminal
```
Type session-router and press Enter to access the system-level configuration elements.
```
ORACLE(configure)# session-router
```
Type sip-nat and press Enter. The system prompt changes to let you know that you can begin configuring individual parameters.
```
ORACLE(session-router)# sip-nat
ORACLE(sip-nat)#
```
realm-ID—Enter the name of the realm you want to identify as the external realm.

The name you use as the realm ID must be unique. No two SIP NAT functions can have the same realm ID. Also, this value must correspond to a valid identifier entry already configured for the realm.
domain-suffix—Enter the domain suffix to identify the domain name suffix of the external realm. The domain suffix must begin with a (.) dot.
The domain name suffix refers to and must conform to the hostname part of a URI. For example:
```
.netnetsystem.com
```
The domain suffix is appended to encoded hostnames that the SIP NAT function creates. For example, if the encoded hostname is ACME-abc123, the resulting FQDN is ACME-abc123.netnetsystem.com.
external-proxy-address—Enter the external proxy address to identify the IPv4 address of the SIP element (for example, a SIP proxy) in the external network with which the E-SBC communicates.
Enter the value in the IP address format. For example:
```
192.168.11.200
```
external-proxy-port—Enter the external proxy port value to identify the UDP/TCP port of the SIP element (for example, a SIP proxy) in the external network with which the E-SBC communicates. The default is 5060. The valid range is:
- Minimum—1025
- Maximum—65535
external-address—Enter the external address, which is an IPv4 address on the media interface in the external realm.
Enter the value in the IP address format. For example:
```
192.168.11.101
```
This value must be such that any packet with an external address value as its destination address is routed to the E-SBC through the media interface connected to or routable from the external realm.
home-address—Enter the home address, which is an IPv4 address on the network interface in the home realm. This value must be such that any packet with a home address value as its destination address must be routed to the E-SBC through the media interface connected to or routable from the home realm.
Enter the value in the IP address format. For example:
```
127.0.0.10
```
The value entered in this field must be different from the IP address value of the home realm’s network interface element.

The home realm network interface is associated with this SIP NAT by its realm ID and the realm’s identifier and network interface value you entered when you configured the realm. The realm’s network interface identifier value corresponds to this SIP NAT’s realm ID, the SIP config’s home realm ID, and the media manager’s home realm ID.
home-proxy-address—Enter the home proxy address to set the IP address for the home proxy (from the perspective of the external realm).
By default, this field is empty. No home proxy address entry signifies there is no home proxy, and the external address will translate to the address of the E-SBC’s SIP proxy.

Enter the value in the IP address format. For example:
```
127.1.0.10
```
home-proxy-port—Enter the home proxy port to set the port number for the home realm proxy. The default value is 0. The valid range is:
- Minimum—0, 1025
- Maximum—65535
route-home-proxy—Optional. Enable or disable requests being routed from a given SIP-NAT to the home proxy. The default value is disabled. The valid values are:
- enabled—All inbound requests for a specific SIP NAT are routed to the home proxy
- disabled—All inbound requests are not routed through the home proxy.
- forced—The Request is forwarded to the home proxy without using a local policy.
address-prefix—Optional. Indicate the IPv4 address prefix from incoming messages that requires SIP NAT function encoding (regardless of the realm from which these messages came).

Note:
This value overrides the value set in the realm’s address prefix field.

This field’s format incorporates an IPv4 address and number of bits in the network portion of the address. For example, a Class C address has a 24-bit network part. The address prefix for 101.102.103.x would be represented as 10.102.103.0/24.

The default value is an asterisk (*). When you enter this value or do not enter a value, the realm’s address prefix value is used.
tunnel-redirect—Set to one of the following values to indicate whether certain headers in a 3xx Response message received by the E-SBC are NATed when sent to the initiator of the SIP INVITE message. The default is disabled. The valid values are:
- enabled—Certain headers in a 3xx Response message are NATed.
- disabled—Certain headers in a 3xx Response message are not NATed.
use-url-parameter—Establish whether SIP headers will use the URL parameter (configured in the next step) for encoded addresses created by the SIP NAT function. If SIP headers will be used, this value identifies which types of headers will use the URL parameter. The default value is none. The available values include:
- none—No headers will use the URL parameter for address encoding.
  
  The following example illustrates the functionality of an E-SBC using a use url parameter value of none:
```
sip: 1234@1.2.3.4 is translated into sip: 1234-acme-xxxx@5.6.7.8
```
  where -acme-xxxx is a cookie and xxxx is the encoded version of 1.2.3.4.
- from-to—From and To headers will use the URL parameter for address encoding
  
  The following example illustrates the functionality of a E-SBC using a use url parameter value of none:
```
sip: 1234@1.2.3.4 is translated into sip: 1234@5.6.7.8; pn=acme-xxxx
```
  where -acme-xxxx is a cookie and xxxx is the encoded version of 1.2.3.4.
- all—All headers will use the URL parameter for address encoding. Acme Packet recommends not using this values because other SIP elements or implementations (other than the Oracle® Enterprise Session Border Controller) might not retain the URL parameter in subsequent SIP messages that they send to the Oracle® Enterprise Session Border Controller.
- phone—
  
  If this field is set to either from-to or all, the E-SBC puts the encoded address of the SIP NAT into a URL parameter instead of using the encoding name inside the userinfo part of the address.
parameter-name—If you have configured the use-url-parameter with the from-to or all value, you need to indicate the hostname prefix.

The parameter name value is used in SIP NAT encoding addresses that have the use url parameter values of from-to or all.
user-NAT-tag—Enter a value to identify the username prefix used for SIP URIs. The values you can use can include any characters valid for the userinfo part of a URI. This should be made unique for each realm and SIP NAT function.

The default value is -acme-.

In combination with the domain suffix and host NAT tag values, this value is used to help the E-SBC identify an encoded URI that it needs to translate when moving between public and private realms.
host-NAT-tag—Enter a value for the host NAT tag field to identify the hostname prefix used for SIP URIs. The value refers to domain labels and can include any characters valid for the hostname part of the URI. This should be made unique for each realm and SIP NAT function.

The default value is ACME-.

In combination with the domain suffix and user NAT tag values, this value is used to help the E-SBC identify an encoded URI that it needs to translate when moving between public and private realms.
headers—List the SIP headers you want affected by the SIP NAT function. The URIs in these headers are translated and encrypted, and encryption occurs according to the SIP NAT function rules.

To enter the full default list, type headers, followed by a Space and -d, then press Enter.

You can also insert the following tags in SIP NAT headers if you want to replace FQDNs with next hop or SIP interface IP addresses:
- fqdn-ip-tgt: replaces the FQDN with the target address
- fqdn-ip-ext: replaces the FQDN with the SIP NAT external address
  
  Enter the tag using the following format:
  
  <header-name>=<tag>
  
  For example:
  
  To=fqdn-ip-tgt
  
  The FQDN in a To header is replaced with the target IP address.
  
  You can insert the following tags to apply NAT treatment to a From header in an INVITE when the gateway sends it into the home realm.
- ip-ip-tgt: replaces any IP address in the From header with the next hop target
- ip-ip-ext: replaces any IP address in the From header with the E-SBC’s external address
  
  To view all SIP NAT function parameters, enter a ? at the system prompt. The following example shows SIP NAT configuration for peering network.
```
sip-nat
        realm-id                       peer-1
        domain-suffix                  .p1.acme.com
        ext-proxy-address              192.168.11.200
        ext-proxy-port                 5060
        ext-address                    192.168.11.101
        home-address                   127.0.0.10
        home-proxy-address             127.1.0.10
        home-proxy-port                5060
        route-home-proxy               enabled
        address-prefix                 *
        tunnel-redirect                disabled
        use-url-parameter              none
        parameter-name
        user-nat-tag                   -p1-
        host-nat-tag                   P1-
        headers                        Call-ID Contact From Join Record-Route
                                       Refer-To Replaces Reply-To Route To Via
                                       f i m r t v
```