STUN traffic

[victor0315]

Does anyone here encoutered any issue on R77 30 not accepting STUN reply?

Currently we have issue on our on-prem skype for business setup because the firewall is dropping the STUN reply of the endpoint.

Anonymous external client cannot hear and cannot be heard during the conference call.

Is there any work around to resolve the issue of checkpoint not accepting STUN traffic?

[Maarten_Sjouw]

Keep in mind that for VOIP the client talks to the Call manager for the control session and when you call someone, the actual voice data is sent direct from phone to phone. UDP High ports (or a specific range when set) need to be enabled between them.

[victor0315]

The external end client is replying with a random ports between 1024-65535 to the external facing interface of the A/V edge server. Is it advisable or safe to allow all those ports from any (internet) to A/V edge server facing interface?

[Maarten_Sjouw · Accepted solution]

Towards the internet the Edge server should work as a proxy. But there still should be traffic allowed, besides that you can configure that UDP port range, which is most often set somewhere between 40.000 and 50.000. That hsould be more than enough in most cases and yes they would need to be allowed.

[Nicklas_Bargell]

Hi,

According to sk34538, STUN is not supported. 

Regards,

Nicklas Bargell