SDP Issues with VOIP deployment

[mgillette]

Hi There,

We have a hosted mitel voice solution that we are seeing call quality issues in the inbound direction, ie calls in. I am attempting to troubleshoot this with our provider and they are seeing SDP attributes being added from our firewall.

I'm relatively new to the voice game so please excuse the ignorance! I have disabled SIP ALG and applied QOS as suggested here

https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/quality-of-service/use-case-qos-for-...

Setup looks like:

PAN ---------------- Ubiquiti Edgerouter Pro --------------- ISP juniper

I'm at a bit of a loss as to where to look next - just as a test I spun up a freepbx system and connected a phone to that and am able to make calls inbound and out without issues so I am confident that the firewall is classifying everything and rules are doing what they should.

I should add theat the issues are only with softphones, we have mitel branded handsets and cisco ATA's that don't have issues with inbound quality.

So the question would be, what would add the SDP attribute and where should I look to resolve this?

Thanks in advance

[jhochberg]

Hello,

This is a very interesting issue. I did a little bit of research on this and found something that I think is worth trying.

There's a capability within PAN-OS called "Application Override" whereby you can force the firewall to alter how it performs application/protocol enforcement.

Please look at the following article in the Palo Alto Networks Knowledge Base:

SIP Application Override Policy

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClouCAC

Try that first. If that helps, then I would suggest trying to re-enable the SIP ALG to restore the enhancements it provides.

Please come back and let me know if this is helpful!

Jeff Hochberg | Sr. Systems Engineer - Technical Business Development

Palo Alto Networks | Atlanta, GA |  USA

The content of this message is the proprietary and confidential property of Palo Alto Networks and should be treated as such. If you are not the intended recipient and have received this message in error, please delete this message from your computer system and notify me immediately by reply e-mail. Any unauthorized use or distribution of the content of this message is prohibited.

[mgillette]

Thanks for the reply, since a bit of time has passed I actually forgot about this post. Long story short it's up and running. I did try an application override and that didn't resolve things - nice to know I was on the right track at least.

What i was able to confirm through a series of packet captures both here and at our voice providers end was that their equipment was dropping packets -  I mean, it had to be their service if I was getting flawless voice with my FreePBX system hosted in a different country.

The provider went back to their suppliers who confirmed the issue and implemented a fix. Turns out, we were possibly the only client they had running that specific version of the Mitel App on iOS and this introduced issues supposedly. Nedless to say I wasn't too stoked about being utalised as beta testers! 

I think next time I'll be more inclined to roll my own solution. Cheers!

[jhochberg]

Fascinating! Thank you for the additional context.

There's plenty to be said for having total control of your solution end-to-end.

And, of course, I'm glad you were able to rule out the firewall as the issue!

All the best!

-JeffH