Unable to call video conferencing system at remote site

[lily.chang]

We are trying to give home users, via their Internet connection, the  ability to call video conferencing systems at remote sites. From tests,  while calling the remote site video conferencing system, it continues  dialing and never connects.

Here's what is showing in syslog:

5/24/2010 3:50:39 PM  Teardown TCP connection 383597 for  outside:<source IP>/1720 to inside:<dest IP>/1092 duration  0:02:01 bytes 0 SYN Timeout
5/24/2010 3:48:37 PM  Built outbound TCP connection 383597 for  outside:<source IP>/1720 (<source IP>/1720) to  inside:<dest IP>/1092
5/24/2010 3:46:20 PM  Deny TCP (no connection) from <source  IP>/57502 to 63.172.227.230/1720 flags ACK on interface outside
5/24/2010 3:46:19 PM  Teardown TCP connection 383379 for  outside:<source IP>/57502 to inside:<dest IP>/1720 duration  0:00:29 bytes 825 TCP Reset-I
5/24/2010 3:46:19 PM  H225 message ALERTING received from <dest  IP>/1720 to <source IP>/57502 before SETUP
5/24/2010 3:46:03 PM  H225 message ALERTING received from <dest  IP>/1720 to <source IP>/57502 before SETUP
5/24/2010 3:45:55 PM  H225 message ALERTING received from <dest  IP>/1720 to <source IP>/57502 before SETUP
5/24/2010 3:45:51 PM  H225 message ALERTING received from <dest  IP>/1720 to <source IP>/57502 before SETUP
5/24/2010 3:45:50 PM  H225 message ALERTING received from <dest  IP>/1720 to <source IP>/57502 before SETUP
5/24/2010 3:45:50 PM  Built inbound TCP connection 383379 for  outside:<source IP>/57502 (<source IP>/57502) to  inside:<dest IP>/1720

The following ports are  open to the video conferencing system:

tcp 1503 
udp 1718 
tcp 1718 
udp 1719 
tcp 1719 
tcp h323 
tcp 1731 
tcp ldap 
tcp range 1024 65535 
udp range 1024 65535

fixup is set:

fixup  protocol h323 h225 1720
fixup protocol h323 ras 1718-1719

Has anyone seen  this message before?

H225 message ALERTING received from <dest  IP>/1720 to <source  IP>/57502 before SETUP

We are using a PIX515E  running 6.3(5).

The laptop with the PVX software has  permitted the PVX software in the Windows firewall.

Any  assistance would be much appreciated.

Regards,

Lily

[Magnus Mortensen]

Lily,

     You may need to disable the fixup since it looks like the video phones are not following the RFC correctly. You could try removing "fixup  protocol h323 h225 1720" and retrying. My guess is Polycom phones?

- Magnus

[lily.chang]

Hi Magnus,

Correct, it is a Polycom system.

I have tested removing the fixup protocol h323 h225 1720 line. When testing without it, the camera does not even see the call coming in whereas before it sees the call but fails.

Regards,

Lily

[Magnus Mortensen]

Lily,

     It may be due to CSCdw13911 which basically outlines that thew PIX 6.3 code does not support segmented H323/SIP/SKinny traffic. If you can get a packet capture of the call setup, look to see if the SETUP message is segmented across two more more packets... If so you will need to move up to 7.x code or later to get support for segmented signaling. There very well may be a SETUP message being sent before the ALERTING message but if that SETUP message is segmented, the inspection won't see it and therefore it will have an issue with the ALERTING message.

- Magnus

[lily.chang]

Hi Magnus,

I will try a packet capture and let you know the results.

Thanks,

Lily

[lily.chang]

Hi Magnus,

Here is a packet capture:

14:04:32.322859 .57483 > .1720: S 2983242345:2983242345(0) win 4096
14:04:32.324583 .1720 > .57483: S 3526985:3526985(0) ack 2983242346 win 8192
14:04:32.682047 .57483 > .1720: . ack 3526986 win 4096
14:04:32.799229 .57483 > .1720: P 2983242346:2983242854(508) ack 3526986 win 4096
14:04:32.800526 .1720 > .57483: . ack 2983242854 win 7684
14:04:32.809619 .57483 > .1720: P 2983242854:2983242979(125) ack 3526986 win 4096
14:04:32.810459 .1720 > .57483: . ack 2983242979 win 8067
14:04:32.842729 .1720 > .57483: P 3526986:3527090(104) ack 2983242979 win 8192
14:04:32.874771 .1720 > .57483: P 3527090:3527228(138) ack 2983242979 win 8192
14:04:33.289169 .57483 > .1720: . ack 3526986 win 4096
14:04:33.539004 .1720 > .57483: P 3526986:3527228(242) ack 2983242979 win 8192
14:04:37.539141 .1720 > .57483: P 3526986:3527228(242) ack 2983242979 win 8192
14:04:45.539522 .1720 > .57483: P 3526986:3527228(242) ack 2983242979 win 8192
14:05:01.540194 .1720 > .57483: P 3526986:3527228(242) ack 2983242979 win 8192
14:05:02.373851 .57483 > .1720: P 2983242979:2983243033(54) ack 3526986 win 4096
14:05:02.375819 .1720 > .57483: . ack 2983243033 win 8138
14:05:02.392313 .57483 > .1720: F 2983243033:2983243033(0) ack 3526986 win 4096
14:05:02.394053 .1720 > .57483: F 3527228:3527228(0) ack 2983243034 win 8192
14:05:02.400278 .1720 > .57483: R 3527229:3527229(0) ack 2983243034 win 8192

Not sure if you can help me interpret this. What do the P and F mean?

Thanks,

Lily