Teleworker - One way audio

[Cabarrus]

I copied and pasted this from the thread below. We use a Pix 515e and im not sure how to allow this:

"Allow Inside penetration by the inside sets to the TW's P-R address."

I assume this means allow our phone subnet in our inside network to go out to the internet and connect to the public IP of the teleworker server?

thanks

thread1329-1383134

Yes, this is much better. Now we use the box in Server-Only mode and it lives on the DMZ. We control both the Outside/DMZ access and the DMZ/Inside access through our industrial firewall (a Cisco ASA). Now I feel I can sleep at night.

Sure enough we had one-way audio for a while, but we got it straightened out. The trick is that there must be a path for Inside IP phones (called streaming devices in the docs) to talk to the TW server on the DMZ (of course) by its PUBLIC-ROUTABLE (P-R) address (rather than by its actual address).

So:
Allow Outside penetration by the remote sets to the TW's P-R address.
Static nat between the P-R and the actual address on the DMZ.
Allow Inside penetration by the inside sets to the TW's P-R address.
Static nat between the P-R and the actual address on the DMZ.

The statics are weird because they must be static (inside,outside) ... and static (inside,dmz) ... instead of the normal static (dmz,inside) ... but it works like a champ.

Thanks for everyone's help.

 

[kwbMitel]

Are you putting the horse before the cart?

What is your setup?

Server and Gateway or Standalone in DMZ?


*******************************************************
Occam's Razor - All things being equal, the simplest solution is the right one.

 

[Cabarrus]

Standalone in DMZ

thanks

 

[Cabarrus]

Page 14 in the MBG Engineering Guidelines mentions this:

The LAN rule can be omitted if there are no IP sets on the LAN, but ensure that
the ICP(s) can communicate with the server's public address.

Which seconds what the poster i quoted mentioned.

thanks

 

[kwbMitel]

Just wanted to make sure you were on the right path. Some users go out of there way to confuse matters.

You appear to be where you need to be, unfortunately, DMZ programming is not my skill.

Good luck

*******************************************************
Occam's Razor - All things being equal, the simplest solution is the right one.

 

[Cabarrus]

We had:
static (DMZ,outside) externalip internalip netmask 255.255.255.255


but no:
static (DMZ,inside) externalip internalip netmask 255.255.255.255

its working now.. thanks!

 

[Cabarrus]

When outside caller calls in, and we want to forward them to one of our teleworker phones, and the call gets released there is no audio between the outside call and the teleworker call.

Not sure if we overlooked something?

thanks