topic Re: H.323 cisco telepresence configuration in General Topics

H.323 cisco telepresence configuration

maximn — Tue, 25 Apr 2017 12:02:29 GMT

Hi guys,

I am very new in PA administration and I am trying to set up voice communication between cisco telepresence sx-20 located with private IP address in my Internal network to some terminals outside the network. I am using IP address like calling number when I am trying to establish the connection.

I have tried a lot of configurations, but no one work. In last - I use static NAT and DNAT : (telepr ext test"(an IP address which is attached to the external interface), Telepresence - sx-20)

and security rule which allow any external traffic to destination "telepr ext test" with basic applications which is needed:

I have rule which allows the traffic from sx-20 to the internet too. I succeed and establish the call to some online test cisco IP addresses for example 71.14.2.158, but no audio or video traffic was received. In monitor tab I saw that the session-end-reason is "tcp-rst-from-server" for apps h.225 and h.245. With Pakcet capture I saw a successfully TCP connection between both sides (my sx-20 and outside terminal-71.14.2.158).

If my config is wrong, what NAT rule/rules should I make/or not to do this task? And what kind of security rules? Any help will be appreciate very well

Thank you very much in advance.

Feel free to ask me anything if I was not so clear.

Best regards,

Maksim

Re: H.323 cisco telepresence configuration

TranceforLife — Tue, 25 Apr 2017 13:44:28 GMT

Can you do bi-directional: yes. I think we had a similar issue and that was due to one-way NAT rule.

Re: H.323 cisco telepresence configuration

maximn — Tue, 25 Apr 2017 13:43:38 GMT

Yes, but result was the same.

P.S. PAN-OS version is 7.1.5

Re: H.323 cisco telepresence configuration

BPry — Tue, 25 Apr 2017 14:37:06 GMT

Out of curiosity why do you have the DNAT for telepresence NAT rule? It seems like you wouldn't really need this policy at all.

Re: H.323 cisco telepresence configuration

maximn — Wed, 26 Apr 2017 06:39:44 GMT

You are right that it is not necessary a DNAT rule, but i have tried a lot of other configurations. Now i have done only one NAT rule with bi-directional: yes with our External GW which is the exit point to the internet:

It should be more clear on this way, but again still not work. I have changed the security policy to:

Is it possible to have a "problem" with the outside terminal (71.14.2.158)? I see rtp/rtcp packets back to External GW, but the session end reason for h.245 and h.225 in monitor tab for outgoing connections is "tcp-rst-from-server". I establish the call, but with no video or audio. Should I receive after all those packets or not?

Thank you very much once again for your answers!

Re: H.323 cisco telepresence configuration

maximn — Thu, 27 Apr 2017 05:24:16 GMT

After a lot of debbuging the problem was resolved. There is an issue with the other side configuration. The right config was static NAT with bi-directional:yes with security rules as you mentioned.

Thank you for your answers and fast repsponses!

Re: H.323 cisco telepresence configuration

TranceforLife — Thu, 27 Apr 2017 07:44:16 GMT

Actually, the biggest hint was "tcp-rst-from-server". But l do not have much of knowledge about VoIP so was not able to conclude 😄 Thanks for coming back with the solution

Re: H.323 cisco telepresence configuration

maximn — Tue, 02 May 2017 10:47:58 GMT

Yes you are right, but I am not very good at voip troubleshooting too 🙂