PAN with Polycom RPAD (Real Presence)

[FrankPiscitello-WCU]

Ok. So, I'm running the 5.0.10 PAN. We are in the middle of a Polycom installation. Internal traffic within the polycom system is working fine (since no FW is in place). The problem is of course the outside users. We are using NAT for external stuff. I created a single Inbound rule (Untrust->trust) to the RPAD server. No Applications selected. Instead I specified all the port numbers as custom services and attached them to the rule.

When a user tries to connect, the call is connected and the user is registered. However, no media/content would go through. As a side note, SIP works external, but not H.323.

Any ideas?

-Frank - West Chester University

[HULK]

Hello Sir,

Is your end device Call server/PBX is NAT aware..? Is there a predict session available  from the signaling session...?

I would suggest you to enable packet capture for ingress and egress on the PAN firewall just to see, the Layer-7 Payload and how it modified by PAN.

Please find below few related discussions:

nat

Polycom Real Presence issue

Thanks

[FrankPiscitello-WCU · Accepted solution]

So, we got it working. Application Override is where we had to go. We setup an application "Polycom" and put ALL the tcp/udp ports required to connect to the RPAD system. Then I put 4 application over-ride policies in place. 2 for Outbound from the RPAD (TCP/UDP) and 2 for Inbound (TCP/UDP) both pointing to the "Polycom" application Object I made earlier.

I then had connections made and verified through the traffic log that the inbound/outbound traffic was being IDed as "Polycom" not H323, SIP, etc... Dials were made and media was connected.

[HULK]

Thanks for your update here. If app-override solved the problem here, it means the PAN  FW was changing the payload information from the layer-7 which was not acceptable for your end server. Hence, your end server/call manager/PBX is a NAT aware box.

This type of situation could handle in 2 ways:

a. Make the end system, NAT aware and create an application-override in PAN firewall for signaling and media traffic.

OR

b. Make the server as a legacy device (no NAT aware) and do the pinholing at the PAN firewall.

Hope this helps

Thanks

[FrankPiscitello-WCU]

The real question is, why would PAN be modified the payload of layer-7 during the App-ID phase?