Codian IP GW 3520 and MCU 4205. H.245 issue?

[Helpdesk]

Dear VC guru. I need your help as I'm not good at videoconferencing and just started to learn how it works. Now question. We have IP gateway placed in DMZ and MCU placed in our internal network. Dial plan on IP GW set to call MCU if any call from internet recieved on external interface of this gateway. When I attempted to call from outside using TANDBERG 1000MXP there was a silence. In 20 sec my video call is dropped. When I looked through event list on GW I could see received call, initiated call MCU

754 16:34:26.485 H.323 Info New connection accepted from 81.xxx.xxx.xxx
755 16:34:26.579 H.323 Info Making new connection to 10.18y.yyy.yyy (bandwidth 512000)
756 16:34:41.855 CONNECTION Info A direct call out failed!

In event liist on MCU I see H.245 error
1004 18:34:52.369 H.323 Info New connection accepted from 10.12z.zzz.zzz
1005 18:34:52.370 CONFERENCE Info new H.323 participant 170
1006 18:34:52.383 CONFERENCE Info created auto attendant "Auto attendant"
1007 18:35:07.385 H.323 Warning Timeout waiting for H.245 connection
1008 18:35:07.387 CONFERENCE Info destroy H.323 participant 170, "81.xxx.xxx.xxx "
1009 18:35:07.390 CONFERENCE Info destroyed "Auto attendant"

I captured traffic between that two units and found out that MCU sent CS: alerting CS: connect (in one packet). In 15 sec MCU sent CS: releaseComplete.

And finally I downloaded VC software, installed on my PC and changed in dial plan on IP GW ip address from MCU to ip of my PC. Video conference between Tandberg outside and my PC was established without any problem. Also I could easily create a conference when calling from MCU to ouside device through IP GW.

Any idea what could be a reason of VC failing?:ermm:

[phantom_iv]

I call firewall problems!

I'd suggest that the IP Gateway can't open an h245 TCP connection to the MCU - note that this uses a different port to the h225 connection used to initiate the call.

Which ports do you have open from the IP Gateway to the MCU? I suspect you might want to open a few more...

[orish]

Try to set 'full proxy' 'between ports' in the gatekeeper setup of the gateway.

Normally I would suggest to avoid NAT - that means buying the dual ethernet option for your MCU would be a smart solution!

[Joe Vallender]

Sounds like whatever is handling the Network Address Translation from 81.x.x.x to 10.x.x.x is not inspecting the packets for imbedded addresses. It could be the H.225 packets are not being inspected.

[phantom_iv]

I'd suggest that the IP Gateway can't open an h245 TCP connection to the MCU - note that this uses a different port to the h225 connection used to initiate the call.


To add to my earlier point (since noone seems to agree with me), could you confirm that TCP ports 49152 to 65535 are open from the IPGW to the MCU (and vice versa)?