PIX520 How to config for MSN Messenger voice phone call

[sepcdf]

Hi,

My company have some 30 PC working behind a pix-520 firewall.Now we want to use MSN Messenger for distant IP telephone. The problem is I can't config the firewall to let the voice come through the pix.

According to the help document of Messenger, if a firewall does not support Upnp (Universal plug and play protocol) ,the udp port (5004-65535) have to be opened.
I did it as follows , but it doesn't work.
conduit permit tcp any any h323
conduit permit udp any any gt 5003

The MSN Messenger help webpage link is:

http://www.microsoft.com/windowsxp/pro/techinfo/deployment/natfw/default.asp

Can you please give me a solution to solve it.
Thanks in advance.

sepcdf

 

[yizhar]

HI.

You will probably need a static mapping of registered ip to the workstation(s) that accept voice connections, in addition to openning ports.

However this can be an obvious security risk as well.

If applicable, I suggest placing a single workstation for that purpose in a DMZ or "dirty" DMZ that will be used for voice only.

Another option, if you are going to use VOIP only to a specific 2nd party, you can try to establish it over a VPN tunnel.

I don't have experience with VOIP so see also what other have to say.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[sepcdf]

Dear Mr.Yizhar Hurwitz:

Thank you for your reply. I will try your suggestion.

Best wishes

sepcdf

 

[bkcarter333]

Make sure that you are not using PAT in your Global statements. Each time a PC makes a call, it needs to be able to reserve it's own valid IP address from a Global pool. You can issue the Global command to set up the pool, and then issue a second one to allow PAT to take over if there are too many connection requests. They actually call it (PAT) "overloading" in the Cisco lingo. Look on Cisco's site for "overload" and "VOIP" or "H323" and there are some good examples.

Bryan

 

[jv1]

My issue is somewhat the opposite: How to block MS, AOL, YAHOO instant messenger on the pix?

Thankx

 

[N0ktar]

To block AOL and ICQ close port 5190, unfortunatelly other IM software is "smarter" meaning it searches for open ports, be it 80 or 53 (granted you filter outgoing traffic with access-lists)and than adapts to use it. Solution? Compile a list of IP addresses with servers IM clients initatially log into, than just deny outside access to those ip addresses.