Exposing Videoconference - "Incomplete" traffic allowed

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Exposing Videoconference - "Incomplete" traffic allowed

L4 Transporter
Hi all

I have tried to expose Videoconference system behind Palo Alto.
Unfortunately using App ID in security policy I have seen Palo Alto allows a lot of "incomplete" traffic.

That's really an issue: When enabling h.323 in security Policy App id engine starts to allows every port in order to find something related to this protocol and obviously you will see in the traffic log incomplete as" session end-reason".

Which is the best practice in this kind of situation?

Thanks in ⎌advance

Accepted Solutions

You can apply zone protection on whatever zone you wish, and really you should have one for your DMZ and your OUTSIDE zones if you have both. Depending on how you have things setup would indicate what zone your traffic shows, but you can verify this in your traffic log by (addr in publicip) and seeing what your destination zone is for traffic going to that address. 

View solution in original post


L7 Applicator

Do you have one public ip or range?

Do you SNAT traffic out from same IP that videoconference system from internet connects to you?

Enterprise Architect, Security @ Cloud Carib Ltd

I have configured static-ip source mapping with bidirectional option flagged! And I have only one public IP!


Can you share more details on how you are actually doing the NAT. H.323 shouldn't be allow every port by any means as H.323. Is this a Polycom unit that you are having troubles with? 



That's the issue 


H.245 is a control channel protocol used with[in] H.323 communication sessions, and involves the line transmission of non-telephone signals.
Standard Ports:


How can I proceed with this protocol?! Should I Enable everything?!


Anybody has this issue before?




I think the only way to proceede is to define a port range with who has configured the Videoconference system and put that range in the NAT bidirectional rule.


Do you agree?



Well tcp/dynamid does not mean that you permit application traffic on all ports.

You permit TCP 3way handshake on any port but if traffic that follows does not match application that is permitted then session is dropped by Palo.

Bad thing is that if you permit all tcp ports in then attackers can do port scan from outside.

Good example is that you never permit application SMTP and port ANY towards your email server because this will permit anyone outside to scan all ports on your mail server to identify what services are running.

Enterprise Architect, Security @ Cloud Carib Ltd


I'm worried about "port scan" because PA in order to identify an Application, allow the first packets to the server (SYN, SACK).

So I've seen from traffic a lot of attempt from outside to Videoconference server, allowed by Palo Alto:


Incomplete allowed.JPG


NOTE** As you can see the reset is coming from server and packet is allowed




Obviously that's a Palo Alto's default behavior .. But when you got an application such as h.245 that has defined as standard port "tcp/dynamic" .. You'll got an issue, because PA's starts to allow first packet (SYN, SACK) in order to identify h.245 application (A LOT OF PACKETS coming in)!


That's not great... 😞


Well there is not much that Palo can do - application is designed that way.


If you have video conference only with limited peers you can add their public IP into rule where you permit this traffic in from.

Or create External Dynamic List that pulls Video conference peer IP's from intranet site.

When people in company plan Video conference they just update intranet site and add peer to the list.

No firewall side reconfiguration needed.

Enterprise Architect, Security @ Cloud Carib Ltd
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!