Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    NAT 1:1 Polycom VSX 7000

    Scheduled Pinned Locked Moved NAT
    48 Posts 3 Posters 6.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • W
      wesleylc1 Rebel Alliance @stephenw10
      last edited by

      What would the tcpdump command syntax look like, just to filter everything to my wan-ip port 189.20.108.XX port 5060?

      1 Reply Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        I would do it from the GUI but: https://docs.netgate.com/pfsense/en/latest/monitoring/performing-a-packet-capture.html

        Steve

        1 Reply Last reply Reply Quote 0
        • W
          wesleylc1 Rebel Alliance
          last edited by

          @stephenw10

          Hi Steve, how are you?
          I monitored a connection made by my videoconferencing system, using "pftop" CLI my polycom connects with the target, but "NO_TRAFFIC: SINGLE" communication errors occur.

          PR        DIR SRC                                           DEST                                                   STATE                AGE       EXP     PKTS    BYTES
rsvp      In  192.168.40.251:0                              140.242.250.200:0                              NO_TRAFFIC:SINGLE       00:15:15  00:00:19        0        0
tcp       In  192.168.40.251:3233                           140.242.250.200:1720                          ESTABLISHED:ESTABLISHED  00:07:57  23:58:04       15     1096
tcp       Out 189.20.108.XX:3233                            140.242.250.200:1720                          ESTABLISHED:ESTABLISHED  00:07:57  23:58:04       15     1096
tcp       In  192.168.40.251:3234                           140.242.250.200:3242                          ESTABLISHED:ESTABLISHED  00:07:57  23:59:35      181    10480
tcp       Out 189.20.108.XX:3234                            140.242.250.200:3242                          ESTABLISHED:ESTABLISHED  00:07:57  23:59:35      181    10480
udp       In  192.168.40.251:3232                           140.242.250.200:3262                           NO_TRAFFIC:SINGLE       00:07:56  00:00:30    19850 13004860
udp       Out 189.20.108.XX:3232                            140.242.250.200:3262                               SINGLE:NO_TRAFFIC   00:07:56  00:00:30    19850 13004860
udp       In  192.168.40.251:3231                           140.242.250.200:3261                           NO_TRAFFIC:SINGLE       00:07:51  00:00:29       95     7220
udp       Out 189.20.108.XX:3231                            140.242.250.200:3261                               SINGLE:NO_TRAFFIC   00:07:51  00:00:29       95     7220
udp       In  192.168.40.251:3233                           140.242.250.200:3263                           NO_TRAFFIC:SINGLE       00:07:51  00:00:29       95     9120
udp       Out 189.20.108.XX:3233                            140.242.250.200:3263                               SINGLE:NO_TRAFFIC   00:07:51  00:00:29       95     9120
udp       In  192.168.40.251:3235                           140.242.250.200:3265                           NO_TRAFFIC:SINGLE       00:07:51  00:00:29       95     7220
udp       Out 189.20.108.XX:3235                            140.242.250.200:3265                               SINGLE:NO_TRAFFIC   00:07:51  00:00:29       95     7220
udp       In  192.168.40.251:3237                           140.242.250.200:3267                           NO_TRAFFIC:SINGLE       00:07:51  00:00:29       95     7240
udp       Out 189.20.108.XX:3237                            140.242.250.200:3267                               SINGLE:NO_TRAFFIC   00:07:51  00:00:29       95     7240

          Best regards,
          Wesley Santos

          1 Reply Last reply Reply Quote 0
          • stephenw10S
            stephenw10 Netgate Administrator
            last edited by

            That's not necessarily an error but you would expect more traffic when it connects correctly.

            I would bet it's sending it's internal private IP still we've seen that many many times. Including numerous times when a VoIP provider told us it definitely wasn't and we had to prove it was using packet captures.

            We would need to see the SIP packets to be sure.

            PM them to me if you prefer. I'll take a look when I have time.

            Steve

            W 1 Reply Last reply Reply Quote 0
            • W
              wesleylc1 Rebel Alliance @stephenw10
              last edited by

              can i send you a .pcap packet capture for you to help analyze?

              1 Reply Last reply Reply Quote 0
              • stephenw10S
                stephenw10 Netgate Administrator
                last edited by

                Yes, start a chat and attach it there.

                W 1 Reply Last reply Reply Quote 0
                • W
                  wesleylc1 Rebel Alliance @stephenw10
                  last edited by

                  not allowed, your chat is restricted to people you follow only

                  1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate
                    last edited by

                    Post whatever it is you think is telling you that. If that is the case it should not be. People chat me all the time without following.

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    W 1 Reply Last reply Reply Quote 0
                    • W
                      wesleylc1 Rebel Alliance @Derelict
                      last edited by

                      ERROR
                      This user has restricted their chat messages. They must follow you before you can talk to them

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by

                        Hmm, must have changed the default at a forum update or something. I've changed that setting now, try again.

                        Steve

                        W 1 Reply Last reply Reply Quote 0
                        • W
                          wesleylc1 Rebel Alliance @stephenw10
                          last edited by

                          Your chat is now released.

                          1 Reply Last reply Reply Quote 0
                          • W
                            wesleylc1 Rebel Alliance
                            last edited by

                            Dear, I made the capture available on Google Drive

                            1 Reply Last reply Reply Quote 0
                            • stephenw10S
                              stephenw10 Netgate Administrator
                              last edited by

                              Great I have that.

                              There are no SIP packets in there so I can't check that directly but it looks like it's still sending it's internal IP as the address to connect back to which can never work. For example:

                              Selection_677.png

                              And:

                              Selection_678.png

                              I won't to be any sort of expert in those protocols but from your description of the behaviour and the fact we see only outgoing RTP traffic in the pcap I think it is not configured to send the external IP.

                              You need to set that correctly in the Polycom device before it can work behind NAT.

                              Steve

                              1 Reply Last reply Reply Quote 0
                              • W
                                wesleylc1 Rebel Alliance
                                last edited by

                                Hi, thanks for your effort to help solve my case.
                                Please can you explain if I used the filter correctly, I intended to monitor only LAN-ip traffic, using a filter for polycom IP address "192.168.40.251", when NAT requests occur, they should be caught in tcpdump using the command filter below?

                                tcpdump -nvxi re0 -w capture.pcap host 192.168.40.251

                                I captured packets from the WAN-ip interface, using a filter for WAN-ip and LAN-ip addresses, but when analyzing wireshark did not find NAT requests, I will forward the link of this packet in your chat.
                                I used the command below.

                                tcpdump -nvxi sk1 -w new.pcap "(host 189.20.108.XX or host 192.168.40.251)"

                                Best regards,
                                Wesley Santos

                                1 Reply Last reply Reply Quote 0
                                • DerelictD
                                  Derelict LAYER 8 Netgate
                                  last edited by Derelict

                                  It has nothing to do with the filter.

                                  The PBX is telling the far side to connect back to 192.168.40.251 on port 3230 for RTP.

                                  Obviously the far side cannot do that because that is your inside, non-routable, RFC1918 address.

                                  You need to tell the PBX to send your outside WAN address there instead.

                                  It is embedded in the SIP protocol. NAT can't translate it and there is no SIP ALG in pfSense to do it for you either.

                                  Chattanooga, Tennessee, USA
                                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                  1 Reply Last reply Reply Quote 0
                                  • W
                                    wesleylc1 Rebel Alliance
                                    last edited by wesleylc1

                                    Hey man, how you doing?
                                    I reviewed all NAT settings applied to "Polycom VSX 7000", also restored the applied settings and configured them again. I can not understand what I am configuring wrong with NAT inside the pfsense firewall, the polycom NAT settings are very simple, below are some pictures of the polycom NAT settings.

                                    LAN properties.
                                    Captura de tela de 2019-08-15 17-18-34.png

                                    Polycom NAT Settings.
                                    Captura de tela de 2019-08-15 17-18-12.png

                                    Captura de tela de 2019-08-15 17-17-06.png
                                    Best regards,
                                    Wesley Santos

                                    1 Reply Last reply Reply Quote 0
                                    • DerelictD
                                      Derelict LAYER 8 Netgate
                                      last edited by

                                      Sorry. I don't read Portuguese.

                                      Chattanooga, Tennessee, USA
                                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                      W 1 Reply Last reply Reply Quote 0
                                      • DerelictD
                                        Derelict LAYER 8 Netgate
                                        last edited by

                                        https://community.polycom.com/t5/Video-Endpoints/VSX-7000-Connection-Issue/td-p/36896

                                        Chattanooga, Tennessee, USA
                                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                        W 1 Reply Last reply Reply Quote 0
                                        • W
                                          wesleylc1 Rebel Alliance @Derelict
                                          last edited by

                                          Sorry, I replaced the images using English.

                                          1 Reply Last reply Reply Quote 0
                                          • W
                                            wesleylc1 Rebel Alliance @Derelict
                                            last edited by

                                            Hello, I have this same problem reported by this person.
                                            I performed all the steps and was only able to connect with the other end by clearing the "NAT is H.323 compliant" check box, but only audio is transmitted between both ends, when I leave this option selected, I can't connect audio / video.

                                            1565900638171-captura-de-tela-de-2019-08-15-17-18-12.png

                                            In fact, I have come to the conclusion that my firewall is blocking requests on the H323 protocol, do you suggest some maneuver to free all traffic coming under the H323 protocol?

                                            Best regards,
                                            Wesley Santos

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.