Page 144
VoIP gateway IP400 version 5.01
In connection with voice over IP, both functions require a detailed analysis of the
data stream in order to be implemented. This must be performed by your firewall
or router firmware. Please refer to the documentation of the product you are
using.
There are four ways of proceeding, if the product you are using does not have
“H.323 firewalling”:
• You configure the firewall so that it allows
all
required data to and from the
gateway.
Although this solution is usually not well received by system administrators, it
does not present a security problem, since the gateway, as a dedicated
device, does not perform any services other than “voice over IP”. No security
gaps are caused in your network by opening the path to and from the gate-
way.
• The number of ports to be released can be restricted if the H.323 devices
whose data is to cross the firewall are all innovaphone devices. For this, how-
ever, the
Disable H.245 Tunnelling
box must not be checked, in the gate-
way definitions for any equipment (see Section 6.1.4 “H.323 protocol
options” from page 73).
The following ports have to be released in both directions:
The number of ports to be released cannot be restricted if the gateway has to
communicate with third party products. It is thus necessary to release all
ports to and from the gateway.
• Tcp: destination port
80
(http), any source port (for configuration)
• Tcp: Destination port
1720
(h.225), any source port (for VoIP calls).
We recommend releasing ports
1721
,
1722
,
1723
, etc.. The number
of ports to be released results from the number of connections and the
administrator should do this, as required.
• Udp: destination port >=
2050
, source port
5004
and
5005
(RTP)
(for VoIP calls)
Tip
If the RAS protocol is not used, QSIG tunnelling is no longer possible. In a
scenario for example, where two locations with PBXs are linked, this can lead
to performance limitations, as no additional features can be transmitted.
