Technical Tip: How to enable STUN protocol in policy
| Description | This article describes how to enable the STUN protocol in a firewall policy. |
| Scope | FortiOS in the default NGFW profile-based mode (with or without Central SNAT enabled). |
| Solution | STUN is a protocol used to allow UDP communication through a NAT device, such as an external firewall. Most commonly, it is used as a supporting protocol for VoIP technologies such as SIP; for more information, see the article Technical Tip: How STUN resolves SIP NAT issue.
By default, STUN configuration options are hidden in policies. Attempting to enable them generates an error.
FW01 # config firewall policy FW01 (policy) # edit 99 FW01 (99) # set permit-stun-host enable
command parse error before 'permit-stun-host' Command fail. Return code -61.
FW01 (99) #
To enable configuring STUN options, ensure the firewall policy handling outgoing VoIP signaling traffic has NAT enabled.
config firewall policy edit <index> set action accept set nat enable set permit-any-host disable set permit-stun-host disable next end
STUN options on firewall policies leverage expectation sessions to match incoming traffic from remote endpoints. Expectation sessions are more commonly encountered when working with FortiOS session helpers; see the article Technical Tip: Session helpers and expectation sessions.
Difference between 'permit-stun-host' and 'permit-any-host': The two available STUN options cannot both be enabled on the same policy, since they define different NAT methods.
When 'set permit-any-host enable' is configured on the firewall policy or an associated IP pool, when outgoing UDP traffic is sent, the firewall will create an expectation session to match incoming UDP packets from any IP address and port, provided the destination IP address and port match the original external Source IP address and port. This is also known as 'full cone NAT', see this document: Full cone NAT for fixed port range IP pools. While this is the most flexible NAT method for STUN, it has a higher potential to allow unwanted UDP traffic to pass through to the original host.
When 'set permit-stun-host enable' is configured on a firewall policy or an associated IP pool, the expectation session includes the original destination IP address the client sent UDP traffic to. Incoming traffic will only match the expectation session if sourced from this IP address. This is also known as 'Address Dependent NAT' or 'Restricted Cone NAT'.
Related documents: |