Watchguard Firewall & H.239

[Anonymous]

Dear All

Has anyone manahed to get the People & Content working on a HDX7000 through a Watchguard Firewall XTM 505 ?  I have been on with Wathcgaurd fror the past couple of days and now they say that they don't support it and there is no proxy available.  They suggest to see if anyone else has it working via filter rule, as it may be possible to do it via that, though they naturally won't commit.

Any help & advise would be greatly appreciated.

Regards

MA

[Anonymous]

Hey MACOM -

    Just to clarify, are you able to make any standard p2p calls with the HDX system?  Or is this just relating to pushing content while on a call?

[Anonymous]

Hi Chris

Everything else is fine - it's just the content sharing during the call which is the issue.

Thanks

Mark

[Anonymous]

Since you are able to make video calls with the system, it may not be a firewall issue.  If you are able to make H.323 calls through the firewall with no problems, content should work as well.  Couple of questions for you...

1) What is the content source?

2) How is the content being pushed? i.e. direct connection to the codec, through a video switcher/scaler, through People+Content IP?

3) What error message, if any, are you getting when trying to push content?

4) If no error message is given is their any indication that something is going to the far end? i.e. black or blue screen

5) Does this only happen when calling one particular endpoint or does it occur no matter what endpoint is being called?

Answering these questions will give me a better understanding of what the nature of the problem is.

[Anonymous]

Hi Chris

Answers as follows:

1. Powerpoint presentation

2. People+contents IP

3. No error, just a black screen where the content should be.

4. As above

5. I have tried point to point and the test site with with content test - it comes back stating tnat H.239 is not being passed.

Many thanks for you help.

Best regards

Mark

[Anonymous]

How broad a range of UDP ports are open.  Does the range agree with HDX Admin>Network>IP>Firewall.  The required range varies dependant upon s/w version. VG3.0.5 is UDP3230-3277 but it has in the past gone as high as 3230-3380 IIRC.

Pete

[Anonymous]

One of our customers has exactly the same problem in one location.

The other location, also watchguard with the same firewall rules but latest firmware on the wg, is working fine.

During testcalls we´ve seen no packet loss, no drops on the fw.

The far side sees that content is being pushed but gets only black screen.
What we´ve done so far:

Tested inside the lan - content working fine (just to make sure that there´s no HW problem)

Tried to send content via p+c ip to the far side - results in black screen (called party)

Tried to send content via direct vga/dvi connection to the far side - results in black screen (called party)

Video and audio is absolutely fine, received and transmitted without any problems.

The port range that has been defined on the wg and also the port forwarding is correct.

I´ll talk to my fw specialist about some more details (firmware etc.) ´cause he´s more involved in that case.

[Anonymous]

Hi Pete

I have all the ports open as far as I can see (3230-3285).  I did read an article on a Juniper forum (I think) which was suggesting a huge number of ports.  I will test when back on-site, but not keen on opening, what would equate to, most or the ports.

Thanks

Mark

[Anonymous]

Thanks Uwe

It does sound very mich the same.

Firmware details would be much appreciated.

Many thanks and best regards

Mark

[Anonymous]

If you are calling Polycom to Polycom, an interesting test to carry out would be to turn off H.239 (Admin>Network>Call Preferences)

That won't try & send H.239 but will do Polycom Dual Stream People & Content.

Pete