I2004 dropping connection with BCM over a VPN

[spen2]

Hi,

I have set up an I2004 phone at home to connect to my a BCM 400 at work via a VPN. I have set up an IPSEC tunnel(using DES with Authentication) from my Draytek 2900 router at home to a Checkpoint firewall at work. The phone connects to the BCM and works fine as long as I keep a call active just after the connection is established. However, if I leave it for a couple of minutes without a call active and then try and make/receive a call I cant hear the caller, but the caller can hear me. If I then hang up, the phone will restart itself and looks for the BCM and a connection is then re established again. I have tried a different I2004 phone and I get the same problem.

Any help with this problem would be much appreciated.

Many Thanks

Spencer

 

[endlesswinter]

what do you have for internet access? DSL, cable,satalite?

 

[spen2]

Hi Endlesswinter,

At home I have NTL cable 2MB. Work currently has a 256k BT lease line.

 

[MagnaRGP]

You need to upgrade your Checkpoint FW. The version you have rebuilds its NAT tables after about 3 minutes of no traffic and when it does it changes the Port tables. The traffic will get lost until the phone watchdog times out and restarts the phone, thus causing a new build and correct mapping for about 3 minutes.

I'm not aware of any other way to fix this.

 

[spen2]

Hi Magna,

Can you or anyone recommend a firewall that will works well with voip, particularly my set up. We will be upgrading ours soon.

Thanks

Spencer

 

[MagnaRGP]

Nortel's VPN Router Portfolio (formerly Contivity) works very well as does the Cisco PIX portfolio.

It is really up to you which features and pricing works for your needs.

At my office, we use an old Contivity with no issues.

 

[ansellrk]

Checkpoint R60 NGX fixes this problem. We are having exactly the same issue with Nokia IP40's & Checkpoint R55. The problem is caused by the Checkpoint FastPath technology which doesn't handle VOIP traffic properly. BTW can you tell me what configuration you use for the Draytek, I have tried to get my 2800VG working as a site to site with Checkpoint and have failed... I think I am missing something obvious! One end of my tunnel is not right, not sure which!

Thanks, Rob

 

[spen2]

Hi Rob,

Thanks for the info. Regarding your problem setting up the Draytek router, I found a useful guide on the draytek site with setup instructions. It is for the draytek 2200 but works with my 2900.

http://www.draytek.com/support/support_note/router/application/vpn_solution/3/g.php

Hope this helps.

Spencer