H.323 With Gatekeeper - D-Link NetDefendOS User Manual

• Service: my_h323_service
• Comment: Allow incoming calls to H.323 phone at ip-phone.
3. Click OK
To place a call to the phone behind the NetDefend Firewall, place a call to the external IP address
on the firewall. If multiple H.323 phones are placed behind the firewall, one SAT rule has to be
configured for each phone. This means that multiple external addresses have to be used.
However, it is preferable to use an H.323 gatekeeper as this only requires one external address.
Example 6.14. H.323 with Gatekeeper
In this scenario, a H.323 gatekeeper is placed in the DMZ of the NetDefend Firewall. A rule is
configured in the firewall to allow traffic between the private network where the H.323 phones
are connected on the internal network and to the Gatekeeper on the DMZ. The Gatekeeper on
the DMZ is configured with a private address. The following rules need to be added to the rule
listings in both firewalls, make sure there are no rules disallowing or allowing the same kind of
ports/traffic before these rules.
Web Interface
Create a new H.323 ALG object:
1. Go to: Objects > ALG > Add > H.323 ALG
2. Specify a name for the ALG, in this case my_h323_alg
3. Click OK
Create a custom Service object for the H.323 gatekeeper:
1. Go to: Objects > Services > Add > TCP/UDP
2. Now enter:
491
Chapter 6: Security Mechanisms