Cato Networks is a certified connectivity partner of RingCentral, a leading provider of unified communications as a service (UCaaS). RingCentral has performed extensive testing that demonstrates Cato’s ability to provide excellent call quality even during poor network conditions with up to 15% packet loss. You can read more about the partnership and how Cato delivers on quality in the press release and the Cato Blog.

If you’re a current or prospective RingCentral customer, this article will guide you through the Cato configuration necessary to get the best performance out of your RingCentral product.

High Level Overview

1. Verify that SIP ALG is disabled for the account or specific sites.
2. Verify that the security policies do not block RingCentral traffic.
3. Configuring the BW Management to give the correct priority for RingCentral traffic.
4. Configure a network rule for RingCentral traffic.

Disabling SIP ALG

From September 2019, SIP ALG is disabled by default on new accounts. If necessary, disable SIP ALG for specific sites or across your entire account.

To disable SIP ALG:

1. Go the the Advanced Configuration section for the entire account or the site:
   • For the account: Configuration > Global Settings > Advanced Configuration
   • For the site: Configuration > Sites > <site name> > Advanced Configuration
2. Click the SIP ALG toggle to enable the Advanced Configuration settings for this feature. (The toggle is green when enabled).
3. Select OFF.
4. Click Save.
   SIP ALG is disabled for the account or site.

Verifying the Security Policies

Configuring the Internet Firewall

By default, the Internet Firewall will not block any RingCentral traffic. However, if you have created a more restrictive Internet Firewall policy, you may need to create an exception to allow RingCentral traffic.

To configure an Internet firewall exception for RingCentral:

1. In the Cato Management Application, go to Security > Internet Firewall.
2. In the Exceptions (Allow Applications) section, click  .
3. Click Add Description to add a name to the policy.
4. In the From section, click and select  in the lower right corner of the popup window.
5. In the To section, click , click the Applications tab, and then select RingCentral.
   
   

6. In the popup window, click OK.
7. Click Save.

When you are finished, the policy looks like the screenshot below:

Configuring the URL Filtering Policy

Like the Internet Firewall, the default URL Filtering policy will not block traffic to any RingCentral domains. However, if you have configured a more restrictive policy, such as blocking all URL categories and allowing only certain domains, you will need to create a Custom Category to prevent specific RingCentral domains from being blocked.

Different domains need to be allowed depending on the RingCentral product you’re using, so please refer to RingCentral’s documentation for a list of the required domains.

To configure a Custom Category for RingCentral:

1. From the navigation pane, click Security > URL Filtering.
2. In the Custom Categories section, click .
3. Click Add Name to add a name to the policy.
4. In the From section, click  and select box in the lower right corner of the popup window.
5. In the URLs & Categories section, click the  button.
   • Domains listed in the format *.domain.com in RingCentral’s documentation should be added to the TLDs section in the domain.com format.
   • Other domains without a wildcard should added to the FQDNs section. Refer to the screenshots below.
     
     Note: In order to save time, you can add the ringcentral.com domain to the TLDs section instead of adding the individual RingCentral subdomains to the FQDN section.
6. In the popup window, click OK.
7. Click Save.

Configuring Bandwidth (BW) Management

RingCentral should be assigned the lowest BW Management priority to ensure optimal voice quality even during link congestion. By default, all voice and video traffic over the Internet is assigned the lowest predefined priority, P10, by the “Internet Voice & Video - Predefined” policy under Networking > Network Rules in the Cato Management Application. Therefore, without any rule modification, RingCentral traffic will be given the same precedence as other voice traffic.

If you’d like to prioritize RingCentral traffic over all other voice traffic, create a lower priority under Networking > Bandwidth Management. You’ll use this priority when setting up a Network Rule in the next step.

To configure a BW Management Priority for RingCentral:

1. From the navigation pane, go to Networking > BW Management.
2. Click  in the top right corner.
3. Define the priority. Any number less than 10 is given precedence over the predefined P10 priority.
4. Click OK.
5. Click Save.

Configuring a Network Rule

Create a network rule for RingCentral traffic to assign a custom BW priority, set the NAT IP, and enable Packet Loss Mitigation. The NAT IP address is also the egress IP address for a specific Cato PoP. We recommend that you select the Cato PoP that is physically closest to a RingCentral PoP, and lets you takes advantage of the RingCentral tier 1 backbone.

Setting the NAT IP in the network rule ensures that both SIP (used for call setup) and RTP streams (voice data) share the same NAT IP. Phone calls will not work if the RTP stream uses a different NAT IP than the SIP stream.

Enabling Packet Loss Mitigation will prevent call quality from degrading with up to 15% packet loss on the WAN link.

Prerequisites

You will need at least one allocated IP to complete the configuration for the network rule. If you do not have any allocated IPs, you can create one under Configuration > Global Settings > IP Allocation in the Cato Management Application. See this article for more information.

To configure a network rule:

1. Go to Networking > Network Rules in the Cato Management Application.
2. Click the  button on the right side of the first network rule and select Add Internet Rule Above.
   Network rules are executed in a top-down order, so this will make sure that RingCentral traffic is assigned to the correct policy.
3. Enter the Name for this rule.
4. Click  in the What column, and in the Applications section, and select the Ring Central application.
   
5. Click OK to close the Services window.
6. Click  in the From column and select Any in the lower left corner of the popup window.
   This will force all RingCentral traffic from every site and VPN user to hit this network rule. Alternatively, you can select specific sites, networks, hosts, or VPN users here.
7. Click OK to close the Add Items window.
8. Click  to expand the section. Select the custom BW priority you created earlier or the default P10.
   
9. Click  to expand the section and select NAT in the Route/NAT drop-down menu.
10. Click the button and select a single or multiple egress IPs.

    Note: We recommend that you select the Cato PoP that is physically closest to a RingCentral PoP.
    In the case of multiple egress IPs, the one closest to the PoP that the site or VPN user is connected to will be used for NAT.

    

    Optional: If you have multiple WAN interfaces, you can set the primary and secondary NICs. You can also set the secondary transport if you have one.

11. Click Accelerations & Optimizations to expand the section and then select Packet Loss Mitigation.
    
12. Click Save.

Finding Cato and RingCentral PoPs

To help you select the best Cato PoP to egress traffic in the Internet network rule, the following map shows the physical locations of the Cato and RingCentral PoPs.

This is a list of the RingCentral PoPs: