topic Re: 7.0.8 to 7.1.8 upgrade - H.323 not working in General Topics

7.0.8 to 7.1.8 upgrade - H.323 not working

GavinPalmer — Fri, 31 Mar 2017 15:23:27 GMT

Dear All,

We have recently upgraded as the title suggests, and since upgrading our Polycom Group series video conference units are not working correctly on H.323 protocol. When we connect to either a public video bridge or direct to another Polycom device, we are unable to hear the caller ont he conference. This was previously working in 7.0.8.

From our initial investigations, we are able to get this working by configuring a static NAT rule for the Polycom device. However when the device using the general Trust -> Untrust dynamic NAT it does not seem to work correctly. We have performed packet captures which all seem to be flowing correctly and we are not seeing any dropped packets.

We have also configured a Trust -> Untrust ANY ANY security rule for the polycom to make sure its not being blocked from that perspective.

The only thing I can think of is that the traffic is not being routed back for some reason due to some change involving NAT that was implemented since 7.0.8.

Can anyone think of why we are having this issue?

Re: 7.0.8 to 7.1.8 upgrade - H.323 not working

GavinPalmer — Wed, 05 Apr 2017 08:32:18 GMT

Seriously... No one wants to take a stab at this one? lol

Re: 7.0.8 to 7.1.8 upgrade - H.323 not working

bmorris1 — Wed, 05 Apr 2017 08:39:30 GMT

Hi Gavin,

I would stick to using static NATs for both inbound and outbound, this is how I've always set up VoIP/video conferencing NAT rules.

Additionally you may be facing this issue, but you'd need to look at the global counters in combination with a packet filter.

https://live.paloaltonetworks.com/t5/Learning-Articles/Session-setup-fails-due-to-session-hash-collision-error/ta-p/70539

https://live.paloaltonetworks.com/t5/Management-Articles/How-to-check-global-counters-for-a-specific-source-and/ta-p/65794

hope this helps,

Ben

Re: 7.0.8 to 7.1.8 upgrade - H.323 not working

OtakarKlier — Wed, 05 Apr 2017 22:58:37 GMT

Hello,

I agree with the static NAT's, I also prefert to make them bi-directional, causes less of a headache with asymentric routing.

Regards,

Re: 7.0.8 to 7.1.8 upgrade - H.323 not working

GavinPalmer — Wed, 12 Apr 2017 13:08:51 GMT

Hi Guys,

Ok so If use static NAT's and I have 8 meeting rooms with Polycom devices, that would mean 8 public IP addresses. Surely that's not scalable? Maybe some kind of PAT would be a better option? What does everyone think?

Re: 7.0.8 to 7.1.8 upgrade - H.323 not working

bmorris1 — Wed, 12 Apr 2017 13:44:41 GMT

Hi Gavin,

Yes that is how I have done it in the past with these polycomm video conferencing devices. Do polycomm have a central server that you could set up on your internal network, with all the devices calling back to that? Then you just need to do a 1-to-1 static NAT for the central server.

You could you PAT in theory to send the traffic to the right video phones but I do not think you can change the ports the video units use.

hope this helps,

Ben

Re: 7.0.8 to 7.1.8 upgrade - H.323 not working

BPry — Wed, 12 Apr 2017 16:14:28 GMT

@GavinPalmer the scalability of this solution would wholly depend on your environment; for example in my environment the scalability of this is sensible and it's exactly what we do with our few actual video conferencing units. I always tell clients that this type of equipment should be a 1-1 anyways seeing as Polycom in particular has real issues sitting behind NATs.

PATs are acceptable granted that you can actually get it working; I wish I still had my cheat sheet from when I setup a few units to be used with verizon hotspots because I spent a fair amount of time figuring it all out but unfortunately I can't locate the list. Polycom is pretty notorious for behaving poorly behind a PAT