Sonicwall IPS blocking Simple Help direct connection

Question

We host a remote access tool called Simple Help. It allows us to access our clients computers and assist them with problems. I can log into it from my remote workstation, and connect to a clients workstation via our server. Then upon a successfully UDP connection Simple Help will try to "upgrade" the connection and take the server out of the picture leaving you with a direct workstation-to-workstation UDP connection. This works fine on many networks. However one of our clients has a Sonicwall firewall and it appears to be blocking this last step, the "upgrade". It seems when Simple Help tries to upgrade the connection the Sonicwall Intrustion Prevention kicks in and stops it. I've tried disabling the IPS service but to no avail. I've tried disabling Gateway AV, IPS, and AntiSpyware services under the Security Services menu all at once but still no success. I've tried removing all these services from the LAN and WAN zones. I've also tried adding an IPS exception for different IPs, no success. And it always logs that IPS detected a probable or possible port scan.

Here's a link to a screen cap of the SW Log: https://skydrive.live.com/redir?resid=D7404A61BC894BC2!225

Any ideas how to make the Sonicwall leave this traffic alone?

Alternatively a SimpleHelp Tech suggested that maybe the sonicwall is just alerting about the IPS event and is not actually blocking it via IPS. He said looking into an option called "Enable Consistent NAT" may help - any thoughts here?

Answer 1

I guess I posted a bit prematurely but maybe this will help others. The "Enable Consistent NAT" option I mentioned in my question seems to have worked. Any explanations as to exactly what this option does are welcome. But my primary issue appears to be solved.

Answer 2

It sounds like what was happening was the connection was going on for long enough for the SonicWall to switch the NATed ports around and effectively kill your old session. When the connection is made it comes in on port XXXX but after a certain amount of time if there is not enough traffic (keep-alives) the connection on that port will get renegeotiated to port YYYY. the SonicWall did this so it keeps routing the traffic...but your app does not so it dies. Consistent NAT resolves this by keeping the connection open and not shifting ports.

This is a big issue if you are trying to use SIP phones with a hosted PBX outside your firewall.