We are having a problem setting an Asterisk on Ubuntu machine via Juniper SSG.
The VOIP machine is using Ubuntu & Asterisk & FreePBX. It is connected to DMZ on the Juniper SSG.
There are other machines connected to the SSG's DMZ port. Currently we have only 1 public IP address (say 1.1.1.1). The DMZ itself is setup internally as 53.0.0.0. Therefore, we're using the VIP function of SSG. The other machines is working okay using this setup, taking up port 80.
On the non-technical background, we're working with 2 vendors on this setup. The VOIP vendor and the firewall vendor.
The problem is that the VOIP vendor wants port 22 to be available online so he can setup the system online and also confirm that the other ports needed by asterisk is available online. He had success connecting to the machine via VPN, so he claimed that the firewall guy has not setup the VIP correctly to allow him access port 22 on the Ubuntu-VOIP machine.
On the other hand, the network guy has already opened ports to other machines using the same setup. These machines are accessible online by typing http://1.1.1.1/setup.html on a remote browser. So it is unlikely that he messed up the setup to the ubuntu machine. And so naturally, he's claiming the voip guy must have done something wrong on the voip machine.
Naturally, I'm stuck in between the two vendors. Neither of them seems to know how to find out if the ports' actually been opened. The voip guy claimed the ports on his machines are open since it is accessible via vpn. The network guy claimed the ports on ssg are open since its' the exact same setup as the other machines.
What do I do? In between these two, I've spend thousands of dollars and about 9 months of development and deployment times. We're not a big company (obviously) and havent got an internal IT staff. So whatever these two says, I try to work with. If I ditch this project, we wont have enough budget to buy a 'proper' VOIP solution that is built in to our PBX. Not that that wont come with problems...
Thanks in advance for your help.
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Thanks for your reply Deimark.
The VOIP guy did ask us to try port 2222 also, in suspicion that the SSG is also using port 22. Is this along the same line/solution with your suggestion?
Anyhow, the Network guy did try free-ing port 2222 but it didnt work either.
Is there anyways I can check (perhaps via logs) if the machine or SSG is passing the data for this port (22 or 2222)?
What to try here is is follow the KB article here for creating a VIP.
http://kb.juniper.net/KB47
Your firewall guy already knows some of this as you already have a working VIP but this may help a bit more as well.
Under step 8 I would enter the following info:
Virtual IP <whatever you already have, ie 1.1.1.1>
Virtual port 2222
Map to service SSH (port 22)
Map to IP <ip of VoIP server>
This will do the same as the VIP you have for port 80 (by the way, I would not use port 80 if you can avoid it, create a self signed cert and use SSL, its more secure)
The firewall will accept connections to is VIP on port 2222 and then forward on those packets to the VoIP server on port 22 and thus resolving the issues.
Your firewall guy should know that he can search through the logs as and when they occur, but you need to make sure that the rules you are trying to log on, do actually have "log" enabled. Simple thing, but it can be overlooked on occasion.
ALso, running a "debug flow basic" on the firewall, with appropriate flow filters could show where teh packets were going, but the set up of a VIP above would be my 1st port of call though.
HTH
Can't actually test this anytime soon (would have to wait 2-3 weeks before we can try this as were overwhelmed with other work right now. But Thanks very much for your input. I remember you from when we started building our firewall. If we stumble into problem, i'll post again. I hope I get your attention again then.
Deimark,
Can I ask a question I missed before?
The map to service part was actually a custom map created by my network guy. So instead of just port 2222, he also has port 5060 and some other ports needed by the VOIP guy. (This was created under Policy>Services>Custom)
But when he added this service to the "map to service" field, I saw that the "Virtual Port" field immidiately changes to 5060 (which is the service name: VOIP (5060)).
Do you think this is the problem? Should he have created different services for each VIP port?
Another strange part is that the VOIP guy wanted port 10000 to 20000 for VOIP, but in SSG we're supposed to specify UDP or TCP. So we specify for both.
Do you think this is the problem? Should he have created different services for each VIP port?
VoIP 5060 is the common port as used by SIP. Normally, its UDP but can be sent over TCP bud. At the mo, as long as port 5060 is forwarded to the asterisk box, then it doesnt really matter what its called.
What you may have here is that there is al;ready a service for 5060 and you created a new one. The duplication is untidy, but as long as 5060 is forwarded,its all good.
Another strange part is that the VOIP guy wanted port 10000 to 20000 for VOIP, but in SSG we're supposed to specify UDP or TCP. So we specify for both.
I assume that the ports above are for the RTP (ie the media of the call, the voice traffic).
If yes, then as long as the SIP ALG is enabled, this should just "work" as the ALG will dynamically open and close RTP ports depending on the call set up etc as part of the SIP request. ie only calls that the asterisk box has arranged (or know about) will be allowed in. This is preferred.
However, if you wanna make 100% sure,then you can simply create a new service with a range of ports on UDP (RTP is normally over UDP) and then allow the packets in, but this is NOT recommended, as you will effectively leave a huge gaping hole in your firewall for all sorts of UDP traffic on those ports to come in. As well as you won't be able to use a VIP for it
I would double check the SIP ALG to make sure its on at Security > ALG > Basic, as this should be all that you need.
HTH
Actually, I meant: Is it going to be a problem if we set a custom service to open the following ports at the same time (i.e, being defined in one screen). Say: My-VOIP to open UDP 10000-20000, TCP 10000-20000 and TCP 5060 and TCP 2222.
This was what my network guy did.
Or should we have set, instead:
My-VOIP-1: TCP 2222 (for the SSH)
My-VOIP-2: TCP5060 (for the VOIP)
My-VOIP-3: TCP10000-20000 (also for VOIP. I guess as you said above, the RTP stuff?)
Then we go to VIP and set a SEPARATE VIP for each of these instead of just My-VOIP with all the services in one bundle? (The part that I dont understand with doing it as one bundle is that the VIP port automatically becomes 5060. what happened to the other ports we've specified?)
Also, this is the second time I came across "ALG" when trying to find a fix. The first time around, My network guy says it shouldnt be a problem. He hasnt got time to try it yet, and I'm too afraid to change the setting by myself. We'll definetely try this one too.
Actually, I meant: Is it going to be a problem if we set a custom service to open the following ports at the same time (i.e, being defined in one screen). Say: My-VOIP to open UDP 10000-20000, TCP 10000-20000 and TCP 5060 and TCP 2222.
This was what my network guy did.
Or should we have set, instead:
My-VOIP-1: TCP 2222 (for the SSH)
My-VOIP-2: TCP5060 (for the VOIP)
My-VOIP-3: TCP10000-20000 (also for VOIP. I guess as you said above, the RTP stuff?)
Then we go to VIP and set a SEPARATE VIP for each of these instead of just My-VOIP with all the services in one bundle? (The part that I dont understand with doing it as one bundle is that the VIP port automatically becomes 5060. what happened to the other ports we've specified?)
Also, this is the second time I came across "ALG" when trying to find a fix. The first time around, My network guy says it shouldnt be a problem. He hasnt got time to try it yet, and I'm too afraid to change the setting by myself. We'll definetely try this one too.
Hiya
I understood that from the info above, you have only 1 public IP, ie 1.1.1.1, so this is what you created as the VIP?
Of course if you had more IPs then feel free to allocate them here, however I will naswer your queries inline here:
My-VOIP-1: TCP 2222 (for the SSH)
Technically, this is not needed, as within the VIP setting, you are just adding in a port. To allow or deny the traffic, then a security rule with the destination of the VIP is needed to allow or deny the access, same as the current HTTP rule for the port 80 VIP
My-VOIP-2: TCP5060 (for the VOIP)
As above, if a service on 5060 is already there, then you dont need a new service. Normally SIP on 5060 uses UDP, its worth confirming if your asterisk box uses UDP or TCP (it can be changed)
My-VOIP-3: TCP10000-20000 (also for VOIP. I guess as you said above, the RTP stuff?)
Yup, this can be created as you say, however, take note the security implications as above. If you leave all these ports wide open, then you can get burned, its much more secure to leave it to the SIP ALG to deal with it
This will leave you with 1 VIP configured, with multiple services, all forwarded to the relevant hosts etc. This is normal, however, if you do have extra IP addresses, then perhaps a full MIP, ie mapped IP (1 to 1 static natting) will do this better for you. ie all traffic to 1.1.1.2 (the 2nd IP) can be mapped to your asterisk box with the associated services allowed through.
Ah, I see. Okay then I think I kinda know which direction we need to take.
Right now we do only have 1 Public IP, but it was mostly because my network guy thought the ssg can only be used with 1 public IP. (I was actually given 5 by the ISP, but we had to cancel the other 4 in order to get the SSG to work).
He seemed to have found a way to incorporate the other 4 also, so might be a good idea for me to use a second one strictly for VOIP, as you say.
Great. Thanks Deimark.
Business Accounts
Answer for Membership
by: deimarkPosted on 2009-05-30 at 10:14:15ID: 24509653
If its the port 22 thats causing the problem, then create a VIP service for something different, ie port 222 and map that to 22 on the internal host.
So the guy will need to make sure his SSH client is talking over 222.
Port 22 is a port used for on box SSH access and unless you change this local port for SSH access or the port that the customer uses, you will get conflicts here and the SSH will fail.