Firewall ports issue (H323. interconnection)

[Guilherme1000]

Hello all,

I have a interconnection between three sites over a H.323 trunk.

we have a firewall and this is causing several communications issues.

I have been looking for ports to enable on the firewall 'cause everytime the IT manager monitors the traffic, a new port has to be open.
then I've come across the H.323 ports problem, 'cause there is a large range of dynamic ports (1024-65535) wich may causes security issues if open.

I know somehow we can use NAT to provide additional security, but Im not sure how does it works.

How can I use it to solve my problem?

 

[amriddle01]

Do not use NAT....that will just stop H323 working completely. You need to open the ports if you want to use voice across the link, isn't each site secure in it's own right? IT men always overreact when it comes to opening ports on internal links, in reality if they are on the internal network having some open ports on those links is the least of your worries



"No problem monkey socks

 

[Guilherme1000]

then I have no choice but to open that doors?

 

[Guilherme1000]

that range of ports?

 

[amriddle01]

Yes, but the dynamic RTP port range is like 49152 - 53246, not from 1024 so some 48,128 ports fewer than you thought



"No problem monkey socks

 

[Guilherme1000]

do you know any specific documentation that contains the exactly range of ports?

 

[amriddle01]

Here is an extract from the installation manual, even shows the traffic direction



"No problem monkey socks

 

[IPGuru]

just a sanity check
you are using a VPN between sites correct?
don't try a direct connection on public IP Addresses it would be a major security risk.

if it is a vpn then there is no point in blocking ports

A Maintenance contract is essential, not a Luxury.
Do things on the cheap & it will cost you dear

 

[Guilherme1000]

yes, it's a VPN

 

[amriddle01]

We know that, but some people who should know better just don't



"No problem monkey socks

 

[MikeSide]

Look if you have H323 ALG on your router to, you need to unchek it if you are ...