topic Re: Videconferencing cut when applying policy in General Topics

Videconferencing cut when applying policy

Antoine_Rebuzzi — Fri, 29 Mar 2019 07:58:34 GMT

Hi,

I need a little bit of help, because we are struggling with surely a simple thing, but we can't find a good solution. We have an issue that, when applying policy, all our videoconferencing flows that are in progress are cut.

We did try to create specific UDP & TCP ports (1024-65535, H323, SIP...) and ticking the box "Keep connections open after the policy has been installed", but it still doesn't work.

I was wondering if someone experienced the same, of if there's a "best practice" for this on the policy rules.

Thanks in advance for your help !

Antoine REBUZZI

Re: Videconferencing cut when applying policy

Wolfgang — Fri, 29 Mar 2019 08:25:21 GMT

Any high CPU utilization at the moment of policy install?

Which type of appliance are you using ?

Re: Videconferencing cut when applying policy

Antoine_Rebuzzi — Fri, 29 Mar 2019 08:27:37 GMT

I've got two different firewalls, one is an appliance 5200, and another one is a splat on an HP server.

Hmm, no high CPU for these firewalls at the moment of the push.

Re: Videconferencing cut when applying policy

G_W_Albrecht — Fri, 29 Mar 2019 08:34:12 GMT

I would suggest to open a SR# with TAC to resolve that !

Re: Videconferencing cut when applying policy

Wolfgang — Fri, 29 Mar 2019 08:58:16 GMT

If there are no interesting logs seen for the dropped connections I agree with Günther to open a case.

There is a good description of the "Keep connections open after the policy has been installed" behaviour in

Connectivity Issues after Policy Install

Wolfgang

Re: Videconferencing cut when applying policy

Antoine_Rebuzzi — Fri, 29 Mar 2019 09:08:09 GMT

Thanks guys.

I was pretty sure I would need a ticket, but I wanted to check if someone experienced the same thing than me before 🙂

Will keep the info I might get from the TAC here !

Antoine

Re: Videconferencing cut when applying policy

Timothy_Hall — Fri, 24 May 2019 22:03:47 GMT

If you are using R80.10 gateway or earlier, SecureXL is completely restarted every time the policy is installed, and it is possible that this is the source of the problem. While you could try just completely disabling SecureXL with fwaccel off and then test policy reinstalls, it would be more prudent to exclude the IP addresses of your videoconferencing server(s) from SecureXL acceleration as detailed in the SK below, and see if the undesirable behavior goes away when policy is loaded.

sk104468: How to disable SecureXL for specific IP addresses

Re: Videconferencing cut when applying policy

JozkoMrkvicka — Fri, 29 Mar 2019 19:46:54 GMT

What about Connection Persistence (Keep all connections) within CLuster Object?

Re: Videconferencing cut when applying policy

Antoine_Rebuzzi — Fri, 05 Apr 2019 08:42:24 GMT

Thanks a lot guys. I will try some of these, while I'm waiting for the TAC answers 🙂