Support #2594
openOutbound trnk
0%
Description
We're connecting an outbound trunk from our Cloudonix domain to a remote PBX that requires a static IP allowlist. Two questions:
Is the IP address for border.cloudonix.io static and guaranteed not to change? Our remote party will be hardcoding it into their SIP access control list.
What IP address(es) does RTP media originate from for outbound calls? Is it the same as the SIP signaling IP or different, and is it also static?
Updated by Oded Arbel 14 days ago
- Status changed from New to Resolved
Schlesinger David wrote:
Is the IP address for border.cloudonix.io static and guaranteed not to change?
The IP address 18.219.128.166 for border.cloudonix.io is static and guaranteed not to change. There other IP addresses (notably the IPv6 address) that are dynamic and will change. If you need to put the Cloudonix border address into your firewall configuration it is recommended that:
- Use an IPv4 address for the trunk address (to force use of the IPv4 static address)
- Set the Cloudonix trunk configuration field "Lock routing to this Cloudonix border server" to the address 18.219.128.166
What IP address(es) does RTP media originate from for outbound calls? Is it the same as the SIP signaling IP or different, and is it also static?
Unfortunately, the Cloudonix media servers are dynamic. Not only that but we have different media POPs around the world - and the system will automatically choose one based on various, sometimes dynamic, conditions. We are also in the habit of adding more POPs from time to time, to improve the Cloudonix service's audio latency.
RTP traffic is done on arbitrary ports in the "ephemeral ports range" and firewalls should take extra care not to block these. If you don't want to allow free global UDP traffic to ephemeral ports, then you should:
- Enable the SIP ALG functionality of your firewall - this system monitors SIP traffic for declarations of media servers and automatically white lists the detected sockets for the duration of the session.
- Make sure not to use TLS as the trunk protocol - otherwise the SIP ALG will not be able to scan the SIP traffic.
Please let us know if there's anything else we can help you with.