Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
New Member

NAT w/ the IP phones

Would like some insight on what magic happens with IOS 12.1(5)T and above that allows the IP phones to be behind a router performing NAT...

Can successfully have IP phones on private addresses behind NAT when NAT is performed on IOS router - cannot figure out how to accomplish same when NAT is being performed on PIX or other firewall despite attempts from folks intimate w/ the firewalls and TAC.

Do not want to implement VPN's due to overhead and management headaches (many, many remote sites).

Will PIX at some point have the same magic as 12.1(5)T IOS? Is there some basic firewall programming to faciliate NAT that I am missing?

SYMPTOMS - other NAT'ing works fine with the firewall set-up - just not the phones....ultimately end up w/ half duplex....all TFTP loads happening and phones ringing etc leads me to believe TCP ports 2000 and 69 are working fine but RTP is not...

Any explanations or thoughts/assistance would be appreciated.


Cisco Employee

Re: NAT w/ the IP phones


Yes, the PIX does have the ability to do this for IP Phones and the Skinny protocol. See the Release Notes for PIX Firewall Version 6.0(1) at the following URL and look in the new software features.

You just need to configure fixup protocol skinny to turn it on. I have not personally done this yet, but I am told that this will work with NAT on the PIX but not PAT so please let us know what you find on this matter (or anyone else).

New Member

Re: NAT w/ the IP phones

Thanks for your thoughts -

Have tried this command w/ TAC's assistance but, as you might expect, looking to perform PAT - have several sites w/ many phones and do not have enough available public IP addresses.

Any visibility as to why PAT functionality is not available? Is it scheduled in development?

Alternative at this point is to configure network to have router perform NAT/PAT which is inconvenient/awkward in many instances.

Still struggling to understand why PAT won't work....Call signalling seems to work fine - RTP (the voice path) doesn't - why the problem with RTP/UDP...Pardon my ignorance.

Cisco Employee

Re: NAT w/ the IP phones

Like I mentioned, I had only heard this, and not experienced it myself. I will see if I can find out more details about this and let you know.

Cisco Employee

Re: NAT w/ the IP phones

I talked to a couple folks and I don't have any visibility on if/when Skinny will work with PAT on the PIX.

It looks like the way to do this right now if you don't have enough public IP addresses to do straight NAT is to use the router to perform the translation.

What you could do is have the NAT access-list on the router setup so that it would only translate for the IP phones, since that is the only reason you would even need to run NAT on the router anyway. At least then the rest of things will still be setup the way you normally would.

CreatePlease to create content