Firewall NAT Requirement for HP Anyware (PCoIP)

This guide covers one firewall setting that has to be right at every editorial site: the firewall must translate the source port on outbound HP Anyware traffic rather than preserving it. Use it when setting up a new site, when adding a second editor to an existing site, or when a session connects normally but video and audio playback is poor.

The requirement

The firewall at each editorial site must allow outbound connections from editing workstations to use normal address translation, where the firewall assigns its own source port to each connection. It must not be configured to preserve or fix the workstation's original source port.

This is the default behavior on essentially every firewall. In most cases nothing needs to be changed, and meeting this requirement means confirming that port preservation has not been turned on. It is an option an administrator has to deliberately enable, usually to make some other application work, and it is occasionally left on afterward.

Why it matters

HP Anyware editing sessions all use the same fixed port number on the workstation. When the firewall preserves that port instead of assigning a new one, two editors at the same site end up competing for the same translation entry. The connection out to the editing host still works, so the session appears to connect normally, but the video and audio coming back to the editor is partly lost or delivered to the wrong machine. The result is a session that connects fine and then performs badly, which is difficult to diagnose because the problem looks like a network fault rather than a configuration choice.

The effect is only visible when more than one editor works through the same site connection at the same time, which is why it can go unnoticed for a while and then appear suddenly as a site grows.

How to confirm it

With two editors connected at the same time, the firewall's connection table should show two different port numbers on the outside of the translation, not the same number twice. If it shows the same number for both, port preservation is enabled and must be turned off.

Technical detail

Outbound NAT applied to any subnet containing HP Anyware / PCoIP clients must use dynamic many-to-one NAT with source port translation (PAT) enabled, where the firewall may assign an external source port different from the client's. Static, fixed, or preserved source-port NAT must not be configured for these subnets, and the firewall must remap the port on collision.

PCoIP clients bind a fixed local UDP source port (commonly 50002) and send to UDP 4172. Where two or more clients egress through the same public address with source-port preservation and no collision fallback, their external 4-tuples collide. Because UDP is connectionless the session cannot re-pin, so inbound host-to-client datagrams are dropped or delivered to the wrong internal host, producing one-directional receive loss while the outbound path appears healthy.

Typical setting names by platform

Verify the exact keyword against the running firmware version, as vendors rename these between major releases.

Acceptance criteria

1. On the firewall serving the client subnet, show the active outbound NAT rule and confirm the port-translation mode above.
2. With two PCoIP clients connected simultaneously through the same public address, the NAT session table shows two distinct external source ports, not 50002 twice.
3. During a sustained session, PCoIP client logs show download (RX) loss under 0.1% with no VGMAC : Failed to authenticate packet entries.

Related firewall requirements

• Endpoint-independent mapping. The NAT mapping for UDP 4172 must be endpoint-independent, meaning a consistent external port for the life of the flow. Symmetric mapping that re-keys mid-session must not be used.
• UDP session timeout. The UDP idle timeout for port 4172 must survive idle periods in an interactive session: 60 seconds minimum, 300 seconds recommended, so the inbound mapping is not torn down during low-activity editing.
• Consistent egress path. PCoIP sessions must not be load-balanced per-packet or per-flow across multiple public addresses or WAN links. All datagrams of a session must egress the same public address.
• No payload modification. No deep packet inspection, UDP proxying, or payload rewriting may be applied to UDP 4172. PCoIP authenticates every packet, so any modification causes the client to discard it as corrupt.

For the ports and addresses that must be allowed in the first place, see Cloud-Enabled Edit Bay Requirements.

When to contact support

If the self-service steps above don't resolve your issue, reach out to the team that handles your type of request:

ProdTech: post-support@amazonstudios.com

ProdTech manages Studio in the Cloud, including initial user onboarding, new account creation, and provisioning access to storage, workspaces, cloud workstations, applications, and tools, plus the setup, performance, and technical issues covered in this guide.

TechOps (TOPS): support@amazonstudios.com

TechOps manages your Originals Access account, and will assist you with issues around Okta sign-in/SSO problems, password resets, MFA/2FA resets (including a new phone), and account lockouts.

TechOps also handles requests for access to specific applications (such as Box, Flow Capture, or Aspera on Cloud).

When contacting us, help us resolve your issue quickly by always including:

• Your full name and account email (@originalsaccess.com).
• A clear description of the problem and the exact error message you see (a screenshot helps).
• Your show code and show name
• The show/workspace, workstation, or application involved.
• When the problem started and what you've already tried.

Please open a new request for each separate issue rather than replying to an older, resolved one, so it reaches the right team.