Edge · NAT & firewall
Audit your edge firewall for the classic voice-killers: SIP ALG rewrites, symmetric NAT, missing keep-alives, and bad RTP port ranges. Generate disable commands for the common firewalls.
SIP ALG is the single biggest cause of cloud voice pain in SMB and enterprise branches alike. "It works for 90 seconds then audio drops" is the symptom. Disable ALG, fix NAT, open the right RTP ports, and 80% of audio issues vanish.
The tool generates three things: a disable-ALG command set for your vendor, a NAT/firewall rule template matching your SIP transport and RTP port range, and a test plan you can run from the CUBE or softphone.
SIP ALG inspects SIP headers, rewrites Contact and Via, pokes dynamic pinholes for RTP, and tries to help. In reality, it rewrites private IPs with a stale public, mangles SDP, pinholes the wrong ports, and misses re-INVITEs. The modern answer is: disable ALG at the edge, let CUBE/SBC handle NAT properly, and let the SBC put itself in the Contact.
Make sure your SBC (CUBE, Oracle, Ribbon) is configured for symmetric RTP — it sends media from the same public IP/port it received on. This way NAT pinholes stay open and the firewall session table recognizes the flow.
Only in very narrow SMB cases with a cheap ATA and no SBC. For any enterprise-grade deployment with a CUBE or cloud SBC, disable it.
ICE is the modern NAT-traversal mechanism. Cloud calling (Webex Calling, Teams) uses it. Your firewall just needs to let outbound UDP for STUN (3478) and TURN (3478 / 443) through. No rewrites needed.
Classic NAT binding expiration. Your SIP REGISTER keep-alive interval is longer than the firewall's UDP idle timeout. Either lower the register interval (CUBE: retry register 50) or raise the UDP idle timer on the firewall.
Disable SIP ALG in the Security & SD-WAN > Firewall tab (support-driven — raise a Meraki case to disable). Allow outbound UDP 5060-5062, TCP 5061, TLS 8934, UDP 8000-48198 to Webex regions.
policy-map global_policy ; class inspection_default ; no inspect sip. Then NAT: static (inside,outside) source static obj-cube obj-cube-pub.