topic Re: VoIP over NAT issues: Ring but no audio; disconnects in General Topics

VoIP over NAT issues: Ring but no audio; disconnects

AdamsCoGovt — Tue, 01 May 2012 19:10:52 GMT

I have our VoIP PBX set up with an IP on our external side via NAT. The policy is a simple static NAT from the internal IP to the external. I also have the correct security policies in place to allow SIP/RTP traffic to pass freely to and from the external IP address. The PBX server can be accessed via HTTP from outside our network, and my cell phone (using BRIA) can successfully register to the PBX.

However, whenever I make a call from outside, it will disconnect after seven (7) seconds when picked up. This happens every time without fail. I have tried tweaking around security policies, enabling application override, and altering the NAT rules.. nothing seems to help.

Can anyone give me suggestions? This setup worked perfectly fine on our old Juniper SRX-240B with the PA-500 in vWire. Ever since I swapped the PA-500 into being our gateway/firewall, it just won't do it.

More information can be provided upon request.

Thanks,

Logan

Re: VoIP over NAT issues: Ring but no audio; disconnects

marcinpudysz — Tue, 01 May 2012 19:39:21 GMT

Hi, i have the same problem. The support area is reported to the task. Waiting for a solution. The problem lies in properly marked RTP packets. application ovverride does not help. We have to wait.

Re: VoIP over NAT issues: Ring but no audio; disconnects

AdamsCoGovt — Fri, 04 May 2012 17:25:03 GMT

Any Palo-Alto support people that can make any suggestions at all? We really want to avoid having to buy an intermediate device for SIP to bypass the PA-500.

Re: VoIP over NAT issues: Ring but no audio; disconnects

sspringer — Fri, 04 May 2012 18:14:11 GMT

Hello,

What software version and content is running on the device?

We are continuing to make improvements to the SIP decoder so I would recommend updating to the latest app/content version to see if this resolves your issue.

VoIP issues can be tricky to troubleshoot so I would highly recommend opening a case with your support team so we can gather packet captures, global counter and session information.

- Stefan

Re: VoIP over NAT issues: Ring but no audio; disconnects

AdamsCoGovt — Fri, 04 May 2012 18:40:43 GMT

Our PA-500 is currently on version 4.1.2.

Packet captures that I've done so far show outgoing RTP transmission, but no incoming.

CASE#: 00076638

Re: VoIP over NAT issues: Ring but no audio; disconnects

AdamsCoGovt — Thu, 31 May 2012 15:12:52 GMT

An update to this ticket:

I've been working with Palo Alto support and still no fix, yet.

Packet captures show that RTP traffic is flowing from the internal phone to the SIP phone outside the network, but there is no flow from outside to inside. It is passing out of our dynamic-ip-and-port NAT rule, but cannot find a way back in.

Still waiting on support for additional testing.

Re: VoIP over NAT issues: Ring but no audio; disconnects

mikand — Thu, 31 May 2012 20:02:50 GMT

Try sniffing manually on your uplink to see if the voip client returns any packets at all?

My guess would be that some header within your SIP connection isnt replaced to show the PA's outside ip/port but showing the original (RFC1918?) address. Which of course will never find its way back to your PA (specially if this is over Internet).

Re: VoIP over NAT issues: Ring but no audio; disconnects

AdamsCoGovt — Mon, 04 Jun 2012 14:06:46 GMT

Packet capture on a laptop running a SIP client shows that packets are being received on the external unit, but packets are hitting the NAT and being dropped when trying to re-enter the network.

PBX has a static NAT to an external IP.

External unit registers via PBX external.

External unit makes call.
PBX connects to internal phone and sets up the call.

Internal phone takes the call and tries to communicate with external unit via default dynamic-port-and-ip NAT (different IP than PBX external).
Traffic flows from internal to external via default NAT, but not vice versa.

The issue is that the traffic cannot re-enter the network via the dynamic-port-and-ip NAT. Our old Juniper SRX-240B did not have this issue, as it would route all SIP traffic back out the PBX external IP in it's default behavior (from what I've been told). This would utilize the static NAT and not the dynamic NAT.

Still working with someone from Palo Alto..

Re: VoIP over NAT issues: Ring but no audio; disconnects

paulhorn77 — Thu, 14 Jun 2012 18:09:47 GMT

Any update I am having a similar issue?

Re: VoIP over NAT issues: Ring but no audio; disconnects

AdamsCoGovt — Thu, 14 Jun 2012 18:15:30 GMT

Never really got any tangible progression. Ultimately, we decided to stop pursuing the issue and wait for our new phone system upgrade after the first of the year. The 3COM system we're using isn't supported any longer and has issues with NAT traversal.

One thing we also did was purchase an InGate Siperator so that our future SIP provider traffic will not pass through the PA-500 and instead will be parallel to the firewall. Managed to find a hardly-used unit on Ebay for way less than retail price.

Re: VoIP over NAT issues: Ring but no audio; disconnects

marcinpudysz — Thu, 14 Jun 2012 18:34:31 GMT

Yesterday i have sesion with support from LA and waiting for solusion.

Re: VoIP over NAT issues: Ring but no audio; disconnects

lildeniz — Mon, 25 Jun 2012 00:40:14 GMT

did u resolve problem

regards

Re: VoIP over NAT issues: Ring but no audio; disconnects

twhite — Mon, 25 Jun 2012 13:27:18 GMT

I had the same problem and finally pointed the outside interface of the VOIP PBX to the internet bypassing the PAN. It has a built in firewall that's satisfactory for it's purpose. I created a zone on the PAN to get to he voice subnet for secure management of the VOIP PBX and also to keep the voice subnet off my internel network. It works for now.

Re: VoIP over NAT issues: Ring but no audio; disconnects

marcinpudysz — Wed, 27 Jun 2012 18:35:13 GMT

yes, my problem is resolved. support offered in my case to use application ovverride for sip application, and it's work.

Re: VoIP over NAT issues: Ring but no audio; disconnects

BlackfenSchool — Mon, 17 Sep 2012 08:31:04 GMT

I'm experiencing the same problem. Could you provide details of the application override fix please?

Mine looks like this, but is not working;

The 10. address is our PBX, the 80. address is the remote PBX and the 5. address is our external IP.

Re: VoIP over NAT issues: Ring but no audio; disconnects

BlackfenSchool — Tue, 18 Sep 2012 11:20:15 GMT

Over three hours on the phone to PA support this morning got it sorted.

My applictation override rules were not working, as they were pointing at predefined applications. Custom Apps for both SIP and RTP were created which then started to allow some RTP through.

We were still getting quite a few calls with no audio (some were coming through). The PA engineer discovered that this was due to us using the dynamic-ip-and-port option in our outgoing source translation. Changing this to static-ip fixed it.

Here's what my working setup looks like;

Security Rules;

NAT Rules;

Application Override Rules;

Custom SIP Application;

Custom RTP/RTCP Application;

Hope this helps anybody experiencing similar problems. PA have taken a support dump, so may have a more elegant fix at some point.