How do I setup Video Streaming in the checkpoint firewall 1

[honu222]

Hi,
Iam trying to setup Video streaming on the Checkpoint firewall. I went out to the Checkpoint support group but all it came back with was that I needed to add a new protocol. I added protocol 103, but my packets are still being dropped when it passes thru the firewall. Does anyone have any successful experience with this?

Please help.

Thank you

 

[rn4it]

What exactly are you trying to do? Do you have specific IP's that you're streaming to/from? Try this setup Smartview Tracker to montior the IP's of you're internal devices and the other side of the streaming connection, see what ports are being dropped if they make sense add them to your rule. We're doing IP Trunking between 2 PBXs, for VoIP application. We needed to add TCP and UDP highports on top of H323.

 

[honu222]

thank you for your response. Unfortunately multicast doesn't really flow thru the firewall tracker, otherwise that would have been a simple thing to see. Within the firewall the video streaming works fine. Its when the traffic goes thru the firewall packets are lost. I'm using HTTP service to connect to the Video streaming server. When I access video streaming within the firewall I can see the video just fine. When I access on the otherside of the firewall it says connecting but then only returns ready down on the left hand corner with a blank screen.

 

[rn4it]

We have an external company that does our video streams. On our websever which links to their video steam server, however it uses rtsp. From the firewall try the following cmd "'fw monitor -e "accept ( dst = <ip of vid svr>);" -o videocap.txt" without quotes. The take the file and open it into a sniffer app ie. Ethereal. This will show all ports it uses.
good luck

 

[honu222]

I need to add a new protocol service to our rules.
would anyone happen to know the protocol value for CGMP. (IGMP is 2.)

 

[rn4it]

From what I've read on Cisco's website, it seems it may use the same protocol value as IGMP. I haven't found any articles to support or deny this. good luck