H323 Video Conferencing

[philroughton]

Hello, does anybody know how to setup H323 Video Conferencing through a CheckPoint firewall NG? We have a Gatekeeper and Gateway within our private network and they look after a number of endpoints, but we need to communicate with the outside world on the Internet. What configuration needs to be done on the firewall - hosts, address translation etc...

Thank you,

Phil.

 

[rn4it]

Well, basically, you'll need to know what ports your Video conferrencing application uses and if their uni or bi-directional. Also, you'll need to understand how the video conferencing will need to work. In order to tell you how to configure it we would need to know more specific information. It sound like you'll need to set up your security and NAT rules to be appropriate to what you're attempting to do. Sorry to be so vague.

 

[martinp05]

hello,

@rn4it: basicaly you are right, but

the checkpoint "understands" voiceoverip (h323), so you do not need to enable traffic in both directions. the firewall will do this dynamically.
if h323-traffic is started in both directons, you are right.

the only thing you have to know is the general h323 traffic between the devices...

maybe this can help:

https://secureknowledge.checkpoint....esaurus>+ip,+<thesaurus>+voip))&resultStart=1

martin

----------------------------------
Martin Peinsipp, Austria
CCSA,
IT-Security-Administrator

 

[rn4it]

In our implementation of VoIP, we needed 2way Security and NAT rules. This is a little different from what is being asked. We used the same article when we did our IP Trunking, connecting 2 PBXs together. There were a number of ports that are needed outside of the H323, based on the PBX manufacture.

 

[philroughton]

Thanks for all your help - because I have no control over the external domain, I cannot create a VoIP Domain Gatekeeper for the destination - this is meant to be the Internet (any Video Conferencing device out there). We're not trying to connect 2 offices together. Is checkpoint still capable of this - I can set up a domain for the office her, but then we want to communicate using H323, to possibly any dievice in the world.

Thank you again, Phil.

 

[rn4it]

I'm sure there are other companies that are doing what you're attempting to do, but I'm not. Did you review the article that Martinp05 linked you to? while trouble shooting use your logfile, this will give you error messages that may be helpful.

You will need to allow any, to your h323 gatekeeper's NAT'd address and have the correct NAT rule and static routes. As well, you may want to have any any rule plus a second rule that allows tcp and udp high port. This would of course depend apon what ports your video conf application needs.
good luck