Firewall and ip telephony

[Fons]

Hi,

every time clients behind the pfsense-firewall are having a conversation using the ip-telephone on their desk the conversation is broken after 15 minutes.

the firewall is on the latest version. we have our own voip-central wich handles all calls. the voip-central connects to a sip-trunk thru the firewall.

neither me, our supplier or the manufacturer can find any setting on the telephones, the voip-central or on the providers end that could cause the sip-connection to break after 15 minutes (or any amount of time)

so I have two questions regarding the firewall:

• could it be that some rule or setting could cause this connection break? and how to find this?
• is it possible that states are broken after a certain amount of time and not been being build up again in time? and how to set this?

(well actually four questions)

I hope someone can help us out on this.

regards, Fons

[Stewart]

@Fons:

Hi,

every time clients behind the pfsense-firewall are having a conversation using the ip-telephone on their desk the conversation is broken after 15 minutes.

the firewall is on the latest version. we have our own voip-central wich handles all calls. the voip-central connects to a sip-trunk thru the firewall.

neither me, our supplier or the manufacturer can find any setting on the telephones, the voip-central or on the providers end that could cause the sip-connection to break after 15 minutes (or any amount of time)

so I have two questions regarding the firewall:

• could it be that some rule or setting could cause this connection break? and how to find this?
• is it possible that states are broken after a certain amount of time and not been being build up again in time? and how to set this?

(well actually four questions)

I hope someone can help us out on this.

regards, Fons

SIP has a reinvite interval of 15 minutes.  It's likely that the reinvite is being NATted and the port is being changed.  Do a capture on the LAN side of the router, wait the 15 mintues until the call drops, and view it in Wireshark.  When you inspect the call you'll see the ports next to the RTP in the chart.  See if they change after the 15 minute mark.  Then do the same thing on the WAN side and look for the same thing.  If the ports change on the LAN side but not the WAN then the router is doing something.  I've never seen a router do it, though, of any make.