Cisco UC500 Device Behind pfSense Firewall
-
Hello,
I'm looking for a little help putting a Cisco UC560 behind a pfSense firewall. Here's my situation:
I'm having some troubles with the UC560 due to it's limited firewall throughput. If I download a large file it maxes out the CPU on the device and causes phones to reboot and re-register or in some cases cause all phone calls to drop and prevents phone calls from being made. I called Cisco and after several weeks of testing it I was told I needed a more powerful firewall. I've been using pfSense at home for several months now and I really enjoy it. I still need the UC560 to act as my phone system, but I'd like to build a pfSense box to act as my firewall. In the long run I'd like to get a new phone system, and a better pfSense box, but until then I'm planning on using some spare parts to make things run a little smoother.
–--------
I found the following document on Cisco's website.
https://supportforums.cisco.com/sites/default/files/legacy/3/4/3/20343-UC500_Firewall_v4.pdf
It gives 4 deployment scenarios for this device:
Deployment Scenario #1 - UC500 behind ALG Capable Firewall
Deployment Scenario #2 - UC500 behind Firewall, no ALG Support
Deployment Scenario #3 - UC500 located in the Firewall's DMZ
Deployment Scenario #4 - Firewall deployed on the UC500's DMZ
Scenario #2 and #3 appear to be useless when SIP is involved, so those won't work for me. I don't think Scenario #4 helps because it sounds like the UC560 is still handing the internet connection and firewall.
This is what I'd like to see the layout be:
WAN-> pfSense -> UC560 (Firewall Off) -> Switch -> IP Phone -> Desktop
The phones are mostly 79x2 and 79x5 IP Phones. They have a switch in them to plug the PCs into. I'd like to keep doing it that way so I don't have to run more cables. The UC560 uses VLANs to separate the phone network from the data network so I'm thinking I'll keep doing it that way.
Is this layout possible? Is good or bad? Can pfSense be configured as an ALG Capable Firewall? The Cisco document gives a lot of info on how to make it work, but I'd like to know more specifically how it would be configured on the pfSense side. I've been reading where some people had to do a static NAT mapping and such. This is just a little beyond my limited knowledge base. I'm looking for a more complete understanding before I dive into this project. I actually have a spare UC540 I can test this on.
I would really appreciate any thoughts and suggestions on better ways to do this if possible.
Thank you