<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none"><!-- p { margin-top: 0px; margin-bottom: 0px; }--></style>
</head>
<body dir="ltr" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p><br>
</p>
<p style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:16px">Jason/Josh:<br>
<br>
Thanks for the input. The issue isn't NAT (we're not NATing). The issue is without NAT, the Wifi Calling feature apparently chooses to initiate inbound from the carrier to the client. When NAT'd, the client recognizes the NAT and initiates on its own. Or at
least that what it appears. I calls 'em like I sees 'em. Whale biologist.<br>
</p>
<p style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:16px"><br>
</p>
<p style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:16px">If anybody has AT&T, TMo and Sprint (because I suppose we need to hold on to them as separate objects until the merger is complete) it'd be much appreciated. AT&T only lists FQDN's here: <a href="https://www.att.com/support/article/wireless/KM1114459/">https://www.att.com/support/article/wireless/KM1114459/</a> (which
the Palo should [SHOULD] understand) but...paranoia I guess. Others have listed TMo as <span style="font-size:12pt">208.54.0.0/17 and </span><span style="font-size:12pt">66.94.0.0/19 as recently as 2018, and Sprint has exactly nothing. <br>
<br>
And as I type this, someone chimed in offlist seconding 280.54.0.0/17 for TMo, so I'll add that to my list.<br>
<br>
Thanks again everyone!</span></p>
<p><br>
</p>
<p><br>
</p>
<div id="Signature">
<div name="divtagdefaultwrapper" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:; margin:0">
<div style="color:rgb(33,33,33); font-family:"Segoe UI","Segoe WP","Segoe UI WPC",Tahoma,Arial,sans-serif; font-size:15px; background-color:white; margin:0px">
<font face="Calibri,sans-serif" size="2"><span style="font-size:11pt"><font color="black"><b>John C. Lyden</b></font></span></font></div>
<div style="color:rgb(33,33,33); font-family:"Segoe UI","Segoe WP","Segoe UI WPC",Tahoma,Arial,sans-serif; font-size:15px; background-color:white; margin:0px">
<font face="Calibri,sans-serif" size="2"><span style="font-size:11pt"><font color="black">Manager of Network Infrastructure, Infrastructure Services</font><font color="black"><br>
Division of Information Resources & Technology </font></span></font></div>
<div style="color:rgb(33,33,33); font-family:"Segoe UI","Segoe WP","Segoe UI WPC",Tahoma,Arial,sans-serif; font-size:15px; background-color:white; margin:0px">
<font face="Calibri,sans-serif" size="2"><span style="font-size:11pt"><font size="3" color="black"><span style="font-size:12pt"> </span></font></span></font></div>
<div style="color:rgb(33,33,33); font-family:"Segoe UI","Segoe WP","Segoe UI WPC",Tahoma,Arial,sans-serif; font-size:15px; background-color:white; margin:0px">
<font face="Calibri,sans-serif" size="2"><span style="font-size:11pt"><font color="black">Rowan University </font></span></font></div>
<div style="color:rgb(33,33,33); font-family:"Segoe UI","Segoe WP","Segoe UI WPC",Tahoma,Arial,sans-serif; font-size:15px; background-color:white; margin:0px">
<font face="Calibri,sans-serif" size="2"><span style="font-size:11pt"><font color="black">201 Mullica Hill Road, Glassboro, NJ 08028 </font></span></font></div>
<div style="color:rgb(33,33,33); font-family:"Segoe UI","Segoe WP","Segoe UI WPC",Tahoma,Arial,sans-serif; font-size:15px; background-color:white; margin:0px">
<a href="http://rowan.edu/irt" target="_blank" id="NoLP" style="font-size: 11pt; font-family: Calibri, sans-serif;">rowan.edu/irt</a><br>
</div>
<div><br>
</div>
</div>
</div>
<div style="color:rgb(33,33,33)">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Jason Alderfer <alderfjh@emu.edu><br>
<b>Sent:</b> Friday, July 17, 2020 5:00 PM<br>
<b>To:</b> Lyden, John C<br>
<b>Cc:</b> nanog@nanog.org<br>
<b>Subject:</b> [EXTERNAL] Re: Wifi Calling Firewall Holes to Punch</font>
<div> </div>
</div>
<div>
<div dir="ltr">In our university environment, wifi calling works just fine over NAT and we have not made any inbound port exceptions in the firewall for it. The critical piece for (non-enterprise) VoIP traffic is that your firewall must not try to function
as a SIP ALG, but I'm not sure that's directly relevant to wifi calling for the major carriers.
<div><br>
</div>
<div>
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr"><span style="color:rgb(0,0,0); font-family:arial,sans-serif; display:block; font-size:10pt">Jason Alderfer<br>
</span><span style="color:rgb(0,0,0); font-family:arial,sans-serif; display:block; font-size:10pt">Director of Technology Systems</span><span style="color:rgb(0,0,0); font-family:arial,sans-serif; display:block; font-size:10pt">Eastern Mennonite University<br>
</span></div>
<br>
</div>
</div>
</div>
</div>
</div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Fri, Jul 17, 2020 at 12:40 PM Lyden, John C <<a href="mailto:lyden@rowan.edu">lyden@rowan.edu</a>> wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex; border-left:1px solid rgb(204,204,204); padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_6524065380238661027WordSection1">
<p class="MsoNormal">Hey gang.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">We’re setting up a unified wireless network for the students here, and to get around the issues with Nintendo and NAT we devoted a large chunk of public IP space to them.
<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">We’re aware that this is causing issues with wifi calling on Verizon, TMo etc because it appears they initiate the SIP session inbound.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Does anybody have a handy list of IP blocks and ports? T-Mobile had a decent page but other providers just said “open up 4500 and 500” and our ISO guys don’t like that.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Thanks if someone can help.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">John C. Lyden<u></u><u></u></p>
<p class="MsoNormal">Manager of Network Infrastructure, Infrastructure Services<u></u><u></u></p>
<p class="MsoNormal">Division of Information Resources & Technology, Rowan University<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</body>
</html>