topic Re: Unable to call video conferencing system at remote site in Network Security

Unable to call video conferencing system at remote site

lily.chang — Mon, 11 Mar 2019 17:50:29 GMT

We are trying to give home users, via their Internet connection, the ability to call video conferencing systems at remote sites. From tests, while calling the remote site video conferencing system, it continues dialing and never connects.

Here's what is showing in syslog:

5/24/2010 3:50:39 PM Teardown TCP connection 383597 for outside:<source IP>/1720 to inside:<dest IP>/1092 duration 0:02:01 bytes 0 SYN Timeout
5/24/2010 3:48:37 PM Built outbound TCP connection 383597 for outside:<source IP>/1720 (<source IP>/1720) to inside:<dest IP>/1092
5/24/2010 3:46:20 PM Deny TCP (no connection) from <source IP>/57502 to 63.172.227.230/1720 flags ACK on interface outside
5/24/2010 3:46:19 PM Teardown TCP connection 383379 for outside:<source IP>/57502 to inside:<dest IP>/1720 duration 0:00:29 bytes 825 TCP Reset-I
5/24/2010 3:46:19 PM H225 message ALERTING received from <dest IP>/1720 to <source IP>/57502 before SETUP
5/24/2010 3:46:03 PM H225 message ALERTING received from <dest IP>/1720 to <source IP>/57502 before SETUP
5/24/2010 3:45:55 PM H225 message ALERTING received from <dest IP>/1720 to <source IP>/57502 before SETUP
5/24/2010 3:45:51 PM H225 message ALERTING received from <dest IP>/1720 to <source IP>/57502 before SETUP
5/24/2010 3:45:50 PM H225 message ALERTING received from <dest IP>/1720 to <source IP>/57502 before SETUP
5/24/2010 3:45:50 PM Built inbound TCP connection 383379 for outside:<source IP>/57502 (<source IP>/57502) to inside:<dest IP>/1720

The following ports are open to the video conferencing system:

tcp 1503
udp 1718
tcp 1718
udp 1719
tcp 1719
tcp h323
tcp 1731
tcp ldap
tcp range 1024 65535
udp range 1024 65535

fixup is set:

fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719

Has anyone seen this message before?

H225 message ALERTING received from <dest IP>/1720 to <source IP>/57502 before SETUP

We are using a PIX515E running 6.3(5).

The laptop with the PVX software has permitted the PVX software in the Windows firewall.

Any assistance would be much appreciated.

Regards,

Lily

Re: Unable to call video conferencing system at remote site

Magnus Mortensen — Tue, 25 May 2010 15:24:12 GMT

Lily,

You may need to disable the fixup since it looks like the video phones are not following the RFC correctly. You could try removing "fixup protocol h323 h225 1720" and retrying. My guess is Polycom phones?

- Magnus

Re: Unable to call video conferencing system at remote site

lily.chang — Tue, 25 May 2010 15:28:17 GMT

Hi Magnus,

Correct, it is a Polycom system.

I have tested removing the fixup protocol h323 h225 1720 line. When testing without it, the camera does not even see the call coming in whereas before it sees the call but fails.

Regards,

Lily

Re: Unable to call video conferencing system at remote site

Magnus Mortensen — Tue, 25 May 2010 15:39:02 GMT

Lily,

It may be due to CSCdw13911 which basically outlines that thew PIX 6.3 code does not support segmented H323/SIP/SKinny traffic. If you can get a packet capture of the call setup, look to see if the SETUP message is segmented across two more more packets... If so you will need to move up to 7.x code or later to get support for segmented signaling. There very well may be a SETUP message being sent before the ALERTING message but if that SETUP message is segmented, the inspection won't see it and therefore it will have an issue with the ALERTING message.

- Magnus

Re: Unable to call video conferencing system at remote site

lily.chang — Tue, 25 May 2010 15:40:54 GMT

Hi Magnus,

I will try a packet capture and let you know the results.

Thanks,

Lily

Re: Unable to call video conferencing system at remote site

lily.chang — Tue, 25 May 2010 19:16:45 GMT

Hi Magnus,

Here is a packet capture:

14:04:32.322859 .57483 > .1720: S 2983242345:2983242345(0) win 4096
14:04:32.324583 .1720 > .57483: S 3526985:3526985(0) ack 2983242346 win 8192
14:04:32.682047 .57483 > .1720: . ack 3526986 win 4096
14:04:32.799229 .57483 > .1720: P 2983242346:2983242854(508) ack 3526986 win 4096
14:04:32.800526 .1720 > .57483: . ack 2983242854 win 7684
14:04:32.809619 .57483 > .1720: P 2983242854:2983242979(125) ack 3526986 win 4096
14:04:32.810459 .1720 > .57483: . ack 2983242979 win 8067
14:04:32.842729 .1720 > .57483: P 3526986:3527090(104) ack 2983242979 win 8192
14:04:32.874771 .1720 > .57483: P 3527090:3527228(138) ack 2983242979 win 8192
14:04:33.289169 .57483 > .1720: . ack 3526986 win 4096
14:04:33.539004 .1720 > .57483: P 3526986:3527228(242) ack 2983242979 win 8192
14:04:37.539141 .1720 > .57483: P 3526986:3527228(242) ack 2983242979 win 8192
14:04:45.539522 .1720 > .57483: P 3526986:3527228(242) ack 2983242979 win 8192
14:05:01.540194 .1720 > .57483: P 3526986:3527228(242) ack 2983242979 win 8192
14:05:02.373851 .57483 > .1720: P 2983242979:2983243033(54) ack 3526986 win 4096
14:05:02.375819 .1720 > .57483: . ack 2983243033 win 8138
14:05:02.392313 .57483 > .1720: F 2983243033:2983243033(0) ack 3526986 win 4096
14:05:02.394053 .1720 > .57483: F 3527228:3527228(0) ack 2983243034 win 8192
14:05:02.400278 .1720 > .57483: R 3527229:3527229(0) ack 2983243034 win 8192

Not sure if you can help me interpret this. What do the P and F mean?

Thanks,

Lily