> Source: [sk113749](https://support.checkpoint.com/results/sk/sk113749) # sk113749 - H.323 VoIP call drops after exactly one hour because Keep Alive "ACK" packets are not forwarded to the VoIP client | Property | Value | |----------|-------| | Solution ID | sk113749 | | Date Created | 2016-10-06 | | Last Modified | 2026-01-13 | | Technical Level | General | | Products | Security Gateway, Scalable Platforms | | Versions | R82, R81.20, R82, R81.20 | ## Symptoms - * H.323 VoIP call drops after exactly one hour. * H.323 Keep Alive "ACK" packets are not being forwarded to the VoIP client. ## Cause H.323 Keep Alive packets sent (sent every two minutes) from the localhost to the remote host are being intercepted by the Security Gateway and are not being forwarded to the remote host. Instead of forwarding these H.323 Keep Alive packets, the Security Gateway is incorrectly responding to the local host, as if it were the remote host. ## Solution This problem was fixed. The fix is included in: * [Check Point R80.10](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk111841) * [Jumbo Hotfix Accumulator for R77.30](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk106162) - since *Take_210* * [60000 / 40000 Appliances - Jumbo Hotfix Accumulator for R76SP.50](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk117633)*-*since Take 72 Check Point recommends to always upgrade to the most recent version ([Security Gateway](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=435)). For **other [supported](http://www.checkpoint.com/support-services/support-life-cycle-policy/index.html) versions** , [Check Point Support](http://www.checkpoint.com/support-services/contact-support/index.html) can supply a **Hotfix** . A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix. For faster resolution and verification, please collect [CPInfo files](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92739) from the Security Management Server and Security Gateways involved in the case. ### Code was improved: * Security Gateway will send automatic TCP Keep Alive ACK packets every 5 minutes in both directions of H.323 (CPAS) connection. * Security Gateway will set the keep alive timer for the H.323 connection for either Client side, or Server side. * The new behavior is controlled on the Security Gateway by the following kernel parameters: |---|---------------------------------|-------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | # | Kernel Parameter | Value | Security Gateway's Behavior | | 1 | `cpas_enable_tcp_keepintvl` | 1 | Enables automatic TCP Keep Alive probes - every 5 minutes, Security Gateway will automatically send TCP Keep Alive packets (in both directions of H.323 connection) that are designed to force a response if the peer is up and reachable: * either an ACK if the connection is still alive * or an RST if the peer has closed the connection due to timeout or reboot | | 1 | `cpas_enable_tcp_keepintvl` | 0 (default) | Disables automatic TCP Keep Alive probes - Security Gateway will *not* send automatic TCP Keep Alive packets | | 2 | `h323_tcp_always_keepalive_fix` | 1 | Sets the keep alive timer for the H.323 connection | | 2 | `h323_tcp_always_keepalive_fix` | 0 (default) | Does *not* set the keep alive timer for the H.323 connection | ### Hotfix installation instructions: 1. Hotfix has to be installed on ***Security Gateway / each cluster member***. **Note:** In cluster environment, this procedure must be performed on *all* members of the cluster. 2. Procedure: * Using CPUSE - On Security Gateway / Cluster Member running Gaia OS R75.40 and above: Make sure to install the [latest build of the CPUSE Agent](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#Latest build of CPUSE and What's New). Refer to [sk92449: CPUSE - Gaia Software Updates (including Gaia Software Updates Agent)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How to work with CPUSE): * Section "[(4-A-c)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How to work with CPUSE - How to download and import a CPUSE package - Import instructions for Offline procedure - Gaia Portal)" / "[(4-A-d)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How to work with CPUSE - How to download and import a CPUSE package - Import instructions for Offline procedure - Gaia Clish)" - refer to import instructions for *Offline procedure* * Section "[(4-B-a)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How to work with CPUSE - How to install a CPUSE package - Installing a Hotfix package / Minor Version package)" - refer to installation instructions for *Hotfixes* You can also use the [sk111158 - Central Deployment Tool (CDT)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk111158) to install this hotfix on Security Gateways. **Note:** Reboot is required. * Using Legacy CLI - On VSX Gateway / VSX Cluster Member running Gaia OS R75.40VS and above; On Security Gateway / Cluster Member running SecurePlatform/XOS/IPSO OS: Note: On these versions of VSX, the Gaia CPUSE does not support installation of hotfixes (refer to [sk92449](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#System requirements and limitations) - section "(2)" - "VSX Gateways"). 1. Transfer the hotfix package to the machine (into some directory, e.g., */some_path_to_fix/*). 2. Unpack and install the hotfix package: ***\[Expert@HostName\]# cd /some_path_to_fix/*** ***\[Expert@HostName\]# tar -zxvf fw1_wrapper_\.tgz*** ***\[Expert@HostName\]# ./fw1_wrapper_\*** **Note:** The script will stop all of Check Point services (*cpstop*) - read the output on the screen. 3. Reboot the machine. ### Hotfix configuration instructions: Permanently set the values of the required kernel parameters *tcp_always_keepalive* and *h323_tcp_always_keepalive_fix* to 1 (one). Follow [sk26202 - Changing the kernel global parameters for Check Point Security Gateway](http://supportcontent.checkpoint.com/solutions?id=sk26202). > For Gaia / SecurePlatform OS: > > 1. Create the *$FWDIR/boot/modules/fwkern.conf* file (if it does not already exit): > > ***\[Expert@HostName\]# touch $FWDIR/boot/modules/fwkern.conf*** > 2. Edit the *$FWDIR/boot/modules/fwkern.conf* file in Vi editor: > > ***\[Expert@HostName\]# vi $FWDIR/boot/modules/fwkern.conf*** > 3. Add the following line (spaces and comments are not allowed): > > ***tcp_always_keepalive=1*** > ***h323_tcp_always_keepalive_fix=1*** ***cpas_enable_tcp_keepintvl=1*** > 4. Save the changes and exit from Vi editor. > > 5. Check the contents of the *$FWDIR/boot/modules/fwkern.conf* file: > > ***\[Expert@HostName\]# cat $FWDIR/boot/modules/fwkern.conf*** > 6. Reboot the Security Gateway. > > 7. Verify that the new value was set: > > > ***\[Expert@HostName\]# fw ctl get int tcp_always_keepalive*** > > ***\[Expert@HostName\]# fw ctl get int h323_tcp_always_keepalive_fix*** > > ***\[Expert@hostname\]: #fw ctl get int cpas_enable_tcp_keepintvl*** > **Note:** To disable the new behavior on the Security Gateway, either remove these kernel parameters from the *$FWDIR/boot/modules/fwkern.conf* file, or set their values to 0 (zero). Then reboot. ### Workaround: If you do not wish to install the hotfix, then as an immediate workaround, you can follow these steps: **Important Note:** This workaround is NOT recommended because it lowers the security of the H.323 connections. 1. Connect with SmartDashboard to the Security Management Server / Domain Management Server that manages the relevant Security Gateway. 2. Locate the relevant security rule that allows the relevant H.323 connections. 3. Right-click on the H.323 service used in this rule - select ***Edit...***. 4. In the ***TCP Service Properties*** window, click on the ***Advanced...*** button. 5. In the ***Protocol Type*** field, select ***None***. Note: Selecting a Protocol Type invokes the specific protocol INSPECT handlers for each protocol type, thus enabling higher level of security by parsing the protocol, and higher level of connectivity by tracking dynamic actions (such as opening of ports). 6. Click on OK. 7. Install the security policy. ### Related solutions: * [sk95369 - ATRG: VoIP](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk95369) --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content