Audio Issues with Asterisk via PA-2050

[Isosat]

I am currently attempting to cut over our office's internal gateway from a BSD firewall to our PA-2050 (running PAN-OS 4.1.9).  When attempting the cutover, I can get all services to work properly with the exception of our two VoIP servers (running Trixbox, which is Asterisk-based).  I can get the servers to make a call, but once connected there is no audio on either end. Both servers are using a 1:1 NAT through the firewall and I am only allowing SIP and RTP ports to be allowed from the internet.  The only changes that were made were to the PA-2050's Ethernet interfaces to replace the existing gateway for the VoIP servers.

I had previously worked with Palo Alto Support to work through this.  They had me set up an Application Override across all ports for both servers, which worked while testing.  Unfortunately, every attempt at going live results in a lack of audio when calls are connected.  Viewing the traffic log, it appears as if the RTP traffic is flowing normally.  I really need to get this cutover completed, but am unable to do so until I can get the audio working.  Has anyone else run into a similar issue?  If so, how were you able to get audio working properly.

[Phoenix]

Hello,

This is more of a troubleshooting scenario and may have to check different parameters as we narrow down the issue. Some points I think are:

> Is the app asterisk-iax allowed, based on the type of application may be some traffic is not being passed.

> Some times voip related apps may have variations on behavior with change in App content version as decoders would be getting updated, so if it was working at certain content version and not in another that may be the reason.

> If the voip servers are internal, did you check by disabling nat rules to see if natting has issue. Also it is good test mechanism to test with 1:1 nat but looks like this was tested already.

> Did you try and see the global counters at the time of passing traffic, this would give us an idea on the drops done by pan.

We will have to set up filters for specific source and destination and run the global counters command while traffic passing.

"show counter global filter packet-filter yes delta yes "

Run this back to back multiple times which would give some idea.

But I would suggest if a case is not opened yet pls open to isolate the issue.

Thanks

[ericgearhart · Accepted solution]

FYI I just recently had to build App overrides for RTP and RTCP to get our host voice solution working in a remote office that is using a PA200. Leave the SIP App-ID alone! I noticed that doing an app override for SIP broke audio too. I have app overrides for just RTP and RTCP and it's working great.

[Isosat]

I just set up our test PBX using this setup and am able to make calls and hear audio.  I'm not completely convinced that this will work though, because I had audio working on it before using Application Override across all ports.  Right now, I'm only using it for RTP and RTCP over UDP ports 9999 - 20001.

[apasupulati]

Hello,

If you configure filters for the VOIP traffic and check the global counters, do you see any drop counters for Packets matching rtp/rtcp predicts of sip? To check for counters use this command with filters turned on: show counter global filter packet-filter yes delta yes

I ran across a known issue on PANOS 4.1.5, where asterisk based VOIP packets matching rtp/rtcp predicts of sip are dropped due to waiting for predicts merging, causing audi issues. This was addressed in PANOS 5.0 release. Do you have any plans to upgrade?

Thanks,

Aditi