topic VoIP Traffic Issue in General Topics

VoIP Traffic Issue

Sarm_Chanatip — Wed, 13 Mar 2019 07:13:58 GMT

Hello guys,

First of all, I'm new with VoIP configuration and now encountering VoIP traffic issue while the call flow traverses the Check Point Gateway

I will briefly explain an issue.

1. When Phone device ( 192.168.10.204 ) that behind firewall calls to Phone device that's the opposite side of firewall ( 10.105.62.102 ). RTP message is working fine, both sides can hear each other

2. But If Phone devices from the opposite side call back to 172.19.0.204 ( translation to 192.168.10.204 ),

RTP message is not working properly, only one side can hear voice but another cannot.

In this point, Phone A could hear, but Phone B could not.

Please see diagram below to refer

Does anyone here ever encounter issue like this before?

Really appreciate every comments

Regards,

Sarm

Re: VoIP Traffic Issue

Wolfgang — Wed, 13 Mar 2019 07:46:58 GMT

Can you show us your NAT-rule for the connection. You have to translate both directions. Maybee this is a NAT problem. Did you see the NAT working for both directions?

Re: VoIP Traffic Issue

D_W — Wed, 13 Mar 2019 09:46:05 GMT

We had an identic issue and used at first https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk95369&partition=Advanced&product=Security#Relevant%20Check%20Point%20security%20rules to check the right rule set.
Based on how your VOIP Architecture is build you have to choose the right ruleset.

Then most stuff worked but for example more then one call at the same time (to/from external) wasn't possible. We haven't found any Log/Drop.

However our final solution was to disable all SIP IPS Rules for the VOIP Area.

KR
David

Re: VoIP Traffic Issue

Sarm_Chanatip — Wed, 13 Mar 2019 10:23:52 GMT

Dear Nickel,

I have configured static NAT both directions and only saw the NAT was working for outgoing call connection but still a bit confusing why incoming call ( RTP )is not working while call is connected.

Regards,
Sarm

Re: VoIP Traffic Issue

Sarm_Chanatip — Wed, 13 Mar 2019 15:14:31 GMT

Hi David,

Thank you for comments.

Based on your sk provided, I have the SIP Security Rule for Proxy in an External Network:

The rule is set to Souce: Net 192.168.10.0 with Destination: 10.105.62.0 and allow any service but still does not work.

Regarding IPS rules we do not have this blade enabled yet, it's just a firewall blade only

Regards,
Sarm

Re: VoIP Traffic Issue

D_W — Wed, 13 Mar 2019 15:36:01 GMT

Have you scrolled trough all sections that are in this SK?
For example when you NAT you have also have to set some special rules, see section 8.

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk95369&partition=Advanced&product=Security#Relevant%20Check%20Point%20NAT%20rules%20-%20SIP

Re: VoIP Traffic Issue

HeikoAnkenbrand — Wed, 13 Mar 2019 18:45:28 GMT

I describe exactly this issue in my article:

VoIP Issue and SMB Appliance (600/1000/1200/1400)

Re: VoIP Traffic Issue

Sarm_Chanatip — Thu, 14 Mar 2019 11:37:48 GMT

Hello Heiko,

I have read your article and tried to perform as the sk attached in the content but did not help. It's not looking like relevant to my case.

I'm still having in trouble with inbound call.

Any ideas I can check more?

Thank you!

Regards,
Sarm

Re: VoIP Traffic Issue

Pawel_Szetela — Thu, 14 Mar 2019 12:41:20 GMT

Hi,

We've had similiar problem but with H323 and no NAT in our case - "Hide internal networks behind gateway's IP" is checked and we have no NAT rules for VOIP traffic. Source and destination wasn't nated but payload was still nated. SK98354 in our case helped.

Depending on the version You are using look at this SK143713

Regards

Re: VoIP Traffic Issue

D_W — Fri, 15 Mar 2019 09:19:46 GMT

IPS can drop without log although IPS is not activated. Also SIP is mentioned.
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk98081&partition=Advanced&product=IPS%22