XBox Live on shared network where port forwarding is not an option

[ronanian]

I have a growing population of XBox users who want to use XBox Live. They are all on my network sharing a single internet-facing IP address in a standard many-to-one NAT setup.

 

The XBox tests their connectivity and gives it a rating of "Strict NAT". It recommends port numbers that I should "open". I have checked and those ports are not blocked by the firewall. The next step would be port forwarding, but obviously I could only do that for one lucky user. It also recommends enabling UPnP, but Sonicwall does not support UPnP. I doubt UPnP would work in a shared environment even if they did.

 

Research indicates that my Sonicwall NSA4500 simply will not support it no matter what I do. At best I could buy enough internet-facing IP addresses to give each of them one-to-one NAT and even then they'd only get up to a rating of "Moderate NAT".

 

Does anyone here have a similar configuration, either with a Sonicwall firewall or a different brand?

[featured_spectre]

You may need to check the ports are open in the modem as well as the router.

 

I use a SonicWall router at home (well the mrs does for work) and it is not an issue when I use her work connection.

[mattx]

Can't you forward the ports to the actual sonicwall itself thus everyone getting the beneifit ?

[featured_spectre]

The sonic wall can't handle it well.

[mattx]

The sonic wall can't handle it well.

 

Chirst, sounds like a pile of poo if it can't do that !!

[featured_spectre]

Well it can handle it, just not as well as other devices. It's literally a hardware firewall with minimal configs available.

[ronanian]

There is no "modem" as such on our T3 and our 100Mb fiber lines. They do not block any ports. The Sonicwall is the internet-facing front end with all of our IPs on it and port-forwarded to our servers as needed.

 

The Sonicwall NSA4500 is an enterprise-class hardware firewall with thousands of configuration options...if it was simple like a home router then this would probably be easier.

 

I was hoping that someone else here supplies internet access to resident students and has dealt with a similar issue. I have hundreds of students and only a few IPs so I can't use port forwarding.

[Willott]

There are mentions on a number of sites about port triggering rather than forwarding (I think it somehow does dynamic port forwarding based on port triggers). May be something to look at as it's suggested to work (on support.xbox.com for one site)

[ronanian]

Update: I was able to get my users a "Moderate NAT" rating.

 

On the Firewall > VoIP Settings page in SonicOS Standard or VoIP > Settings in SonicOS Enhanced, enable "Consistent NAT". Whatever this VoIP function is, it somehow helps with XBL's NAT rating. I found it buried in a couple Sonicwall forum threads on the issue, although it's also in this KB article:

 

https://www.fuzeqna.com/sonicwallkb/consumer/kbdetail.asp?kbid=3956

 

...of course, one gets turned off to that KB article pretty quickly when reading most of the steps which are about assigning an address to the xBox and port-forwarding to it, which doesn't work when you have dozens or hundreds of XBL users and only a few Internet-facing IP addresses. If it didn't have that stuff I might have noticed the one step about "Consistent NAT".