Solved: ASA H.323 disconnecting after 2 hours

acomiskey · ‎05-30-2008

ASA 8.0.2

h323 sessions are disconnecting after 2 hours. I have tried to fix this with the following...

timeout h323 0:00:00 h225 0:00:00

and

access-list h323_timeout extended permit tcp any any eq h323

class-map h323-timeout

description h323

match access-list h323_timeout

policy-map global_policy

class h323-timeout

set connection timeout tcp 0:00:00

Neither have worked. Any suggestions?

Farrukh Haroon · ‎05-30-2008

The following links are directly from Polycom:

Configuring a Cisco PIX Firewall to not drop H.323 calls after 2 hours

http://knowledgebase.polycom.com/kb/search.do?cmd=displayKC&docType=kc&externalId=10128&sliceId=SAL_PUBLIC_1_2&dialogID=6300049&stateId=1%200%206296551

http://knowledgebase.polycom.com/kb/search.do?cmd=displayKC&docType=kc&externalId=EndUser-Guides-Middleware-PolycomPathNavigatorandCiscoPIXFirewallpdf&sliceId=pdfPage_1&dialogID=6300049&stateId=1%200%206296551

Regards

Farrukh

View solution in original post

Farrukh Haroon · ‎05-30-2008

Are you inspecting H.323 in the global policy?

You can check by issuing the following command:

show run all policy-map

Also have a look at the following:

http://www.cisco.com/en/US/docs/security/asa/asa80/command/reference/i2.html#wp1704171

http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/inspect.html#wp1229306

Regards

Farrukh

acomiskey · ‎05-30-2008

No, I had to disable h323 inspection to get a polycom to work. Does this effect the ability to set a timeout?

Farrukh Haroon · ‎05-30-2008

As you know H.323 is opening dynamic connections (which comprise of both UDP and TCP). I don't know much about the Polycom implementation tough. By disabling inspection, I don't know if the firewall will be able to correlate the various control/data flows that comprise a single call (TCP / UDP) and apply the appropriate timeout.

Regards

Farrukh