VOIP with H323 over remote access VPN not working on R80.10

[Viviana_Checa]

Hi everyone,

I am trying to implement VOIP with H323 over remote access VPN in R80.10, the VPN user connects to Avaya Central (which is in internal network of the main office) through a soft phone. The status on R80.10 is: the soft phone register successfully on Avaya Central, the vpn user is able to do calls (calls between VPN user and extension on main office), but, the voice of the vpn user is not heard on the main office. The voice from main office is heard by vpn user.

On R77.30 works very fine, the thing is on R80.10 there is no protocol type on H323 options. For VoIP over VPN, protocol type must be set on NONE, for Video calls, protocol Type must be set on H323.

I have cloned H323, and try to set on protocol - None, but it did not work!

I attached to this post the captures for H323 on R77.30 and R80.10

Any ideas for solve this issue?

I appreciate your valuable comments

[Vladimir · Accepted solution]

On R80.10, you have "Match for Any" selected, unlike in R77.XX:

[Viviana_Checa]

Hi Vladimir, thank you for your valuable answer. My H323_Cloned was unchecked Match for any, I have checked this option and created a specific rule (Source: VPN Network, Destination: VoIP Network, Service H323_Cloned)...Push the policy. And guess what! It works!! Both sides can hear audio

Thank you again for your helpful answer!

[Vladimir]

You are quite w:)lcome

[Viviana_Checa]

[Heisenberg]

Hi Viviana_Checa,

Is this settings on the split tunnel mode? or need full tunnel to achieve?

[Gaurav_Pandya]

Yeah, I had also same scenario where we are able to heard far end voice but our voice was not audible.

We did the same thing which Vladimir has suggested and changed setting in h323 service. It worked.

[Viviana_Checa]

Hi Gaurav, yes, it really worked! Now the vpn users are able to do calls.

[Sujatmiko_Sujat]

Hi Vivianya,

Did you create a gatekeeper and gateway object for the AVAYA ? 

I tried to add new and tried to install policy, but got this error : 

Gateway: NS-IDCYB-CPFWINT-LAN
Policy: Fw-Access_Module
Status: Failed
- "/opt/CPR77CMP-R80/conf/Fw-Access_Module.pf", line 157364: ERROR: Duplicate keys <0a070507, 40000000, 00000001> in table 'ho_from'
- Error compiling IPv6 flavor.
- Operation ended with errors.

regards,

Miko

[PhoneBoy]

I highly recommend you open a TAC case so we can investigate what's going on.

Contact Support | Check Point Software 

[Viviana_Checa]

Hi Miko,

Did you disable the ipv6 on the fw?

[Claudio_Bolcato]

I had the same problem with both SIP and H.323. The major problem was with asyncronous routing and/or NAT. 

Another useful thing to check is the deep inspection on the Voip Protocols. Maybe you can try to use a custom service without deep inspection.

[Sujatmiko_Sujat]

Hi all, 

thx for the reply, case solved when we used SIP not used H 323.

thx very much,

regards,

Miko

[Gaurav_Pandya]

Thanks for sharing information.

[Viviana_Checa]

Hi Miko, is better use SIP, H 323 is complicated ! but works !