Re: [Serusers] Re: [Users] How Effective is STUN?

Many of the commercial, symmetric NATs have some form or fashion of SIP awareness (granted, some of them are broken... like Checkpoint's) -- Checkpoint, Cisco, Astaro, etc. Older Netgear boxes tend to be symmetric, but the more recent ones are not. Linksys boxes are asymmetric, usually port-restricted cone. As for the rest, I don't know for certain, but for my clients, I've run into FAR more asymmetric home clients than not. Asymmetric NATs are far easier to implement and, done correctly (prt-restricted cone), provide actually more security than symmetric because it masks the identification of multiple servers behind a firewall, as not all requests come from the same IP/port combination. Ideally, a good UA would be able to have a STUN server put in, check for whether or not VoIP would work with STUN, and default to that if necessary, but not if NOT necessary. Some UAs simply aren't that intelligent, and some UAs have broken STUN implementations (SJ Labs, for instance). Of course, in the truly ideal world, all firewalls will become SIP aware... N. On Sun, 20 Nov 2005 15:46:26 +0200, Daniel-Constantin Mierla wrote