VoIP through NAT/PAT

[wattie29]

Does anyone know if H.323 voip is supported through NAT/PAT. I have done a sniffer trace and I can see the NAT convert the IP header but not the H.225. Any advice.

It does seem to work through the firewall using dynamic NAT. Any ideas?

 

[wybnormal]

I know that SIP is not supported by NAT without some work and thats because of the RTP UDP stream that carries the compressed voice(or other media). H.323 has issues because of the large numbers of ports it uses that are dynamically assigned.

An excellent paper on H.323 and firewalls can be found at:

http://www.vtel.com/Support/galaxy/H323_Proxies_Firewalls.htm

The real question is are you refering to NAT (network address translation) or PAT (port address translation) there are subtle but very important differences between the two and how it impacts VoIP.

Mike S

http://www.packetattack.com

http://www.packetpress.net

Home of the book "Network Security Using Linux"

 

[wattie29]

Thanks mate, I will have a look at that.

I believe the VoIp that is working is using NAT as it is configured with the 'nat' and 'global' commands, wheras the one that is not is using static(outside,intf2) I believe this is PAT.

As you can see I'm not much of a wiz on these firewalls, hope that makes sense.

Cheers for the help so far.

 

[wybnormal]

The PAT will give you absolute fits

NAT and PAT are not your friends for VoIP but at least with NAT you can use something like STUN to get around it. THink Skype THey use a form of STUN to work around NAT issues. There is also a cool toy called "NAT Check Program" at:

http://midcom-p2p.sourceforge.net/

Which can help in deciding if NAT is giving you problems. I have a short blurb on it in an upcoming Skype book from Syngress that I worked on.

MikeS

http://www.packetattack.com

http://www.packetpress.net

Home of the book "Network Security Using Linux"

 

[mynus]

PAT is actually noted by Cisco's release notes not to function at all with VOIP. Using common sense it's kinda obvious anyway, but NAT should work just fine, as the outgoing/incoming streams for H.23X should be masq'd and forwarded, not port translated.