Set up a SonicWall router

Learn how to set up your SonicWall router to work properly with your phone system.

Before you begin: These steps are advanced and are typically completed by an admin or an IT admin on your account.

Open a browser window, enter the IP address of the SonicWall’s LAN Interface (or WAN interface if remote access is enabled) in the address (URL) bar and then press enter on your keyboard. If the web UI doesn't load, enter https:// before the IP address.
Sign in to the management interface with your credentials.
From the Manage section, change the following settings.

What to do next: Make sure these settings are applied once they have been changed.

Set the DNS servers

Learn how to set the DNS servers properly for optimal performance with your phone system.

Domain Name Service (DNS) Resolution is vital to phone operability. We recommend that phones perform their own DNS lookups with their resolvers set to Google’s DNS whenever possible. There are two ways to do this below.

Assign via DHCP — Recommended

This option is best if your SonicWall router is handling DHCP. If you have another device handling the DHCP server functionality, please refer to the manufacturer documentation for that device.

After logging in to your router and choosing the Manage section, select Network > DHCP Server.
Select Editfor the phone's internal IP range and then select DNS/WINS from the configuration menu.
Choose Specify Manually.
Enter 8.8.8.8 and 8.8.4.4.
Select OK to confirm the change.

Assign via Static DNS

This option is best if phones and computers that exist on the same network require a set DNS for non-phone operation. Please refer to your phone manufacturer’s documentation for instructions as this varies for each phone.

Disable SIP transformations

Learn how to disable SIP transformations on your router to allow for optimal performance with your phone system.

After logging in to your router and choosing the Manage section, select the VOIP tab.
Under SIP Settings, verify that Enable SIP Transformations is not checked.

Enable consistent NAT

Learn how to change your standard NAT policy to a consistent NAT, increasing compatibility with your VoIP phone system.

After logging in to your router and choosing the Manage section, select the VOIP tab.
Under General Settings, verify that Enable consistent NAT is checked.

Add access rules

Learn how to add specific access rules to your router to ensure that communication between our servers and your phones is always allowed and properly handled.

First, create and group address objects for IP blocks.

After logging in to your router and choosing the Manage section, select Objects > Address Objects.
From the pop-up menu, select Add and then give the object a name such as GTC1.
Complete the following fields:
- In the Zone Assignment field, choose WAN.
- In the Type field, choose Network.
- In the Network field, enter 199.36.248.0.
- In the Netmask/Prefix Length field, enter 255.255.252.0.
Select Add when complete.
Repeat steps 2-4 for the remaining two IP blocks, using the following changes:
- For the second object, the Network is 199.87.120.0.
- For the third object, the Network is 162.250.60.0.
- For the fourth object, the Network is 45.12.196.0.
- For the fifth object, the Network is 202.173.24.0.
  - In the Netmask/Prefix Length field, enter 255.255.248.0.
- For the sixth object, the Network is 173.199.0.0.
  - In the Netmask/Prefix Length field, enter 255.255.192.0.
- For the seventh object, the Network is 23.239.224.0/19.
  - In the Netmask/Prefix Length field, enter 255.255.224.0.
- For the eighth object, the Network is 78.108.124.0.
  - In the Netmask/Prefix Length field, enter 255.255.254.0.
- For the ninth object, the Network is 68.64.0.0.
  - In the Netmask/Prefix Length field, enter 255.255.224.0.
Once all three IP blocks are created, select Address Groups and then select Add.
Enter a name for the address group.
Add the three address objects you created earlier to the address group by selecting them and then pressing the right-facing arrow button in the middle of the screen to move the objects into the group.
Select Ok when complete.

Then add your access rules.

From Rules > Access Rules, select Add.
From the Create New Rule menu, complete the following settings in the general tab for the inbound traffic rule:
- In the From field, enter LAN.
- In the To field, enter WAN.
- In the Source Port field, enter Any.
- In the Service field, enter Any.
- In the Source field, enter Any.
- In the Destination field, enter the name of the Address Group created earlier.
Note: All other general settings can remain as they are.
From the same Create New Rule menu, complete the following settings in the advanced tab for the inbound traffic rule:
- In the UDP Connection Inactivity Timeout field, enter 300 seconds.
- In the Disable DPI field, make sure this is checked if available.
Select Add when complete to create the rule.
Repeat step 1 to create a second rule.
From the Create New Rule menu, complete the following settings in the general tab for the outbound traffic rule:
- In the From field, enter WAN.
- In the To field, enter LAN.
- In the Source Port field, enter Any.
- In the Service field, enter Any.
- In the Source field, enter the name of the Address Group created earlier.
- In the Destination field, enter Any.
Note: All other general settings can remain as they are.
From the Create New Rule menu, complete the following settings in the advanced tab for the outbound traffic rule:
- In the UDP Connection Inactivity Timeout field, enter 300 seconds.
- In the Disable DPI field, make sure this is checked if available.
Select Add when complete to create the rule.

What to do next: After these rules are created you should use the priority modifiers to move these rules to the top of their respective lists. This ensures that traffic matches and follows the policy for the rules just created rather than an existing rule in place.

Exclude GoTo Connect traffic from the Intrusion Prevention System (IPS)

Learn how to add IP addresses associated with your GoTo Connect traffic to your IPS system to avoid additional inspections that cause delays in getting calls to your phones.

SonicWall routers come equipped with an Intrusion Prevention System, or IPS. This system is used for more in-depth scanning of incoming and outgoing network traffic to help ferret out attacks that can hide from more conventional firewall scans. IPS is a great additional security feature but can cause some problems for VoIP traffic. Due to the real-time nature of VoIP traffic, it does not have the time to wait for additional inspection and in some instances the sheer amount of traffic being directed at a single destination can be misconstrued as an attack and the traffic will be blocked. See the steps below to exclude your GoTo Connect traffic from this process.

After logging in to your router and selecting the Manage section, select Security Services > Intrusion Prevention.
Select Configure IPS Settings from the configuration menu. If you see Upgrade Required instead of the IPS configuration menu, see "Upgrade required message" below to learn what that means and what options you have.
Choose Specify Manually.
Select the Allow IPS Exclusion List checkbox and then make sure the radio button for Use Address Object is selected.
From the drop-down menu for network objects, choose the GoTo Connect object group that you created earlier.
Select OK > Accept to save the change.

Upgrade required message

If you see Upgrade Required instead of the IPS configuration menu when trying to make changes to those settings, it means that your Intrusion Prevention System is still active and operating within your SonicWall. Consequently, you will be unable to modify any details of what is and is not scanned which can cause issues with your phone system.

Here are your options if you run into this situation:

Recommended — Reach out to SonicWall to purchase the additional license needed to configure the IPS settings. This is the only way to ensure that GoTo Connect’s traffic will never be falsely detected and blocked.
Uncheck the Prevent All and Detect All options for Low Priority Attacks. This should be the default setting on your SonicWall and does not seem to cause many issues from our experience. The issues seem to arise when these security settings are increased instead.
- If issues arise with GoTo Connect traffic being prevented at times, you can modify this further to allow Medium Priority Attacks, and so on up to and including disabling the IPS system entirely.

Article last updated: 22 April, 2022

You are viewing the latest version of this article.