• Service: H323
• Source Interface: lan
• Destination Interface: any
• Source Network: lannet
• Destination Network: 0.0.0.0/0 (all-nets)
• Comment: Allow outgoing calls
3. Click OK
Incoming Rules:
1. Go to Rules > IP Rules > Add > IPRule
2. Now enter:
• Name: H323In
• Action: SAT
• Service: H323
• Source Interface: any
• Destination Interface: core
• Source Network: 0.0.0.0/0 (all-nets)
• Destination Network: wan_ip (external IP of the firewall)
• Comment: Allow incoming calls to H.323 phone at ip-phone
3. For SAT enter Translate Destination IP Address: To New IP Address: ip-phone (IP address of phone)
4. Click OK
1. Go to Rules > IP Rules > Add > IPRule
2. Now enter:
• Name: H323In
• Action: Allow
• Service: H323
• Source Interface: any
• Destination Interface: core
• Source Network: 0.0.0.0/0 (all-nets)
• Destination Network: wan_ip (external IP of the firewall)
• Comment: Allow incoming calls to H.323 phone at ip-phone
3. Click OK
To place a call to the phone behind the NetDefend Firewall, place a call to the external IP address on
the firewall. If multiple H.323 phones are placed behind the firewall, one SAT rule has to be
configured for each phone. This means that multiple external addresses have to be used. However, it
is preferable to use an H.323 gatekeeper as this only requires one external address.
Example 6.8. H.323 with Gatekeeper
6.2.9. The H.323 ALG Chapter 6. Security Mechanisms
245
To Next Page
