Solved! Go to Solution.
You can apply zone protection on whatever zone you wish, and really you should have one for your DMZ and your OUTSIDE zones if you have both. Depending on how you have things setup would indicate what zone your traffic shows, but you can verify this in your traffic log by (addr in publicip) and seeing what your destination zone is for traffic going to that address.
Do you have one public ip or range?
Do you SNAT traffic out from same IP that videoconference system from internet connects to you?
Can you share more details on how you are actually doing the NAT. H.323 shouldn't be allow every port by any means as H.323. Is this a Polycom unit that you are having troubles with?
That's the issue
H.245 is a control channel protocol used with[in] H.323 communication sessions, and involves the line transmission of non-telephone signals.
How can I proceed with this protocol?! Should I Enable everything?!
Anybody has this issue before?
I think the only way to proceede is to define a port range with who has configured the Videoconference system and put that range in the NAT bidirectional rule.
Do you agree?
Well tcp/dynamid does not mean that you permit application traffic on all ports.
You permit TCP 3way handshake on any port but if traffic that follows does not match application that is permitted then session is dropped by Palo.
Bad thing is that if you permit all tcp ports in then attackers can do port scan from outside.
Good example is that you never permit application SMTP and port ANY towards your email server because this will permit anyone outside to scan all ports on your mail server to identify what services are running.
I'm worried about "port scan" because PA in order to identify an Application, allow the first packets to the server (SYN, SACK).
So I've seen from traffic a lot of attempt from outside to Videoconference server, allowed by Palo Alto:
NOTE** As you can see the reset is coming from server and packet is allowed
Obviously that's a Palo Alto's default behavior .. But when you got an application such as h.245 that has defined as standard port "tcp/dynamic" .. You'll got an issue, because PA's starts to allow first packet (SYN, SACK) in order to identify h.245 application (A LOT OF PACKETS coming in)!
That's not great... :(
Well there is not much that Palo can do - application is designed that way.
If you have video conference only with limited peers you can add their public IP into rule where you permit this traffic in from.
Or create External Dynamic List that pulls Video conference peer IP's from intranet site.
When people in company plan Video conference they just update intranet site and add peer to the list.
No firewall side reconfiguration needed.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!