topic Re: R80.40 Gateway Voice L7 Nat not working in Firewall and Security Management

R80.40 Gateway Voice L7 Nat not working

Duminda_lakmal — Thu, 06 Apr 2023 05:27:59 GMT

Hi We have an Issue, after upgrading to R80.30 to R80.40 Voice message header contact URI is not nat in the firewall.

we have checked the topology configuration internally and external - okay

NAT - Static Object NAT - okay

Access rule Configured service as sip(UDP) pre-defined and for tcp-5060, custom service object.

with R80.30 same configuration works fine, but without any changes just upgrade the version to R80.40 voice is not connected. when we execute tcpdump we have observed layer-3 nat working and issue was VoIP packet layer-7 message header contact URI not nat.

Please advice how to resolve this issue.

Thank you!

Re: R80.40 Gateway Voice L7 Nat not working

Chris_Atkinson — Thu, 06 Apr 2023 05:34:13 GMT

Could you please confirm which Jumbo/JHF take the gateway has installed?

Re: R80.40 Gateway Voice L7 Nat not working

Duminda_lakmal — Thu, 06 Apr 2023 05:38:52 GMT

Hi Chris,

I have tested with T180, T190 and T192

all same having issues.

Re: R80.40 Gateway Voice L7 Nat not working

emmap — Thu, 06 Apr 2023 05:43:14 GMT

Please check this SK.

Re: R80.40 Gateway Voice L7 Nat not working

Chris_Atkinson — Thu, 06 Apr 2023 06:02:33 GMT

Also suggest working with TAC to validate if the VoIP fixes in T196 are relevant here.

Re: R80.40 Gateway Voice L7 Nat not working

Duminda_lakmal — Thu, 06 Apr 2023 06:43:56 GMT

Hello Chris,

I appreciate your response. I have an ongoing TAC case, and the TAC team is currently working with RnD to find a resolution. However, it seems like the resolution is taking longer than expected. As a result, I have created this post to explore any alternative solutions that we can implement from our end to upgrade gateways quickly. It's crucial that we complete the upgrade as soon as possible.

Thank you.

Re: R80.40 Gateway Voice L7 Nat not working

Duminda_lakmal — Thu, 06 Apr 2023 07:19:40 GMT

Hi emmap,

Thank you for sharing the mentioned SK. I have reviewed it, and it appears that the setting "Hide NAT changes source port for SIP over UDP" only applies to port-level NAT changes. However, in our case, we are also observing that the message header contact URI address (SIP Server IP) is not being NATed.

Based on my understanding, it seems that we will need to configure the NAT settings manually after upgrading to version 80.30. Could you please provide some advice on whether this will also apply to IP level NAT changes(Contact URI)?

Thank you.

Re: R80.40 Gateway Voice L7 Nat not working

emmap — Thu, 06 Apr 2023 08:16:26 GMT

Per the VoIP guide, have you configured the NAT on the network/host objects?

Re: R80.40 Gateway Voice L7 Nat not working

Duminda_lakmal — Thu, 06 Apr 2023 08:21:42 GMT

Hi Emmap,

Yes, SBC (Session Border Controller) we have configured on DMZ and SBC IP address NAT with Static NAT configuration.

Thank you,

Duminda.