[VSX 5000] Behind A Firewall: Can Call But Can't Receive A Call

[Anonymous]

Hi,

I'm looking for help regarding an issue with a Polycom VSX 5000 set behind a firewall: I can call outside but not receiving any call.

However, if I'm not behind a firewall and use a direct WAN IP address: no problem.

Let me present you the situation.

Site A:

Visio Polycom VSX 5000:

• Location: China
• WAN_IP_A (FW WAN IP)
• LAN IP: 172.16.29.2/24 + gateway and DNS settings accordingly
• Network > IP Network > Firewall: 
• Fixed Ports: YES + default ports
• NAT configuration: Manual
• NAT Public (WAN) Address: FW WAN IP
• NAT is H.323 Compatible: NO
• Address Displayed in Global Directory: Public
• Behind a FW SonicWALL NSA 2400

On the FW:

• Opened the TCP ports 1720, 3230-3239: UDP ports 3230-3269
• Set the NAT rules
• Set the Access rules

I made screenshots of the FW config made for the visio:

• System Information
• Ports Service Objects
• Ports Group Service Objects
• Address Object for the LAN IP of the visio
• FW Access Rule: LAN > WAN
• FW Access Rule: WAN > LAN
• NAT Policies

Site B:

Visio Polycom VSX 5000:

• Location: Hong Kong
• WAN_IP_B
• Not behind a firewall

Test:

• Site A calls Site B with WAN_IP_B: video and sound OK
• Site B calls Site A with WAN_IP_A: NOK => it's ringing on Site B but no one picks up; nothing happens on Site A.

Remarks:

• I tried NAT is H.323 Compatible: YES => same result
• If I set on the visio "NAT configuration: Auto", I automatically receive a weird WAN IP that is not even in the subnet of WAN IP we lease from our ISP... I don't know what this IP is, but I would expect the visio would detect the WAN IP of our FW or our ISP gateway.

Can anyone help me with this issue? Did I miss something on the FW configuration? Why is calling only working on 1 side?

[Ovg1]

Did you forward TCP ports 1720, 3230-3239: UDP ports 3230-3269 from external IP of your NAT to internal IP of your VSX?

[Anonymous]

Yes, that's what the last rule of this screenshot is supposed to do...

If any request arrives on the WAN port (X1), translate to Polycom VSX 5000 Private (LAN IP of the visio) if it matches the service Polycom VSX 5000 Services (includes all the ports mentionned).

[Ovg1]

Does VSX ringing when incoming call arrives? If no, 1720 port not forwarded to VSX ....

I can't open link - login/pass required ...

[Anonymous]

Hi,

Sorry for the screenshot, this link should work.

No, on Site A, VSX doesn't ring. Only rings on Site B but no response from the far site. It's weird because according to the config I've done on the SonicWALL, the port 1720 should be forwarded to the VSX...

[Ovg1]

Since no incoming call at Site A, there is/are some error(s) in configuration of firewall - double check it.

[Anonymous]

To chip in on this, you mention about ring tones at either side, I am on similar kit and similar scenario.

Site A calls Site B and auto-answer works perfectly - no problem

Site B calls Site A and both sides you can hear ringing.

Ports opened and NAT'd correct on router. Added to ACL NAT as well.

What am I missing?

[Anonymous]

Does anyone know how I can edit my own post? I need to edit 1 link for the screenshot because it's not the correct one and I get Google Drive notifications to give access to some users but I can't do that...

[SteffenBaierUK]

Hello CuiZinieR,

welcome to the Polycom Community.

After a certain period you can no longer edit your post. Simply attach the Screenshot instead of linking it in your next reply.

Please ensure to provide some feedback if this reply has helped you so other users can profit from your experience.

Best Regards

Steffen Baier

Polycom Global Services

[Anonymous]

Hi,

Following SteffenBaierUK's instructions, I post in attachment the image that should be accessible via the "NAT Policies" hyperlink in the first post. Please, don't request the access for this image because I'm not able to make the image available on Internet: it was a mistake, I used a wrong link.