Cisco Router (ISR/ASA) – SIP Configuration Guide

Learn how to configure SIP on Cisco ISR and ASA routers for optimised VoIP communication and management.

Table of Contents

Overview Before you start Ports used by VoIP Configuration 1. Disable SIP Inspection (ASA / Firepower) 2. Check Access Control Lists (ACLs) 3. NAT configuration 4. QoS (recommended) 5. Optional: DNS and NTP Good practice Troubleshooting One-way audio Calls dropping early Registration issues Poor quality

Overview

This guide outlines how to prepare Cisco routers and firewalls (ISR, ASA, Catalyst) for SIP-based VoIP.

Cisco platforms are generally very reliable for VoIP, but SIP inspection and default firewall behaviour can cause issues if left unchanged.

 

Before you start

You’ll need:

  • CLI or web access (depending on platform)
  • SIP provider details
  • Basic knowledge of ACLs and NAT

 

Ports used by VoIP

  • SIP: 5060 (UDP/TCP), optionally 5061 (TLS)
  • RTP: typically UDP 10000–20000

 

Configuration

1. Disable SIP Inspection (ASA / Firepower)

On ASA devices, SIP inspection is enabled by default.

From CLI:

policy-map global_policy
 class inspection_default
  no inspect sip

Why this matters:
Like SIP ALG, inspection rewrites SIP traffic and frequently causes one-way audio or dropped calls.

 

2. Check Access Control Lists (ACLs)

Make sure outbound traffic isn’t being blocked.

Example:

access-list VOIP permit udp any host <provider_ip> eq 5060
access-list VOIP permit udp any host <provider_ip> range 10000 20000

Apply the ACL to the relevant interface.

 

3. NAT configuration

Standard outbound NAT is usually fine.

Example:

nat (inside,outside) source dynamic any interface

For hosted setups, you typically don’t need inbound NAT rules.

If running an on-site PBX, use static NAT and ensure consistent mapping.

 

Cisco handles QoS very well, and it’s worth configuring.

Example:

class-map match-any VOICE
 match protocol rtp audio

policy-map VOICE-POLICY
 class VOICE
  priority percent 30

Apply to WAN interface.

 

5. Optional: DNS and NTP

VoIP systems rely on both:

  • DNS for resolving SIP servers
  • NTP for time sync (important for registration and TLS)

Make sure both are reachable.

 

Good practice

  • Avoid double NAT
  • Use CUBE (Cisco SBC) in larger environments
  • Prefer SIP over TLS if supported

 

Troubleshooting

One-way audio

Usually RTP being blocked or misrouted.

Check:

  • ACLs permit RTP
  • NAT is consistent
  • Inspection is disabled

 

Calls dropping early

Often caused by SIP inspection still being active somewhere.

 

Registration issues

Start with:

  • DNS resolution
  • Reachability of SIP server
  • ACLs

 

Poor quality

Look at:

  • Interface utilisation
  • QoS configuration
  • Packet loss