UDP Conversations for VOIP

[manuel2000]

Hi All;

I have an outside VOIP server running H323.  The phones internally use a keep-alive mecahnism over UDP 5000 as a destination and varying source ports. 

The server on the untrust side of the firewall will send the same keep-alives in response. This is known by some firewalls as a UDP conversation or sometimes is necessary in transparent mode. 

The service drops connections if the packet is not returned by the server to the phone.  To the PA by default the service appears to initiate a connection from Untrust to Untrust as a response, though it should be part of the Trust (Phone) to Untrust (Server) communication as a response. 

On Cisco, Checkpoint and Juniper There are fixups for the protocols and an extension of for the timeout valuees for UDP that are necessary. 

Is there a way for me to allow these UDP conversations prevalent in voice communication over IP?

[manuel2000]

Hi All;  It turns out that the reason the second communication was showing as initiated from the VOIP Server was due to the UDP default timeout being 30 seconds.  To find out if this is the case with your installation on the command line goto:

show session info

UDP Timeout will show as 30 seconds by default.

If you then use "Application Override" you will be able to adjust the TCP, UDP and other timeouts for the application, in my case the specific VOIP app.

I also found it helpful that should the connections stay open that show session info told me that at 80% of the allowable number of sessions (in a PA500 this is 65000), the timers will be halfed, saving me the problem of sessions bogging down the system if too many are open.

This feature is important as something like a Syslog server that matched the application override would produce millions of open (and staying open) UDP connections.

Anyway, Pen Name Manuel OUT!. 

[manuel2000]

The help desk did all the work on the answer, I just put it with my post for everyone!