Port isolation with SIP

[MichaelSchramm]

We're currently discussing the use of port isolation for security reasons for  a customer. They want to minimize the effect of a possible malware incident.

They have a setup, where they connect many of the network clients through the internal switch if IP phones.

I was just wondering, whether port isolation would break internal SIP calls between the IP phones.

From what I know, SIP initiates direct connections between the phones after they've got corresponding IP information from the SIP server.

Is there a way to make an exception from port isolation for single VLANs?

Or would the customer need to implement something like a SIP proxy?

[ww]

There is no vlan exception. You need force rtp / sip traffic through the gateway. The gateway cant be on a isolated port

[cmr]

I think you'd need to do something like putting each SIP endpoint on it's own VLAN, then the calls would route through the gateway, not sure if you can force it not to connect locally (at least on Cisco SIP solutions)

[PhilipDAth]

This varies by phone system.  Some systems have the phones talk directly to each other, some proxy all calls through the phone system.  On some systems, this is a configurable setting.