IPIPGW and PIX firewall

[mmelbourne]

I am trying to make an IPIPGW accessible through a PIX 6.3(5) firewall. The H.323 ras and H225 fixups are enabled, but connections to the IPIPGW are not established; the firewall generates an error "call proceeding before setup". The workaround appears to be to disable both fixups and open >1024 ports, which is less than ideal. What generates the "call proceeding before setup" and can it be worked around on the IPIPGW; I've tried both slow- and fast-start connections.

[teodorgeorgiev]

Hi,

this is really an odd issue. The Q.931 sequence of call setup is:

A SETUP --> B

(optionally B can reply with "SETUP->ACK", or if it is an overlapped number, but this does not count for H.323)

B CALL PROCEEDING / PROGRESS / ALERT --> A

B CONNECT --> A

It is very basic, but in general that is the procedure. Cisco says that a SETUP message has arrived after the CALL PROCEEDING one, which is incorrect. An H.323 (H225) debug would bring some light to the issue.

We have a network of Cisco voice gateways, Call managers, thirf party gatekeepers and gateways, calling each other through a Cisco 6.4 PIX and it works (however we had some nasty troubles with path mtu discovery).

[kkelly]

I get the same problem using Polycom Gear. Did it ever get resolved ? Did 7.x Pix code solve anything?

I have a PIX 501 here at home and cannot get h.323 through it period.

[kelvin.blair]

Do a no fixup on h323 and ras..I missed that you've already don that.. Sorry.. :)