Supported H.323 Deployments and NAT

Supported H.323 deployments are listed the Table. NAT ,Hide or Static, can be configured for the phones in the internal network, and (where applicable) for the Gatekeeper.

NAT is not supported on IP addresses behind an external Check Point gateway interface

Manual NAT rules are only supported in environments where the Gatekeeper is in the DMZ

Service	No NAT	NAT for Internal Phones — Hide/Static NAT	NAT for Gatekeeper — Static NAT
Endpoint to Endpoint	Yes	Static NAT only	Not applicable
Gatekeeper/Gateway in External	Yes	Yes	Not applicable
Gatekeeper/Gateway to Gatekeeper/Gateway	Yes	Yes	Yes
Gatekeeper/Gateway in DMZ	Yes	Yes	Yes


Endpoint-to-Endpoint Communication	The IP Phones communicate directly, without a Gatekeeper or an H.323 gateway. Static NAT can be configured for the phones on the internal side of the gateway.
Gatekeeper or H.323 Gateway in External Network	The IP phones use the services of a Gatekeeper or H.323 gateway on the external side of the gateway. This topology enables the use of the services of a Gatekeeper or an H.323 gateway that is maintained by another organization. It is possible to configure Hide NAT or Static NAT (or no NAT) for the phones on the internal side of the gateway.
H.323 Gatekeeper/Gateway to Gatekeeper/Gateway	Each Gatekeeper or H.323 gateway controls a separate endpoint domain. Static NAT can be configured for the internal Gatekeeper. For the internal phones, Hide NAT or Static NAT can be configured.
Gatekeeper or H.323 Gateway in the DMZ	The same Gatekeeper or H.323 gateway controls both endpoint domains. This topology makes it possible to provide Gatekeeper or H.323 gateway services to other organizations. Static NAT or no NAT can be configured for the Gatekeeper or H.323 gateway. Hide NAT or Static (or no NAT) can be configured for the phones on the internal side of the gateway.