MiVoice Business w/MBG in DMZ- One Way Audio Out

[Hoosierpapa]

Long time fan, first time poster...

I have a customer that we have installed vMBG 9.4 to accommodate for the addition of SIP trunks to their MCD.  The customer is unable to provide a direct WAN connection to the server to allow for the Server-Gateway configuration.  So we went with DMZ.  The customers network vendor is advising he cannot do a hair-pin NAT to allow the sites voice network to stream to the designated public address of the MBG.  When I do a custom config and try to have the ICP side streaming set to the DMZ IP address of the server, registration is going to the carrier with a different public IP address and we get a 403 error.  I am in process of working with their support to get the customers entire Public IP subnet authorized.  Hopefully that works, but in the meantime I wanted to run it by the brain trust I have relied on so many times.

[acejavelin]

When it comes to MBG, do it right or don't do it... Sorry, but in this case I would tell the customer this is how it works and these the approved applications, either give us a direct public connection for server-gateway mode, or do the DMZ properly otherwise things are not going to work right. If they won't work within the necessary established standards, refuse to do the work... It might sound like a whiny kid the way I wrote it, but it will be worth it in the long run.

I make exceptions in some areas and fudge things, but not with the MBG when it's being used for trunking.

[Hoosierpapa]

Update...
I was able to get working with a Custom Network Profile using the DMZ address for ICP side and public for the set side.
Once we were able to have Intelepeer authorize the customers entire Public IP range, we were able to register and pass audio both ways.  Just got done testing everything and it is working! Call setup and teardowns, DTMF, forwarding, xfers, and conferencing.  Finger crossed this isn't a future landmine.
I agree Ace, I hate finagling a solution that doesn't keep it simple and within "supported" configs.  Unfortunately our powers that be don't follow the logic and reasoning behind sticking to it.  Gotta make that sale!