Special Issues; Firewall Security - 3Com SuperStack 3 NBX Administrator's Manual

434 A A: C
PPENDIX ONNE

Special Issues

Firewall Security

X H.323 G
TIONS ATEWAY
This section describes issues related to H.323 telephony in general and to
ConneXtions gateways in particular. These include:
Firewall Security
■
Gateway Load
■
Remote Access
■
PBX Connections
■
Class of Service
■
IP Type of Service and Differentiated Services
■
Alternate Gatekeepers
■
Firewalls determine which packets can cross the boundary between a
protected network (intranet) and the public internet. The network
administrator specifies crossing privileges according to network needs
and policies. Control criteria consists of direction of transfer, source and
destination address, packet type, and access ports.
Firewalls affect, and are affected by, H.323 gateways. For example,
firewall processing increases packet delay while the complexity of the
H.323 protocol complicates the firewall programming.
The only way to safely avoid firewall delays is to exclude outside internet
access. This means calls can only be made within the secure intranet.
In some business applications, it is possible to eliminate the firewall delay
by setting up a dedicated physical connection between the H.323
gateway and the router. This approach, which requires a second NIC in
the ConneXtions PC system, bypasses the firewall and puts the burden of
discriminating against non-H.323 packets on the gateway. The PC system
that runs the ConneXtions software must be secure.
Systems that must conform to very conservative firewall policies can use a
Virtual Private Network (VPN) if they need to filter incoming H.323 calls
from the public Internet. An alternative is to use a firewall with H.323
proxy support.
While the operating system that runs the H.323 gateway can be
programmed to serve both as an H.323 gateway and as an IP router, such
arrangements are usually impractical because the gateway needs so
much processing power just to handle audio conversions.