One-Way Audio Through Expressway-E Static NAT
Globex has 400 remote users on MRA. Expressway-E has internal interface 10.20.5.10 and external 203.0.113.25 with static NAT. The firewall allows inbound TCP 443, TCP 5060-5061, and UDP 3478 to the NAT address; outbound is any. Expressway-E is configured with media traversal and the default media port range 36000-59999. Users can register and calls ring in both directions, but external users hear no audio from internal endpoints; internal users hear external users. Calls remain connected for about 20 seconds and then clear. A packet capture on the outside interface shows RTP leaving 203.0.113.25 from UDP ports 41000-41120 toward the external client, but the firewall's drop log shows those packets denied inbound. The carrier NAT is not symmetric. No SIP ALG is enabled. The customer wants to avoid putting Expressway-E on a public IP.
1. Why do calls ring but have one-way audio, and what is the most likely firewall cause?
Read the worked answer
Signaling uses TCP 5061, which is allowed inbound; call setup therefore succeeds. MRA media is relayed by Expressway-E using the configured media port range 36000-59999. The capture shows RTP leaving the public NAT address from 41000-41120, but the firewall drop log denies those packets inbound. That means the firewall permits call control and TURN but not the media relay range. Stateful inspection alone is not sufficient when the external client sends media to a port in that range and no prior outbound flow exists for that five-tuple. The 20-second clear is consistent with missing RTP and media timeout. A codec mismatch would normally produce a SIP 488 or 415, not a clean ring with no audio. A one-way audio pattern where only one direction is missing also fits a partially open port range or asymmetric NAT.
2. What NAT and firewall changes are required, and how would you verify them?
Read the worked answer
Add an inbound rule on the public firewall permitting UDP 36000-59999 from the internet to the static NAT address 203.0.113.25, in addition to TCP 5060-5061 and UDP 3478. Keep the NAT as a one-to-one static translation with no port translation. Configure Expressway-E with its external IP and confirm the media port range matches the firewall rule. Do not enable SIP ALG; it rewrites SDP and can cause one-way audio. Validate with simultaneous captures inside and outside: the RTP source ports should be in the range and the payload should survive NAT unchanged. On Expressway-E, check media session status and TURN allocation. Test an external-to-internal call in both directions, then a conference with two external participants. If audio works after the rule but fails after 20 seconds, check the firewall's UDP timeout and enable RTP keepalives or reduce the Expressway media port range to a smaller managed block.
3. If the customer refuses to open a wide UDP range, what options remain?
Read the worked answer
Options are constrained because MRA media must reach Expressway-E. You can narrow the media port range on Expressway-E to a smaller documented block and open only that block, but capacity limits the number of concurrent calls. You can place Expressway-E on a public IP with a host firewall, or use a cloud edge service that terminates media closer to users. TURN over TCP 443 can help with restrictive networks but adds overhead and is not a full substitute for UDP media. Do not disable media traversal unless every call can use a direct path, which MRA cannot guarantee. The trade-off is security exposure versus call capacity; document the size of the opened range and monitor it.