H.460 Nat Firewall Traversal - Polycom HDX Series Administrator's Manual

Administrator's Guide for Polycom HDX Systems
2 - 14
Visit the Polycom Security section of the Knowledge Base at
timely security information. Systems deployed outside a firewall are potentially
vulnerable to unauthorized access. You can also register to receive periodic email
updates and advisories.

H.460 NAT Firewall Traversal

You can configure Polycom HDX systems to use standards-based H.460.18
and H.460.19 firewall traversal, which allows video systems to more easily
establish IP connections across firewalls.
The following illustration shows how a service provider might provide H.460
firewall traversal between two enterprise locations. In this example the V
traversal server gateway is on the edge of the service provider network and
facilitates IP calls between Polycom HDX systems behind different firewalls.
2
V IU Server Gateway
that Supports H.460.18
and H.460.19
Enterprise Location A
System with
Traversal Enabled
To use this traversal, Polycom HDX systems and firewalls must be configured
as follows:
• Enable firewall traversal on the Polycom HDX system.
• Register the Polycom HDX system to an external V
Gateway that supports the H.460.18 and H.460.19 standards.
• Make sure that firewalls being traversed allow Polycom HDX systems
behind them to open outbound TCP and UDP connections.
— Firewalls with a stricter rule set should allow Polycom HDX systems
to open at least the following outbound TCP and UDP ports: 1720
(TCP), 14085-15084 (TCP) and 1719(UDP), 16386-25386 (UDP).
— Firewalls should permit inbound traffic to TCP and UDP ports that
have been opened earlier in the outbound direction.
• For best interoperability, make sure that H.323 protocol-aware features are
disabled on firewalls being traversed.
Service Provider
IP Network
www.polycom.com for
2
IU™
Gatekeeper
Enterprise Location B
System with
Traversal Enabled
2
IU Traversal Server