Re: [EXTERNAL] Re: Wifi Calling Firewall Holes to Punch

["Lyden, John C" <lyden () rowan edu>]

Jason/Josh:

Thanks for the input. The issue isn't NAT (we're not NATing). The issue is without NAT, the Wifi Calling feature 
apparently chooses to initiate inbound from the carrier to the client. When NAT'd, the client recognizes the NAT and 
initiates on its own. Or at least that what it appears. I calls 'em like I sees 'em. Whale biologist.


If anybody has AT&T, TMo and Sprint (because I suppose we need to hold on to them as separate objects until the merger 
is complete) it'd be much appreciated. AT&T only lists FQDN's here: 
https://www.att.com/support/article/wireless/KM1114459/ (which the Palo should [SHOULD] understand) but...paranoia I 
guess. Others have listed TMo as 208.54.0.0/17 and 66.94.0.0/19 as recently as 2018, and Sprint has exactly nothing.

And as I type this, someone chimed in offlist seconding 280.54.0.0/17 for TMo, so I'll add that to my list.

Thanks again everyone?!



John C. Lyden
Manager of Network Infrastructure, Infrastructure Services
Division of Information Resources & Technology

Rowan University
201 Mullica Hill Road, Glassboro, NJ 08028
rowan.edu/irt<http://rowan.edu/irt>

________________________________
From: Jason Alderfer <alderfjh () emu edu>
Sent: Friday, July 17, 2020 5:00 PM
To: Lyden, John C
Cc: nanog () nanog org
Subject: [EXTERNAL] Re: Wifi Calling Firewall Holes to Punch

In our university environment, wifi calling works just fine over NAT and we have not made any inbound port exceptions 
in the firewall for it.  The critical piece for (non-enterprise) VoIP traffic is that your firewall must not try to 
function as a SIP ALG, but I'm not sure that's directly relevant to wifi calling for the major carriers.

Jason Alderfer
Director of Technology SystemsEastern Mennonite University


On Fri, Jul 17, 2020 at 12:40 PM Lyden, John C <lyden () rowan edu<mailto:lyden () rowan edu>> wrote:
Hey gang.

We're setting up a unified wireless network for the students here, and to get around the issues with Nintendo and NAT 
we devoted a large chunk of public IP space to them.

We're aware that this is causing issues with wifi calling on Verizon, TMo etc because it appears they initiate the SIP 
session inbound.

Does anybody have a handy list of IP blocks and ports? T-Mobile had a decent page but other providers just said "open 
up 4500 and 500" and our ISO guys don't like that.

Thanks if someone can help.

John C. Lyden
Manager of Network Infrastructure, Infrastructure Services
Division of Information Resources & Technology, Rowan University