topic Re: H323 Hop Count being inspected? in Firewall and Security Management

H323 Hop Count being inspected?

Martin_Seeger — Wed, 09 Jun 2021 12:38:14 GMT

We are using R80.30. After an update from JHF 219 to JHF 228 we suddenly had a near complete outage of all H323 calls. There was no Drop, Reject, Detect or Prevent in the log file.

When we checked SK153152, we noticed the following change in JHF227:

PRJ-16286,PRJ-16287,PMTR-58322: NEW: Added support for HopCount field in H323 protocol. Refer to sk169513.

This seemed the only change mentioned with any relevance concerning H323. So I took a look at the Hop Count in the troubled calls:

                    hopCount: 31

According to https://www.packetizer.com/ipmc/h323/whatsnew_v5.html the H323 HopCount has only 5 bit. So 31 is the max HopCount.

My suspicion here is: Check Point drops the packet because HopCount is exceeded or modifies the HopCount.

Can someone confirm or deny my suspicion? How can I tell the gateway to ignore the hop count?

Thanks in advance, Martin

Re: H323 Hop Count being inspected?

_Val_ — Fri, 11 Jun 2021 12:47:03 GMT

I would advise to raise a TAC case for this.

Re: H323 Hop Count being inspected?

Martin_Seeger — Fri, 11 Jun 2021 12:49:39 GMT

Already opened the TAC case two days ago. Specifically asked this question yesterday morning.

Re: H323 Hop Count being inspected?

PhoneBoy — Fri, 11 Jun 2021 23:09:44 GMT

I assume if you can trigger this issue, you can see the precise reason for it being dropped with something like fw ctl zdebug drop | grep x.x.x.x

Re: H323 Hop Count being inspected?

Martin_Seeger — Mon, 14 Jun 2021 07:40:13 GMT

Replication is possible, but that would disable 800 telephonse for the duration. That's why I would first try to get the question answered ;-).