topic Re: ALG for Facetime via NAT? in General Topics

ALG for Facetime via NAT?

bjdraw — Thu, 19 Jan 2012 15:35:30 GMT

We're running 4.0.5 and Facetime does not work as the packets coming from Apple's servers via the Internet are dropped. I noticed there was an ALG for H.323 in 4.1 but wasn't sure if that was related to Facetime or if there was anothe work around.

Re: ALG for Facetime via NAT?

mikand — Thu, 19 Jan 2012 16:12:59 GMT

ALG? Dont you mean Appid?

Re: ALG for Facetime via NAT?

kbrazil — Fri, 20 Jan 2012 06:45:08 GMT

There has been an App-ID for facetime for some time and it works fine with NAT. Facetime uses STUN to deal with NAT so it should be seamless anyway.

Cheers,

Kelly

Re: ALG for Facetime via NAT?

mikand — Fri, 20 Jan 2012 20:00:02 GMT

There still is according to: http://apps.paloaltonetworks.com/applipedia//

It looks like it depends on "ichat-av, sip, ssl, stun" which means that you need to allow those aswell (I think you will get an error or warning otherwise if you try to commit with not all dependencies set).

Re: ALG for Facetime via NAT?

bjdraw — Mon, 23 Jan 2012 13:55:43 GMT

mikand wrote:

ALG? Dont you mean Appid?

I mean an Application Layer Gateway which isn't exactly equal to an App-ID, is it?

http://www.paloaltonetworks.com/researchcenter/2010/08/whats-appening-with-apple-facetime/

I did see the PAN AppID for Facetime, was just trying to determine if allowing it was as simple as a rule allowing that application from the Internet to my LAN, or perhaps the other way around since the traffic is actually initiated from my LAN.

Re: ALG for Facetime via NAT?

bjdraw — Mon, 23 Jan 2012 15:31:34 GMT

kbrazil wrote:

There has been an App-ID for facetime for some time and it works fine with NAT. Facetime uses STUN to deal with NAT so it should be seamless anyway.

Cheers,

Kelly

I created a policy from zone Internet to zone Internet from Any IP to my Dynamic NAT IP which allows "facetime, aim-base, web-browsing, ssl, stun, sip, ichat-av" and tested unsuccesfully. The outbond traffic is correctly identified, but the traffic comging back from Apple's servers is allowed, but identified as "insufficient-data."

I assume allowing the AppID alone isn't enough to make it work with a Dynamic NAT? (We're NAT'ing all our clients out the same public IP)

Re: ALG for Facetime via NAT?

bjdraw — Mon, 23 Jan 2012 17:09:32 GMT

Scratch this entire thread, NO inbound rules are required to make Facetime work on the PAN firewall.

The reason mine wasn't working out of the box was becaue I had an explicit deny for SIP traffic destined from my network to the Internet. And since the Facetime AppID is dependant on SIP, it failed without logging. Interestingly with the rule disalbed, Facetime is working but sip traffic is still not logged.

Re: ALG for Facetime via NAT?

mikand — Mon, 23 Jan 2012 19:41:17 GMT

Didnt you get any warning during commit that you had colliding rules?

And which PANOS is it you were using?

Re: ALG for Facetime via NAT?

bjdraw — Wed, 25 Jan 2012 13:22:13 GMT

I was running 4.0.8 (can't remember the exact 4.0 release) and I didn't get a warrning because my policy for traffic destined for the internet from the LAN was 'any' and I just added exclusions to block SIP and SMTP. If I had put an explicit rule allowing Facetime from the LAN to the Internet then I would've gotten an error.