Blizzard New Game Overwatch PA not allowing voice traffic through, Even with custom service ports.

[taviss]

It seems that I can not seem to get the voice chat in Blizzards over watch to work through a PA. 

So as a test i put TCP ports 1119, 3724, 6113, 80, and udp 26503-36503 and 3724 forward through allowing any app, to the PC running the game.  Still didn't make  a differance. Not sure if anyone has a PA setup with users playing games behind it or not, just wondering if anyone else has run into this issue. 

Cheers, 

[bmorris1]

Hi,

You can always request a signature be made for this application:

https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Request-a-new-App-ID/ta-p/60834

In the mean time, try creating a temporary 'allow all' rule for your source IP and play the game to see what ports, urls & applications hit this rule. Then create a new rule based on what you discover.

Make sure you log the rule and have a url filtering profile attached set to alert.

hope this helps,

Ben

[taviss]

Yeah so this is the odd thing, i have put in an wide open rule.  I have allowed all through and set the application default to any, and it still seems to clip on the outside. It seems very odd to me. 

I have requested the application into the new app id allready. 

[reaper]

some voip implementations could be flak. is the voice chat being identified as something specific? you may need to disable the ALG on the application level

It's also possible that without a proper signature (while it is being created) you need to set static bi-directional NAT and allow some inbound ports to your IP

[taviss]

Yeah so here is the crazy thing, i did a bi-directional NAT and and opened the firewall wide up (not too worried it's a home device use for testing before putting in production) and it still clipped the voice data on it.  I run the PC direct of the ISP no problem. Put the PA in wireline and same thing. It's super odd. I would have thought a bi-direction with wide open rules would work. Also made sure it wasn't application default but application any. 

[pulukas]

Sounds like you are hitting one of the ALG setups probably a VOIP one.  What do the logs say for the permitted traffic? This might help see what needs to be turned off or put in for override.

[erikda]

Disabling ALG made it work for me.

[nextgenhappines]

@erikda  Have you open a case with TAC?   We have a case with TAC now to have them look into why in game chat is not working.   I would suggest to open a case with TAC from your end as well,  PAN will get this issue resolve.

[nextgenhappines]

We had a troubleshoot session with TAC.  The workaround is setup an application override for traffic using UDP port 6250.  

https://live.paloaltonetworks.com/t5/Learning-Articles/Tips-amp-Tricks-How-to-Create-an-Application-...

We are requesting an overwatch appid.  No ETA yet.  stay tune.

[erikda]

Again, for me the solution was to disable ALG for application sip.

Voice now works in Overwatch, and Playerunknown's battlegrounds.

[nextgenhappines]

Hi erikda,

Understood, in our environment, if we disabled the SIP application ALG, it will break other VoIP applications.  

happy holidays,

[jvalentine]

Disabling the SIP ALG under Objects / Applications / SIP, disables it for the entire firewall.  

Using an Application Override (while doing some other things) also has the effect of disabling the SIP ALG.

Both methods are acceptable workarounds depending on your environments.  

[Rhollmer]

Just to bump this thread...  On SW version 8.0.10, that was the fix for me as well.  Override SIP-ALG and it should work fine.

[vamontford]

It worked for me as well.  Thanks for posting your solution!  Objects->Applications->SIP->ALG->Customize->Disable