About Isosat

Ok, it looks like the issue has finally been resolved.  What finally solved the issue was setting up the addition of two Application Overrides for SIP: one for UDP and one for TCP.  To be safe, we set the port numbers pretty wide open (1034-65535). ... View more

Found out some more information after spending most of my day with Support.  Our Edge Router keeps showing an ARP entry for the address I'm attempting to NAT my VoIP server to.  I've already commented out the NAT rule in that firewall, as well as deleted two static routes that had been entered into the firewall.  I'm still unable to clear that ARP entry from my Edge Router.  It is a Cisco router, and I can't seem to find any answers that permanently remove the ARP entry. ... View more

I think it may be a NAT issue after my latest cutover attempt.  I changed the default gateway of one of the VoIP servers to my PA-2050's interface again and continue to get one-way audio.  This is also after commenting out the NAT rule in the BSD firewall as well as clearing the ARP table in the Edge Router.  I decided to reboot the VoIP server and then was completely unable to reach the internet on the server, so all calls immediately got an "All circuits are busy now" message.  I have the NAT working for several other servers, and the NAT rules match those exactly.  This is incredibly frustrating and Palo Alto Support has largely been unhelpful. ... View more

Just attempted another cutover this morning.  I enabled the NAT and Security rules on my PA-2050.  While that was committing, I commented out the same rules in our BSD firewall.  I then changed the Default Gateway for one of my VoIP servers from the BSD firewall to the PA-2050.  I then cleared the ARP tables in our Edge Router.  When making a call, I could hear audio on the receiving end, but could hear nothing from the office phone behind the VoIP server. I feel like I'm getting closer, but am still missing something. ... View more

The VoIP servers are currently using the BSD firewall as their default gateway.  We are trying to move everything off of the BSD onto the PA-2050 for easier management.  We are currently using the PA-3020 between our Internet fiber and our Edge Router in transparent vWire mode. We want the PA-2050 to handle all of our NATs as the owner of the company does not want to have a single point of failure.  The PA-2050 has been handling the NAT for several other servers (two web servers and two DNS servers) in our DMZ without any issues.  Also, during the cutover, every other service (internet, emails, etc.) works without any issues.  It's only the audio over VoIP that doesn't work. ... View more