Issues with VoIP in one of our office

[Ob1lan]

Hi,

So we have one of our office which is connected to our other offices via S2S VPN. They have a Check Point 1530 running R80.20.05.

Their VoIP provider installed a server on the LAN, and it communicated with the trunk that is outside our network.

Enclosed  are the NAT rules created for them (where x.SIP.SERVER is the local device, VoIP_1x is the provider's device on internet and LU-xx-WAN-IP is our firewall's WAN IP).

The problem explained by our SIP provider, along with a suggestion :

Currently, if a call start ringing and the other party answer after more than 30 sec, the sip 200 OK is blocked by your router and the call is cancelled after 30 sec.

Could you increase udp conntrack timeout. I guess it's now setup to 30sec.
on linux, this is :
net.netfilter.nf_conntrack_udp_timeout = 30

net.netfilter.nf_conntrack_udp_timeout_stream = 180

If you could set it to 180 sec, this should be fine.

Do you happen to know what needs to be done on our Check Point firewall to solve their issue ?

Thanks in advance for your help

[PhoneBoy]

I'm assuming the analog to this would be the virtual UDP Timeout (which is 40 seconds).
This is set in Global Properties > Stateful Inspection

[G_W_Albrecht]

Check Point 1530 locally managed has it as Advanced Settings > Stateful Inspection - UDP virtual session timeout

[Ob1lan]

Unfortunately, this is centrally managed, so I don't have that setting in the list.

[G_W_Albrecht · Accepted solution]

That is even easier - in this case, you can change this in the (duplicated) service itself that is used on the GW !

[Ob1lan]

Aahh ! I completely forgot about this ! Thanks for reminding me ! Indeed I can set a specific value for the Virtual session timeout from the service object itself 🙂

 

Thanks a lot !!

[Ob1lan]

Indeed, that was my guess, however changing that value from there will impact all our gateways (40+ worldwide). 

I wish there was an option to change the value only for that specific gateway...

[the_rock]

Hm, as phoneboy said you can chanhe the timeout settings, but question is really do you see any drops on the CP firewall  at all?