Vonage and Netscreen 5xp

Posts: 4 · New Forum Member Joined: Jun 26, 2004 Posts: 4

Is anyone else using a Netscreen 5XP?

Here is the settings that I've come up with so far. I did them in the GUI, but this is what they translate to:

set service "Vonage - Voip" group "other" udp src 0-65535 dst 5060-5061
set service "Vonage - Voip" + udp src 0-65535 dst 10000-20000

I’m not sure if I need this one as it seems to only address 5060, but it did help (10.202.2.102 is the IP address of the Moto box - can't seem to log into it no matter what I try)

set interface untrust vip untrust 5060 "Vonage - Voip" 10.202.2.102
set address "Trust" "Vonage Phone" 10.202.2.102 255.255.255.0

Added traffic shaping so that it gets priority

set policy id 12 name "Vonage Phone" from "Untrust" to "Trust" "Any" "VIP::1" "Vonage - Voip" Permit traffic gbw 0 priority 0

Posts: 1 · New Forum Member Joined: Nov 30, 2004 Posts: 1

I have the same configuration and am getting UDP floods from Vonage RTP servers that kill my conversations. I attempted the procedure above and the issue is still occuring. I think the issue I am having is that either the VIP is not allowing traffic due to the virtual port or NAT translation on the destination port on inbound traffic.

Are you positive traffic is being passed inbound via your VIP setup as indicated?

Any advice?

Niknak

Posts: 62 · Posted: Sun Feb 06, 2005 9:05 pm Post subject: Solution To Netscreen 5 Issues

I have the same configuration also, NS-5XP - Screen OS 5.1.0r3.0.

I was also having issues wit the RTP sessions getting out of sync, (person on one end of the phone could hear, but other party couldn't - you needed to hit the flash button to toggle to the call waiting line, then flash back to original line then conversation would work again).
I was also getting email alerts from the NS device regarding the UDP floods. I had assigned a static IP to the Pap2 device, created a custom service for the ports the Vonage uses, and prioritized the traffic to highest priority on both the trusted and untrusted, and set the policy application to Ignore on both the trusted and untrusted, still no luck.
The thing that appears to have cleared up the issue was turning off the UDP Flood protection on all the interfaces, I may have not had to do all interfaces, but I was searching for a solution since the issue had been elevated to 3rd tier support at Juniper.
Hope this helps....

Posts: 62

Below Are The Line From The NetScreen That Relate To Vonage:

set service "Vonage Internet Phone" protocol udp src-port 0-65535 dst-port 5060-5061 timeout 30
set service "Vonage Internet Phone" + udp src-port 0-65535 dst-port 53-53
set service "Vonage Internet Phone" + udp src-port 0-65535 dst-port 69-69
set service "Vonage Internet Phone" + udp src-port 0-65535 dst-port 10000-20000

set interface untrust vip untrust 5060 "Vonage Internet Phone" xxx.xxx.x.x manual

set address "Trust" "Home-IP-Phone" 192.168.1.5 255.255.255.255 "Troy's Home IP Phone"

set policy id 967126 from "Trust" to "Untrust" "Home-IP-Phone" "Any" "Vonage Internet Phone" permit traffic gbw 100 priority 0 mbw 260
set policy id 967126 application "IGNORE"

set policy id 967127 from "Untrust" to "Trust" "Any" "VIP(untrust)" "Vonage Internet Phone" permit traffic gbw 100 priority 0 mbw 260
set policy id 967127 application "IGNORE"

Posts: 5 · New Forum Member Joined: Apr 16, 2005 Posts: 5

Hello,

I don’t know if you could help me or not. I have been trying to get my phone to work and I think I have totally jacked up my Netscreen. I can no longer access the internet but services like MSN Messenger work. I know you can load a configuration file into the Netscreen. I’m on Screen OS 3.0 something. Would it be possible to have someone send me a copy of there configuration file. I think this might be the easiest why to get back up and running.

Thank you

Posts: 2 · New Forum Member Joined: Mar 10, 2006 Posts: 2

rozy wrote:

I have the same configuration also, NS-5XP - Screen OS 5.1.0r3.0.

I was also having issues wit the RTP sessions getting out of sync, (person on one end of the phone could hear, but other party couldn't - you needed to hit the flash button to toggle to the call waiting line, then flash back to original line then conversation would work again).
I was also getting email alerts from the NS device regarding the UDP floods. I had assigned a static IP to the Pap2 device, created a custom service for the ports the Vonage uses, and prioritized the traffic to highest priority on both the trusted and untrusted, and set the policy application to Ignore on both the trusted and untrusted, still no luck.
The thing that appears to have cleared up the issue was turning off the UDP Flood protection on all the interfaces, I may have not had to do all interfaces, but I was searching for a solution since the issue had been elevated to 3rd tier support at Juniper.
Hope this helps....

Can UDP Flood Protection be configured from the 5xp interface?
Thanks

Never mind, figured this out. Needed to upgrade the ScreenOS to 5.x

Posts: 2 · New Forum Member Joined: Mar 10, 2006 Posts: 2

So I configured my 5xp as suggested by rozy. The router supplied by Vonage is a Linksys RTP300. I assigned a static IP to the router. For some reason, the VIP status for the untrusted interface for the Vonage service (port 5060) is listed as "Down". Can anyone tell me why this is? Although I can make calls, when there's any load on my network, the outbound voice quality is terrible so the traffic shaping does not seem to be working. I'm about to drop Vonage. Any help or suggestions would be greatly appreciated.

Thanks!

Here's the pertinent config settings:

set service "Vonage Internet Phone" protocol udp src-port 0-65535 dst-port 5060-5061
set service "Vonage Internet Phone" + udp src-port 0-65535 dst-port 53-53
set service "Vonage Internet Phone" + udp src-port 0-65535 dst-port 69-69
set service "Vonage Internet Phone" + udp src-port 0-65535 dst-port 10000-20000
set service "Vonage Internet Phone" + udp src-port 0-65535 dst-port 123-123
set service "Vonage Internet Phone" timeout 30

set interface untrust vip untrust 5060 "Vonage Internet Phone" 10.251.131.221

set interface trust dhcp server ip 10.251.131.221 mac xxxx xxxx xxxx

set address "Trust" "Home-IP-Phone" 10.251.131.221 255.255.255.0

set policy id 14 from "Trust" to "Untrust" "Home-IP-Phone" "Any" "Vonage Internet Phone" permit traffic gbw 100 priority 0 mbw 260
set policy id 14 application "IGNORE"

set policy id 15 from "Untrust" to "Trust" "Any" "VIP::1" "Vonage Internet Phone" permit traffic gbw 100 priority 0 mbw 260
set policy id 15 application "IGNORE"