topic Re: Issues with VoIP in one of our office in Spark Firewall (SMB)

Issues with VoIP in one of our office

Ob1lan — Mon, 26 Apr 2021 13:00:02 GMT

Hi,

So we have one of our office which is connected to our other offices via S2S VPN. They have a Check Point 1530 running R80.20.05.

Their VoIP provider installed a server on the LAN, and it communicated with the trunk that is outside our network.

Enclosed are the NAT rules created for them (where x.SIP.SERVER is the local device, VoIP_1x is the provider's device on internet and LU-xx-WAN-IP is our firewall's WAN IP).

The problem explained by our SIP provider, along with a suggestion :

Currently, if a call start ringing and the other party answer after more than 30 sec, the sip 200 OK is blocked by your router and the call is cancelled after 30 sec.

Could you increase udp conntrack timeout. I guess it's now setup to 30sec.
on linux, this is :
net.netfilter.nf_conntrack_udp_timeout = 30

net.netfilter.nf_conntrack_udp_timeout_stream = 180

If you could set it to 180 sec, this should be fine.

Do you happen to know what needs to be done on our Check Point firewall to solve their issue ?

Thanks in advance for your help

Re: Issues with VoIP in one of our office

PhoneBoy — Wed, 28 Apr 2021 16:21:56 GMT

I'm assuming the analog to this would be the virtual UDP Timeout (which is 40 seconds).
This is set in Global Properties > Stateful Inspection

Re: Issues with VoIP in one of our office

the_rock — Wed, 28 Apr 2021 17:04:05 GMT

Hm, as phoneboy said you can chanhe the timeout settings, but question is really do you see any drops on the CP firewall at all?

Re: Issues with VoIP in one of our office

G_W_Albrecht — Fri, 30 Apr 2021 08:19:54 GMT

Check Point 1530 locally managed has it as Advanced Settings > Stateful Inspection - UDP virtual session timeout

Re: Issues with VoIP in one of our office

Ob1lan — Mon, 03 May 2021 10:02:09 GMT

Unfortunately, this is centrally managed, so I don't have that setting in the list.

Re: Issues with VoIP in one of our office

Ob1lan — Mon, 03 May 2021 10:03:02 GMT

Indeed, that was my guess, however changing that value from there will impact all our gateways (40+ worldwide).

I wish there was an option to change the value only for that specific gateway...

Re: Issues with VoIP in one of our office

G_W_Albrecht — Mon, 03 May 2021 12:10:46 GMT

That is even easier - in this case, you can change this in the (duplicated) service itself that is used on the GW !

Re: Issues with VoIP in one of our office

Ob1lan — Tue, 04 May 2021 08:47:30 GMT

Aahh ! I completely forgot about this ! Thanks for reminding me ! Indeed I can set a specific value for the Virtual session timeout from the service object itself 🙂

Thanks a lot !!