topic Re: Site-to-site VPN VoIP between CP 6400 with R81 and CP 1530 does not work in Spark Firewall (SMB)

Site-to-site VPN VoIP between CP 6400 with R81 and CP 1530 does not work

SWBW_Klixer — Tue, 18 Oct 2022 18:15:23 GMT

Hello,

via an existing VPN tunnel, IP telephones from the manufacturer Avaya are to register in a branch office via H232 on the "IP Office 500 V2" PBX at the main location and make calls via this.

The registration of the phones works.

However, telephony is not possible via these devices.
An extremely delayed operation of the IP telephones can also be seen.

In the branch office, a CP 1530 appliance establishes a permanent VPN tunnel to the CP 6400 security cluster. There is a router in front of the CP 1530 appliance and implements the Internet dial-in. There is a switch behind the CP 1530. The interfaces of the CP 1530 and the switch are assigned Vlans.

No blocked packets can be seen in the log via Smart Console.

Can someone help me to solve the problem. Thank you in advance.

Re: Site-to-site VPN VoIP between CP 6400 with R81 and CP 1530 does not work

G_W_Albrecht — Tue, 18 Oct 2022 20:30:36 GMT

Did you already contact CP TAC ?

Re: Site-to-site VPN VoIP between CP 6400 with R81 and CP 1530 does not work

Chris_Atkinson — Wed, 19 Oct 2022 01:32:56 GMT

What version is the 1530 operating with and how are your rules for SIP/H232 traffic defined?

What if any advanced settings are set on the 1530 with regards to VoIP?

Re: Site-to-site VPN VoIP between CP 6400 with R81 and CP 1530 does not work

SWBW_Klixer — Wed, 19 Oct 2022 09:47:50 GMT

Re: Site-to-site VPN VoIP between CP 6400 with R81 and CP 1530 does not work

SWBW_Klixer — Wed, 19 Oct 2022 09:54:58 GMT

The version of the 1530 is R80.20.50 (992002773).

There are currently no explicit rules for SIP/H232.
In the current test phase, the value "Any" is set under "Services&Applications".
There are no explicit settings on the 1530 related to VoIP.

What should be set?

Many Thanks

Re: Site-to-site VPN VoIP between CP 6400 with R81 and CP 1530 does not work

G_W_Albrecht — Wed, 19 Oct 2022 11:01:04 GMT

sk176295: How to configure VoIP on Locally Managed Quantum Spark appliances using new VoIP wizard (SIP users)

Re: Site-to-site VPN VoIP between CP 6400 with R81 and CP 1530 does not work

SWBW_Klixer — Wed, 19 Oct 2022 14:18:00 GMT

The 1530 is not managed locally. We use the central management.

Where can you set the appropriate settings here? Many Thanks.

Re: Site-to-site VPN VoIP between CP 6400 with R81 and CP 1530 does not work

rrbranco — Thu, 20 Oct 2022 14:43:29 GMT

Check you scenario and configure the rules based on the info available at

ATRG VoIP -

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk95369#Relevant%20Check%20Point%20security%20rules

attention to "... Do not use this service in the same rule with the 'XXXX' service (because they contradict each other). ... "

Re: Site-to-site VPN VoIP between CP 6400 with R81 and CP 1530 does not work

G_W_Albrecht — Thu, 20 Oct 2022 14:50:53 GMT

Why not ? That is the way to get your issue resolved asap !

Re: Site-to-site VPN VoIP between CP 6400 with R81 and CP 1530 does not work

G_W_Albrecht — Thu, 20 Oct 2022 14:52:29 GMT

Then you will have to follow this guide: sk95369: ATRG: VoIP

Re: Site-to-site VPN VoIP between CP 6400 with R81 and CP 1530 does not work

RS_Daniel — Thu, 20 Oct 2022 20:27:20 GMT

Hi,

I see two important things to check here. First as every one here already told you, make sure you have a correct configuration according to your specific scenario and sk95369. Second thing, can you provide more details about your ISP connections? are they static IP addresses? dynamic? if dynamic, does DHCP provide a public IP or private IP address that is nated later by the ISP?

did you check drops on CLI with "fw ctl zdebug + drop | grep X.X.X.X" while you replicate the issue? if you did not, try filtering the PBX ip address first and then the IP phone address.

Regards