CISCO AS5300 - H323 PORT 1720 PROBLEM 1

[aliggee]

I've started to route h323 calls from my cisco as5300 on port 1720, things worked fine.....

now 1720 has been closed at the remote end, is there any way i can change the port number on the cisco as5300?

any other ideas/

Appreciate the help.

Alistair.

 

[rtfmdude]

Alistair,

port 1720 is h323 - you can't change the listen port afaik - well, perhaps you can do some protocol translation and make an additional listen port that ties to 1720.

As far as being 'closed' on the remote end - I'm guessing you're doing voip in a country that doesn't allow it?

It happens. The easiest way to get around this is to just create a GRE tunnel between the devices and run your calls through that. I've done the EXACT same thing when a buddies' ISP did that to him.

 

[aliggee]

what's a gre tunnel please?

 

[rtfmdude]

a gre tunnel is a virtual point to point interface, just like an vpn connection. gre(alone) does nothing for security, however.

though this doc primarily addresses multicast over gre, you should be able to get the idea:

http://www.cisco.com/en/US/tech/tk828/technologies_configuration_example09186a00801a5aa2.shtml

 

[aliggee]

cheers for the pointer, really appreicate it.

still not sure how to implement it on my as5300.

thanks

 

[rtfmdude]

aliggee,

basically, imagine this:
(unfiltered situation)
[router1]1.1.1.1---internet---2.2.2.2[router2]

everything is fine, your dial peers are pointing at 1.1.1.1, and 2.2.2.2. Then, someone starts filtering 1720, so, we overlay a private tunnel ON TOP of the public internet:

[router1]1.1.1.1---internet---2.2.2.2[router2]
(adding a private tunnel, just like a serial connection)
[router1]3.3.3.1---internet---3.3.3.2[router2]


you can then ping 3.3.3.1 and 3.3.3.2 from each other - it's like you created a brand new serial link on top of the public connection - a tunnel.

so, on router1, this is the config:

interface tunnel1
ip address 3.3.3.1 255.255.255.252
tunnel source 1.1.1.1
tunnel destination 2.2.2.2

on router2, it's the reverse:

int tunnel1
ip address 3.3.3.2 255.255.255.252
tunnel source 2.2.2.2
tunnel destination 1.1.1.1

Try that. Note: this is not encrypted at all.

 

[aliggee]

thanks very much for the assistance, you are very decent.

the challenge i've got is - the far end is not cisco, it's a gsm gateway that does run a voip interface... but only a really basic one.

someone told me that you can change the outgoing port number for all h.323 calls?
Is this true?

This solution would be perfect for us as i could set all gateways to accept calls on the specified port.

thank you.

 

[aliggee]

does anyone know how to:
change the port number (default is 1720) for all calls on a cisco as5300 router?

 

[rtfmdude]

I don't know off the top of my head - sorry! I suppose you could try to NAT it somehow, but I have a feeling that the traffic generated by the router is not subject to NAT(it's own nat process).

 

[aliggee]

what about if i bought some sort of pix firewall....
do you think that could do it?

 

[rtfmdude]

Yes, I think that's well within the realm of the PIX - here's a doc on how to handle VoIP with a PIX:

http://www.cisco.com/en/US/products...s_configuration_example09186a00801fc74a.shtml

but that's in a 'normal' deployment environment. might honestly be easier to get a pix on BOTH sides, and create an ipsec tunnel between them, or do the gre thing with any ol' IOS box.