VOIP is only one way. Please help me on firewall rules especially NAT.

Did you configure Network Protection -> Voip ?

First, let me see if I understand your environment:

You core switch (IP 172.16.2.1) handles all routing between networks.

You have a static route on your UTM pointing traffic with destination 172.16.16.0/21 to 172.16.2.1

You are NATing requests from your VPN SSL Pool to the 172.16.16.0/21 (SIP) network.

Is that it?

Regards,

Giovani

One way voice issue? Check my response here. 

https://community.sophos.com/products/unified-threat-management/f/network-protection-firewall-nat-qos-ips/80754/allowing-remote-worker-to-use-voip-pbx-via-vpn

In your case it sounds like you need to add the subnet 172.16.16.0/21 to your one of your sip configuration files

Hi apijnappels,

I tried bought sip and h323 helpers,  but my voip works on proprietary service ports..  Alcatel... I wish to know what my firewall rules should be..

Rgds,

Dan

Hi Giovani,

The first two points are correct.   Im not really a NAT guy so i dont know if i understand the third point.  I think there is no NAT between ssl vpn and inside local network... I tried snat and dnat but i dont know if the variables are correct..  I dont know exactly what to put..

Rgds,

Dan

Hi rsenio,

I'll check with my voip guy.  It's a ALE omni pcx box.  I downloaded the voip config from the server through vpn so im sure server can see remote user.   Problem is ssl users cannot be heard during a call.  Do i need some firewall rules set?

Rgds,

Dan

You'll most likely need to have firewall rules for all RTP traffic ports that the VOIP server is using. Have you also looked at the Voip settings inside Webadmin?

I'm thinking that the only way this communication would happen without masquerading packets from the SSL VPN is if you core switch also has a route pointing  172.16.200.0/22 (SSL VPN Pool) to 172.16.2.2 (UTM). Is that the case?

Could you provide us with some screenshots of your firewall rules allowing SSL VPN -> SIP communication so we can get a feel of your setup? Also, do you see any blocked packets at the firewall log when doing a SIP call from an endpoint connected to the SSL VPN? If you do, sharing some of these logs would be nice. 

Anyway, I don't think this is firewall related as you appear to be able to reach your SIP server without issues from the SSL VPN. I would bet rsenio's suggestion is most likely to be the answer to your issue. I have very little experience with VoIP, but his suggestion just makes sense to me.

Regards,

Giovani

You'll want to ensure the traffic is flowing properly without a firewall issue on the VPN for sure. But the PBX is going to need that entry in the sip config files. I've encountered this many times.

Hi Giovani,

Yes the core switch has a working route to 172.16.200.0/22 to 172.16.2.2. 

Here is a screen shot of my firewall rules.

Im still checking out with my voip guy regarding Rsenio's suggestion.  Thanks.

Rgds,
Dan