3Com 3C10402B Administrator's Manual page 481

Special Issues 481
administrator specifies crossing privileges according to network needs
and policies. Control criteria consists of direction of transfer, source and
destination address, packet type, and access ports.
Firewalls affect, and are affected by, H.323 gateways. For example,
firewall processing increases packet delay while the complexity of the
H.323 protocol complicates the firewall programming.
The only way to safely avoid firewall delays is to exclude outside internet
access. This means calls can only be made within the secure intranet.
In some business applications, it is possible to eliminate the firewall delay
by setting up a dedicated physical connection between the H.323
gateway and the router. This approach, which requires a second NIC in
the ConneXtions PC system, bypasses the firewall and puts the burden of
discriminating against non-H.323 packets on the gateway. The PC system
that runs the ConneXtions software must be secure.
Systems that must conform to very conservative firewall policies can use a
Virtual Private Network (VPN) if they need to filter incoming H.323 calls
from the public Internet. An alternative is to use a firewall with H.323
proxy support.
While the operating system that runs the H.323 gateway can be
programmed to serve both as an H.323 gateway and as an IP router, such
arrangements are usually impractical because the gateway needs so
much processing power just to manage audio conversions.
3Com recommends that a high-performance PC be dedicated to the
ConneXtions software.
The question of whether an operating system is adequately "secure" is a
subject of debate. The concern is that Windows has many IP ports of its
own. One way to deal with these ports is to set up a firewall that limits
the range of externally accessible ports. However, some organizations
connect the ConneXtions gateway directly to the Internet through a
second NIC that bypasses the firewall protecting the rest of the local
network. ConneXtions supports either configuration.
Organizations that want to completely bypass firewall delays can research
the large volume of security information about the subject.