Buy or Renew
Buy or Renew
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
1155
Views
0
Helpful
3
Replies

MGCP E1 backhaul issues traversing Checkpoint after FW upgrade.

IAN HOLMES
Level 1
Level 1

‎03-04-2010 04:26 AM - edited ‎03-15-2019 09:38 PM

The ccm-manager backhaul process is hunting through the primary, secondary call agents, then dropping the backhaul. All started after the customer's provider upgraded their Checkpoint firewall. Initially the gateway wasn't showing as registered in Call Manager after the upgrade. But after they patched the firewall for a known MGCP bug that was black-holing traffic the gateway shows as registered. But we cannot place calls and have forced the gateways into SRST as the ccm-manager backhaul process seems to be sending packets but not receiving any. The firewall logs are seeing traffic to the CCM on TCP 2428 and returning on the random source port........as per the tcpdump on the FW interfaces........but we never see the packets received in the "sh ccm-manager backhaul". Debug of the ccm-manager backhaul packets shows them being sent. UDP port 2427 is being seen in both directions also.

Labels:
0 Helpful
3 Replies 3

jconi
Level 3
Level 3

‎03-04-2010 01:27 PM

Hello Ian,

I had the same pb with MGCP GW and Checkpoints several times.

The GW receives the 200 OK mgcp msg after sending a RSIP, but it's not recognized by the GW as an MGCP msg. In the debug mgcp packets on the router, I only see RSIP. But in the wireshark, I see the RSIP and the 200 OK. However, the DSCP was reset to 0 by the FW, so this FW certainly modified the packets in a way that I never found.

I changed the network design for the GW when I faced this pb.

jp

0 Helpful

IAN HOLMES
Level 1
Level 1
In response to jconi

‎03-04-2010 08:38 PM

JP,

     So did you solve this by bypassing the FW or was there some rules applied. I don't have a bypass option. I don't see how DSCP value change would be an issue.......as this is changed all the time by carriers, but were you suggesting if they made that change, maybe there are other changes within the packet or payload being done by Checkpoint ??

Cheers, Ian.

0 Helpful

jconi
Level 3
Level 3
In response to IAN HOLMES

‎03-04-2010 11:32 PM

I bypassed the FW.

I tried to reproduce the problem in my lab with a Checkpoint installed by a colleague, but the GW worked correctly.

For the problem I was suggesting that something was changed by the FW (not only the DSCP), that can cause the problem.

On the customer site, I could not do anything with the Checkpoint.

Maybe you can ask them to disable the SmartDefense (just temporarily), or uncheck some MGCP related boxes for packet inspection or other.

Good luck

jp

0 Helpful
Customers Also Viewed These Support Documents