Watchguard Firebox X15 User Manual page 161

About the H.323 proxy
If you use Voice-over-IP (VoIP) in your organization, you can add an H.323 or SIP (Session Initiation Protocol)
proxy policy to open the ports necessary to enable VoIP through your Firebox. These proxy policies have been
created to work in a NAT environment to maintain security for privately addressed conferencing equipment
behind the Firebox.
H.323 is used commonly on older videoconferencing equipment and voice installations. SIP is a newer
standard that is more common in hosted environments, where only endpoint devices such as telephones are
hosted at your business location and a VoIP provider manages the connectivity. You can use both H.323 and
SIP proxy policies at the same time, if necessary. To determine which proxy policy you need to add, consult the
documentation for your VoIP devices or applications.
It is important to understand that you usually implement VoIP by using either:
Peer-to-peer connections
In a peer-to-peer connection, each of the two devices knows the IP address of the other device and
connect to each other directly.
Hosted connections
Connections hosted by a call management system (PBX)
With H.323, the key component of call management is known as the GateKeeper. We do not support H.323
connections hosted by call management systems at this time. In this release, the H.323 proxy supports only
peer-to-peer connections.
Coordinating the many components of a VoIP installation can be difficult. We recommend you make sure that
VoIP connections work successfully before you try to use the system with the Firebox proxy policies. This can
help you to troubleshoot any problems.
Some manufacturers use the TFTP protocol to send periodic updates to the VoIP equipment under
management. If your equipment requires TFTP for updates, make sure you add a TFTP policy to your
Firebox configuration to allow these connections.
When you enable an H.323 proxy policy, your Firebox:
Automatically responds to VoIP applications and opens the appropriate ports
Makes sure that VoIP connections use standard H.323 protocols
Generates log messages for auditing purposes
To enable the H.323 proxy, see
Edit the HTTP proxy.
User Guide
Enable a proxy. Then, if you choose, edit the proxy definition as described in
Proxy Settings
149