IPIPGW and PIX firewall

Question

I am trying to make an IPIPGW accessible through a PIX 6.3(5) firewall. The H.323 ras and H225 fixups are enabled, but connections to the IPIPGW are not established; the firewall generates an error "call proceeding before setup". The workaround appears to be to disable both fixups and open >1024 ports, which is less than ideal. What generates the "call proceeding before setup" and can it be worked around on the IPIPGW; I've tried both slow- and fast-start connections.

Answer 1

Hi,
this is really an odd issue. The Q.931 sequence of call setup is:
A SETUP --> B
(optionally B can reply with "SETUP->ACK", or if it is an overlapped number, but this does not count for H.323)
B CALL PROCEEDING / PROGRESS / ALERT --> A
B CONNECT --> A
It is very basic, but in general that is the procedure. Cisco says that a SETUP message has arrived after the CALL PROCEEDING one, which is incorrect. An H.323 (H225) debug would bring some light to the issue.
We have a network of Cisco voice gateways, Call managers, thirf party gatekeepers and gateways, calling each other through a Cisco 6.4 PIX and it works (however we had some nasty troubles with path mtu discovery).