H.323-Based VoIP

Introduction to H.323

H.323 is an ITU (International Telecommunication Union) standard that specifies the components, protocols, and procedures that provide multimedia communication services over packet networks (including IP based networks).

The Security Gateway supports these H.323 architectural elements:

• IP phones

  Devices that:

  • Handle signaling (H.323 commands)
  • Connect to an H.323 gatekeeper

  IP Phones are defined in SmartDashboard, usually as a network of IP Phones. Usually it is not necessary to define Network objects for individual IP Phones.

• Standard telephones that connect to an H.323 gateway

  These are not IP devices. It is not necessary to define them in SmartDashboard

• A Gatekeeper that manages a collection of H.323 devices, such as phones

  Gatekeepers convert phone numbers to IP addresses. A Gatekeeper usually provides gateway services as well.

• A Gateway that provides interoperability between different networks

  The gateway translates between the telephony protocol and IP.

Supported H.323 Deployments and NAT Support

Supported H.323 deployments are listed the Table. NAT (Hide or Static) can be configured for the phones in the internal network, and (where applicable) for the Gatekeeper.

• NAT is not supported on IP addresses behind an external Check Point gateway interface
• Manual NAT rules are only supported in environments where the gatekeeper is in the DMZ

H.323 Security Rule Base Configuration

This section explains how to configure rules that allow H.323 calls through the gateway.

H.323 Specific Services

These predefined H.323 services are available:

TCP:H323

UDP:H323_ras

UDP:H323_ras_only

TCP:H323_any

General Guidelines for H.323 Security Rule Configuration

• It is recommended to configure anti-spoofing on the Check Point gateway interfaces.
• To allow H.323 traffic, create rules let H.323 control signals through the gateway.

  It is not necessary to define a rule that specifies which ports to open and which endpoints can talk. The gateway derives this information from the signaling. For a given H.323 signaling rule (with RAS and/or H.323 services), the gateway automatically opens ports for the H.245 connections and RTP/RTCP media stream connections.

  Dynamic ports will only be opened if the port is not used by a different service. For example: if the Connect message identifies port 80 as the H.245 port, the port will not be opened. This prevents well-known ports from being used illegally.

• To allow H.323 traffic in the Security Rule Base, use regular Network objects. It is not necessary to define special Network objects.
• When using Hide NAT for H.323, include the hiding IP address in the destination of the H.323 rule. This allows the initiation of a TCP handshake from the external network to the hiding IP.

H.323 Rule for an Endpoint-to-Endpoint Topology

An endpoint-to-endpoint topology is shown in the figure, with Net_A and Net_B on opposite sides of the gateway. This procedure explains:

• How to allow bidirectional calls between the phones in the internal network (Net_A) and phones in an external network (Net_B)
• How to define NAT for the internal phones

  No incoming calls can be made when Hide NAT is configured for the internal phones.

To define an H.323 rule for endpoint-to-endpoint topology:

1. Configure this rule:

1. Define Hide NAT (or Static NAT) for the phones in the internal network.

   Do this by editing the network object for the internal network (Net_A):

   1. In the NAT tab, select Add Automatic Address Translation Rules
   2. Select the Translation method (Hide or Static)

   If you define Hide NAT, add a Node object (with the Hide NAT IP address) to the Destination of the rule(s) defined in step 1.

2. Install the security policy.

H.323 Rules for a Gatekeeper-to-Gatekeeper Topology

A Gatekeeper-to-Gatekeeper topology is shown in the figure, with Net_A and Net_B on opposite sides of the gateway.

This procedure explains how to:

• Allow bidirectional calls between the phones in the internal network (Net_A) and phones in an external network (Net_B)
• Define NAT for the internal phones and the internal Gatekeeper (GK_A)

To define an H.323 rule for gatekeeper-to-gatekeeper topology:

1. Define the network objects (Nodes or Networks) for
   • Phones that use the Gatekeeper for registration
   • Allowed to make calls and their calls tracked by the gateway.

   In the figure, these are Net_A and Net_B.

2. Define the Network object for the Gatekeeper objects (GK_A and GK_B)
3. Define this rule in the rule base:

1. Define Hide NAT (or Static NAT) for phones in the internal network.

   Do this by editing the network object for the internal network (Net_A):

   1. On the NAT tab, select Add Automatic Address Translation Rules
   2. Select the Translation method (Hide or Static).
2. To define Static NAT for the Gatekeeper or Gateway in the internal network: do step 4 again.
3. Make the time-out of the H323_ras service equal to or greater than the Gatekeeper registration time-out.

   Configure the time-outs in the Advanced Properties window of the Service object.

4. Install the security policy.

H.323 Rules for a Gateway-to-Gateway Topology

The figure shows a Gateway-to-Gateway topology, with Net_A and Net_B on opposite sides of the gateway.

This procedure explains how to:

• Allow bidirectional calls between phones in the internal network (Net_A), and phones in an external network (Net_B)
• Define NAT for the internal phones and the internal gateway (GW_A).

To define an H.323 rule for gateway-to-gateway topology:

1. Define the network objects (Nodes or Networks) for phones that are allowed to make calls and their calls tracked by the gateway.

   For this example, these are Net_A and Net_B.

2. Define the network object for the gateway objects (GW_A and GW_B)
3. Define this rule in the rule base:

1. Define Hide NAT (or Static NAT) for the phones in the internal network.

   Do this by editing the network object for the internal network (Net_A):

   1. On the NAT tab, select Add Automatic Address Translation Rules
   2. Select the Translation method (Hide or Static).
2. To define Static NAT for the Gatekeeper/Gateway in the internal network, do step 4 again for the Gatekeeper/Gateway object (GK_A).
3. Install the security policy.

H.323 Rules for a Gatekeeper in the External Network

This figure shows a H.323 topology with a Gatekeeper in the Internet, with Net_A and Net_B on opposite sides of the gateway.

This procedure explains how to:

• Allow bidirectional calls between the phones in the internal network (Net_A) and phones in an external network (Net_B)
• Define NAT for the internal phones

To define an H.323 rule for a gatekeeper in the external network:

1. Define the network objects (Nodes or Networks) for the phones that:
   • Use the Gatekeeper for registration
   • Are allowed to make calls and their calls tracked by the gateway

   In the figure, these are Net_A and Net_B.

2. Define the network object for the Gatekeeper (GK_B)
3. Configure this rule in the rule base:

1. Define Hide NAT (or Static NAT) for the phones in the internal network.

   Do this by editing the network object for the internal network (Net_A):

   1. On the NAT tab, select Add Automatic Address Translation Rules
   2. Select the Translation method (Hide or Static)

      If you define Hide NAT, add a Node object (with the Hide NAT IP address) to the Destination of the rule(s) configured in step 3.

2. Make the time-out of the H323_ras service greater or equal to the Gatekeeper registration time-out. Configure the time-outs in the Advanced Properties window of the Service object.
3. Install the security policy.

H.323 Rules for a Gateway in the External Network

The figure shows an H.323 topology with a Gateway in the Internet, with Net_A and Net_B on opposite sides of the gateway.

This procedure explains how to:

• Allow bidirectional calls between phones in the internal network (Net_A) and phones in an external network (Net_B)
• Define NAT for the internal phones

To define an H.323 rule for a gateway in the external network:

1. Define network objects (Nodes or Networks) for phones that are allowed to make calls, and their calls tracked by the gateway.

   For the example, these are Net_A and Net_B.

2. Define the network object for the Gateway (GW_B)
3. Define this rule in the rule base:

1. Define Hide NAT (or Static NAT) for the phones in the internal network.

   Do this by editing the object for the internal network (Net_A):

   1. On the NAT tab, select Add Automatic Address Translation Rules,
   2. Select the Translation method (Hide or Static).

      If using Hide NAT, add a Node object (with the Hide NAT IP address) to the Destination of the rule(s) defined in step 3.

2. Install the security policy.

H.323 Rules for a Gatekeeper in DMZ Topology

The figure shows a H.323-based VoIP topology where a Gatekeeper is installed in the DMZ.

This procedure explains how to:

• Allow bidirectional calls between the phones in the internal network (Net_A) and phones in an external network (Net_B)
• Define NAT for the internal phones and the Gatekeeper in the DMZ (GK_DMZ)

To define an H.323 rule for a gatekeeper in the DMZ:

1. Define the network objects (Nodes or Networks) for the phones:
   • That use the Gatekeeper for registration
   • Are allowed to make calls and their calls tracked by the gateway

   In the figure, these are Net_A and Net_B.

2. Define the network object for the Gatekeeper (GK_DMZ).
3. Define this security rule:

1. Define Hide NAT (or Static NAT) for the phones in the internal network.

   Do this by editing the network object for Net_A:

   1. In the NAT tab, select Add Automatic Address Translation Rules
   2. Select the Translation method (Hide or Static).

      If using Hide NAT:

      (i) Select the Hide behind IP address option.

      (ii) Enter the IP address of the Hiding address of the phones in the internal network.

      (iii) Add a Node object with the Hide NAT IP address to the Destination of the rule(s) defined in step 3.

2. To define Static NAT for the Gatekeeper in the DMZ:
   • Create a Node object for the Static address of the Gatekeeper (for example: GK_DMZ_NATed).
   • Define these manual NAT rules:

• As for all manual NAT rules, configure proxy-ARPs.

  You must associate the translated IP address with the MAC address of the gateway interface that is on the same network as the translated addresses. Use the arp command in UNIX or the local.arp file in Windows.

  The command fw ctl arp displays the ARP proxy table on gateways that run on Windows. On UNIX, use the arp -a command.

1. Make the time-out of the H.323_ras service greater than or equal to the Gatekeeper registration time-out. Configure the time-outs in the Advanced Properties window of the Service object.
2. Install the security policy.

H.323 Rules for a Gateway in DMZ Topology

The figure shows a H.323-based VoIP topology where a Gateway is installed in the DMZ.

This procedure explains how to

• Allow bidirectional calls between the phones in the internal network (Net_A) and phones in an external network (Net_B)
• Define NAT for the internal phones and the Gateway in the DMZ (GW_DMZ)

To define an H.323 rule for a gateway in the DMZ:

1. Define network objects (Nodes or Networks) for phones that are allowed to make calls and their calls tracked by the gateway.

   In the figure, these are Net_A and Net_B.

2. Define the network object for the Gateway (GW_DMZ).
3. Define this rule in the rule base:

1. Define Hide NAT (or Static NAT) for the phones in the internal network.

   Do this by editing the network object for Net_A:

   1. On the NAT tab, select Add Automatic Address Translation Rules
   2. Select the Translation method (Hide or Static).

      If using Hide NAT:

      (i) Select the Hide behind IP address.

      (ii) Enter the IP address of the Hiding address of the phones in the internal network.

      (iii) Add a Node object with the Hide NAT IP address to the Destination of the rule(s) defined in step 3.

2. To define Static NAT for the Gateway in the DMZ, add manual NAT rules, as follows:
   • Create a Node object for the Static address of the Gateway (for example: GW_DMZ_NATed).
   • Define these manual NAT rules:

• As for all manual NAT rules, configure proxy-arps.

  You must associate the translated IP address with the MAC address of the Check Point Gateway interface that is on the same network as the translated addresses. Use the arp command in UNIX or the local.arp file in Windows.

  The command fw ctl arp displays the ARP proxy table on gateways that run on Windows. On UNIX, use the arp -a command.

1. Install the security policy.