Log In

Come Join Us!

Are you a
Computer / IT professional?
Join Tek-Tips Forums!
  • Talk With Other Members
  • Be Notified Of Responses
    To Your Posts
  • Keyword Search
  • One-Click Access To Your
    Favorite Forums
  • Automated Signatures
    On Your Posts
  • Best Of All, It's Free!
  • Students Click Here

*Tek-Tips's functionality depends on members receiving e-mail. By joining you are opting in to receive e-mail.

Posting Guidelines

Promoting, selling, recruiting, coursework and thesis posting is forbidden.

Students Click Here


Best option for SIP failover

Best option for SIP failover

Best option for SIP failover

We've just started a migration to SIP and I'm looking for some advice on how best to ensure reliable failover or redundancy.

The PBX is an IP Office 9.1 and the SIP trunks are provided by Gamma via a reseller. We have Palo Alto PA-220 firewall connected to two different ISPs on two WAN interfaces. Each ISP has their own IP range. The idea is that WAN1 is a leased line, and WAN2 is a backup VDSL line. The Palo routes all traffic over WAN1 by default and automatically switches to WAN2 (by adding a new static route with a lower metric) if WAN1 loses connectivity. Once WAN1 comes back the Palo automatically removes the temporary route so all traffic goes back to WAN1.

The SIP trunks are configured on the IPO with static port blocks and the relevant ports have been opened on the firewall with a bi-directional static IP mapping to a dedicated public IP provided to us by ISP1 . This IP is hard-coded into the IPO config under network topology.

This works fine as long as ISP1 is up and running. However we've recently had a couple of issues with ISP1 and that has gotten us thinking about how to implement failover.

The problem as I see it is the public IP that has to be hard-coded into the SIP packets. Although traffic fails over to WAN2 with no problem, since the IPO is still putting the IP address from ISP1 into the SIP packets and thus the incoming SIP data is going to the wrong IP address.

My first thought was to use STUN to get the IPO to pick up the correct IP address. However it would appear STUN only runs once each time the IPO is rebooted. That would mean that in the event of WAN1 failing someone would have to manually reboot the IP Office in order for it to trigger STUN to pick up the correct public IP. This is clearly not ideal (although could be tolerable in a worst-case scenario if nothing else works)

Currently I'm wondering about some sort of border device. This could be a full blown SBC or it could just be some sort of SIP Proxy or B2BUA . The idea would be that we could connect ISP1 and ISP2 to two WAN ports on the border device, then connect the LAN on the IP Office to the LAN on the border device. We'd then configure the IP Office to use the LAN IP of the border device as the SIP trunk endpoint and configure our Gamma SIP trunks on the border device. The border device would need to be capable of failover so in the event ISP1 fails, the border device would re-establish the connection to Gamma using ISP2 instead. The IP Office could then happily sit there never needing to know what route traffic was using to actually go in and out of the network.

Does such a device exist? I know SBCs do, but I don't know if any of them have that sort of dual WAN failover capability (or if they do, are they stupidly expensive)? Alternatively is there a better way to provide redundancy/failover (for example can the IP Office be forced to re-poll the STUN server every few minutes?)

Thanks in advance for any suggestions.


Reincubate - Accelerating growth of start-up & entrepreneurial businesses

RE: Best option for SIP failover

you can do this with gamma active standby, speak to your business partner

RE: Best option for SIP failover

How would that work with the IP Office? I presume we could set up the standby trunk as a different SIP line but you'd still have the problem of it having the wrong IP address sent in the SIP packets as that's hard-coded on the LAN interface on the IP Office? Or am I being thick...

Reincubate - Accelerating growth of start-up & entrepreneurial businesses

RE: Best option for SIP failover

use both interfaces

RE: Best option for SIP failover

Not sure if this helps but the docs say

When selected, the system will rerun STUN discovery whenever the system is rebooted or connection failure to the SIP server occurs.

RE: Best option for SIP failover

Does the Palo-Alto do SIP transformations?

Whilst we usually turn it off and use network topology we have one customer with this type of setup and for them we do not use network topology but instead use SIP transformations to amend the SIP packets from the IPO to include the public IP instead of the private one, and the main benefit is the firewall adds the IP of whichever Internet connection the SIP is using at that time (be it primary or secondary connection).

But then this is using a voiceflex SIP trunk on username/password authentication and not IP authentication. With a Gamma trunk in this scenario you would still need to update the Gamma portal with the change of public IP address.


RE: Best option for SIP failover

Best option for Failover is an ISDN trunk vader2

That way you have a route that is completly independent form Internet/data network and.or Gamma failures.

Do things on the cheap & it will cost you dear

RE: Best option for SIP failover

Thanks for the suggestions. I had turned off the ALG on the Palo Alto but it may be worth seeing it will rewrite the packets properly (although I know most ALGs are pretty rubbish at doing that properly) The whole idea is to replace our existing ISDN30 so it wouldn't really make much sense keeping ISDN as a backup, although we are going to keep an analog line or two around in case of emergency. I'm also future-proofing as ISDN is on the way out (although I'll believe the 2025 deadline when I see it!)

I'll get our reseller to speak to Gamma to see if they have any options, even if it's as simple as registering our backup IP address against our SIP trunk or having a second trunk ready to be spun up on that IP.

If we did go the SBC or Sip Proxy route can anyone recommend any decent but affordable kit? I've heard people say good things about the Audiocodes devices...

Reincubate - Accelerating growth of start-up & entrepreneurial businesses

Red Flag This Post

Please let us know here why this post is inappropriate. Reasons such as off-topic, duplicates, flames, illegal, vulgar, or students posting their homework.

Red Flag Submitted

Thank you for helping keep Tek-Tips Forums free from inappropriate posts.
The Tek-Tips staff will check this out and take appropriate action.

Reply To This Thread

Posting in the Tek-Tips forums is a member-only feature.

Click Here to join Tek-Tips and talk with other members! Already a Member? Login

Close Box

Join Tek-Tips® Today!

Join your peers on the Internet's largest technical computer professional community.
It's easy to join and it's free.

Here's Why Members Love Tek-Tips Forums:

Register now while it's still free!

Already a member? Close this window and log in.

Join Us             Close