One X Communicator-One X Agent and Global Connect

[Ken Kumpula]

We recently switched from Citrix VPN to Global Connect for remote users. Since this has taken place, we have had users of both applications will randomly experience where they cannot answer a call. The call makes it appearance, they click on answer, however it is ignored. Eventually when the call is either redirected (RONA) or to voicemail, the application will respond with 'unable to accept call session'. Then the application will re-register and work fine for some random amount of time. When we ask the users to go back to the original VPN application, all is well again. In the Wireshark trace on a failed call there is a ARP request followed by a port 443 request from an very unexpected IP address.

 

[avayaguy23]

Firewall issue.

 

[Ken Kumpula]

@avayaguy23, Oh I 100% agree... but I cannot be the first to encounter this issue. I have the user g back to the Citrix VPN and it works fine.

 

[dialtonebone]

It's likely that your new firewall is either routing things incorrectly or inappropriately trying to understand/detect threats in the h323 protocol. What does the firewall log say when this occurs?

 

[Wanebo]

If you are on Global Protect they are using Palo Alto firewalls and they should easily be able to see the traffic between one end point and another and tell what is being blocked and what is being allowed. Have the users keep track of when the issue occurs and provide your firewall people that info in a timely matter and they should be able to pin down the issue rather quickly. It will also be helpful to them if you gather up the end users GP logs and provide them also.