Connection Problem with Polycom VSX7000

[mmxong]

Hello All,

I am having issues with video conferencing when using our Polycom VSX7000 which was working fine previously with our Checkpoint Firewall. When we switch over to PA-2020. We start having issues.

We are able to dial out to connect with remote VC unit but when the remote VC units tried to connect to us, the VSX7000 shows connected but there is no video or audio.

The rules are allow any from external to internal as well.

We have another LifeSize unit which works just fine.

Both are NATed.

Thanks

Ben

[bpappas]

Are you using static NAT or dynamic NAT?

Does the Polycom use H.323?

-Benjamin

[shabeerc]

Yes Benjamin

What will do in this case

Thanks

shabeer

[SimmSimm]

It may or may not help, but it looks like our issues with the polycom VC systems, which were similar to yours, all went away with the update to the 4.1.3 code.

Set up with Static Bidirectional NAT  & simple application filter security rules.

Nick.

[shabeerc]

Hi Nick

Thanks for the update

actually here iam using 4.1.4 PAN-OS and same NAT rule any any security policy,also i did application override for polycome device.no luck

[AmeriNet-TK]

Shabeer,

Did you ever resolve this?  I just ran into the exact same problem with a 2050 running 4.1.7, old polycom vsx7000.

Thanks,

Tim

[shabeerc · Accepted solution]

Dear TIm

Please check your polycom settings

Below is the right Polycom device settings inorder work with Palo Alto

Admin
Settings->Network->IP Network, Firewall:

    - Enable
NAT/Firewall Traversal: (CHECK this option)

  - NAT
Configuration: (MANUAL)

  - Nat
Public (WAN) Address: (Enter the Public IP of the Polycom)

  - NAT is
H.323 Compatible:(UNCHECK this option)

  - Address
Displayed in Global Directory: (Public)

Thanks

Shabeer

[dbrenipc]

I am currently having the same problem on v504 code...

what ind of "simple application filters" did you setup ?

Thank you in advance,

Don

[SimmSimm]

Three rules in security policy:

Simple application group:

Note that for outgoing connections theres no restriction on service, for incoming its restricted to application default ports only. The explicit block rule in the middle blocks some application default ports that dont need to be open for NATted incoming connections.

Using 4.1.11hf1.