Hello everyone,
I am facing a strange behaviour with a Jabber (for Windows) connected through VPN calling an IP Phone.
The RTP flow is passing through some Stormshield FW.
For the example, the worstation has 2 IP : one Wifi 192.168.0.2 and one VPN 10.10.10.2
The IP Phone has the IP 172.16.16.2.
Call flow is Jabber => FW1 => FWX => FW20 => IP PHONE
When I do a tcpdump (host = 172.16.16.2) on FW1 I see something like that :
src=10.10.10.2
DST = 172.16.16.2. for the Jabber to IP Phone RTP flow
I don't see anything from the IP Phone to the Jabber.
I see the same through every FW except FW20.
The same tcpdump (host = 172.16.16.2) I see :
src=10.10.10.2
DST = 172.16.16.2 for the Jabber to the IP Phone.
Then I see the answer :
src=172.16.16.2 (I am okay with that)
DST = 192.168.0.2 (the real workstation IP ????)
Has someone ever seen this ?
How the IP Phone is able to see this real IP since it is answering to this ?
Is it possible that Jabber is giving the real IP or is it a FW configuration issue ?
Best regards
Irwin
