Important Information about Creating H.323 Security Rules

Best practice - Configure anti-spoofing on the Check Point gateway interfaces.

• To allow H.323 traffic, create rules that let H.323 control signals through the gateway.

  It is not necessary to Configure a rule that specifies which port to open and which endpoint can talk. The gateway automatically gets this information from the signaling. For a given H.323 signaling rule (with RAS and/or H.323 services), the gateway automatically opens ports for the H.245 connections and RTP/RTCP media stream connections.

• Dynamic ports will only be opened if the port is not used by a different service. This prevents well-known ports from being used illegally.

  For example, if the Connect message identifies port 80 as the H.245 port, the port will not be opened.

• To allow H.323 traffic in the Security Rule Base, use regular Network Objects. It is not necessary to Configure special Network Objects.
• When you use Hide NAT for H.323, include the hidden IP address in the destination of the H.323 rule. When you include the hidden IP address, this allows the initiation of the TCP handshake from the external network to the hidden IP.
• Make sure to check Keep all connections or the firewall drops your connection every time you Install Policy.
  1. Double-click your gateway.

     The Check Point Security Gateway window shows.

  2. From General Properties > Other > Connection Persistence > Keep all connections > OK.

     Note - Rematch connections is selected by default.

Note – The old policy rules are still intact for calls already in-progress and they will not be dropped.

Sample H.323 Rules for an Endpoint-to-Endpoint Topology

The IP Phones communicate directly, without a Gatekeeper or an H.323 gateway. Static NAT can be configured for the phones on the internal side of the gateway.

An endpoint-to-endpoint topology is shown in the image, with Net_A and Net_B on opposite sides of the gateway. This procedure explains:

• How to allow bidirectional calls between the phones in the internal network (Net_A) and phones in an external network (Net_B)
• How to Configure NAT for the internal phones

  No incoming calls can be made when Hide NAT is configured for the internal phones.

VoIP rule for this scenario:

Source	Destination	Services & Applications	Action
Net_A Net_B	Net_B Net_A	H323	Accept

To Configure an H.323 rule for endpoint-to-endpoint topology:

1. Configure an Access Control rule that allows IP phones in Net_A or Net_B to call each other.
2. Select the applicable service.
3. Configure the VoIP rule.
4. Configure Hide NAT or Static NAT for the phones in the internal network.
5. Do this by editing the Network Object for the internal network (Net_A). See Setting up your network for Network Address Translation.
6. Install Policy.

Sample H.323 Rules for a Gatekeeper-to-Gatekeeper (or H.323 Gateway) Topology

Each Gatekeeper or H.323 gateway controls a separate endpoint domain. Static NAT can be configured for the Internal Gatekeeper. For the internal phones, Hide NAT or Static NAT can be configured.

The illustration shows a Gatekeeper-to-Gatekeeper or Gateway topology, with Net_A and Net_B on opposite sides of the gateway. This procedure shows you how to:

• Allow bidirectional calls between phones in the internal network (Net_A), and phones in an external network (Net_B)
• Define NAT for the internal phones and the internal gateway (GW_A) or Gatekeeper (GK_A).

VoIP Access Control rule for this scenario

Source	Destination	Service	Action	Comment
GK_A GK_B GW_A GW_B	GK_B GK_A GW_B GW_A	H323 H323_ras	Accept	Bidirectional calls

To define an H.323 rule for Gatekeeper-to-Gatekeeper topology:

1. Define an Access Control rule that allows IP phones in Net_A to call Net_B and the reverse.
2. Define the Network Objects for the gateway objects (GW_A and GW_B)

   OR

3. Define the Network Object for the Gatekeeper objects (GK_A and GK_B).
4. Define the VoIP rule.
5. Configure Static NAT for the Internal Gatekeeper.
6. Define Hide NAT or Static NAT for the phones in the internal network. Do this by editing the Network Object for the internal network (Net_A). See Setting up your network for Network Address Translation.
7. Install Policy.

Sample H.323 Rules for a Gatekeeper (or H.323 Gateway) in an External Network

The IP phones use the services of a Gatekeeper or H.323 gateway on the external side of the gateway. This topology enables the use of the services of a Gatekeeper or an H.323 gateway that is maintained by another organization. It is possible to configure Hide NAT or Static NAT (or No-NAT) for the phones on the internal side of the gateway.

The image shows an H.323 topology with a Gateway, with Net_A and Net_B on opposite sides of the gateway. This procedure shows you how to:

• Allow bidirectional calls between the phones in the internal network (Net_A) and phones in an external network (Net_B)
• Configure NAT for the internal phones

VoIP Access Control rule for this scenario:

Source	Destination	Services & Applications	Action	Comment
Net_A Net_B GK_B	GK_B Net_A	H323_ras H323	Accept	Bidirectional calls.

To configure an H.323 rule for a Gatekeeper in the external network:

1. Configure the Network Objects. In the image, these are Net_A and Net_B.
2. Configure the Network Object for the Gatekeeper (GK_B) or GW_B gateway.
3. Configure the VoIP rule.
4. Configure Hide NAT or Static NAT for the phones in the internal network. Do this by editing the Network Object for the internal network (Net_A). See Setting up your network for Network Address Translation.
5. Install Policy.

Sample H.323 Rules for a Gatekeeper (or H.323 Gateway) in DMZ Network

The same Gatekeeper or H.323 gateway controls both endpoint domains. This topology makes it possible to provide Gatekeeper or H.323 Gateway services to other organizations. Static NAT or no NAT can be configured for the Gatekeeper or H.323 gateway. Hide NAT, Static NAT, or No-NAT can be configured for the phones on the internal side of the gateway.

The image shows an H.323-based VoIP topology where a Gatekeeper or Gateway is installed in the DMZ. This procedure explains how to:

• Allow bidirectional calls between the phones in the internal network (Net_A) and phones in an external network (Net_B)
• Configure NAT for the internal phones and the Gatekeeper in the DMZ (GK_DMZ)

VoIP Access Control rule for this scenario:

Source	Destination	Services & Applications	Action	Comments
GK_DMZ GW_DMZ Net_A Net_B	Net_A Net_B GK_DMZ GW_DMZ	H323 H323_ras	Accept	Bidirectional calls.

Static NAT rules for the Gatekeeper in the DMZ:

Original			Translated			Comments
Source	Destination	Services & Applications	Source	Destination	Services & Applications
GK_DMZ	Net_B	*Any	GK_DMZ: Static	=	=	Outgoing calls
Net_B	GK_DMZ_NATed	*Any	=	GK_DMZ: Static	=	Incoming calls

To Configure an H.323 rule for a Gatekeeper in the DMZ:

1. Configure the Network Objects. In the image, these are Net_A and Net_B.
2. Configure the Network Object for the Gatekeeper (GK_B) or GW_B gateway.
3. Configure the VoIP rule.
4. Configure Hide NAT or Static NAT for the phones in the internal network. Do this by editing the Network Object for the internal network (Net_A). See Setting up your network for Network Address Translation.
5. Install Policy.