Aethra Vega X3 Use And Installation Manual page 94

NAT (Network Address Translation)
Network Address Translation is an Internet standard that allows a LAN (Local Area Network) to use a set
of IP addresses for internal traffic and another address (or set of addresses) to connect to services on an
external network (the internet, for example). Devices that implement NAT are located at boundaries
between the LAN and the external network, and their purpose is to provide translation of IP addresses for
all packets that are destined for the external network. Many organizations use NAT as a security
mechanism because it masks the internal IP addresses—if hackers do not know the IP address of a
machine, they cannot attack it and cause disruptions. NAT also allows a company to use more IP
addresses than they might otherwise be allocated. Since these addresses are only used internally, there is
no problem with IP address conflicts with other organizations.
Problems with Video and Voice Communications on NAT/Firewall Protected Networks
The IP based voice and video protocols like H.323 require that terminals be capable of establishing audio-
video communication channels using IP addresses and data ports. In this situation, a problem arises:
terminals must "listen" for incoming calls to establish IP connections, but the firewall is generally
configured in such a way as not to allow packets past that are not expressly requested. Even if the network
administrator left a port open for the terminal to receive notification of a call (port 1720, designated as a
"well-known TCP port") the video and voice communication protocols for IP necessitate the opening of
other ports in order to receive control messages and open audio and video channels.
The identities of these additional ports are determined dynamically, not in advance, meaning that the
network administrator would have to open all the firewall ports to allow video and voice communication,
thus virtually disabling the firewall. Network administrators are unlikely to do this (and wisely so), since it
effectively eliminates network security policies. NAT also creates an obstacle for voice and video
communications over IP. NAT allows an organization to assign private IP addresses to machines on the
local network, but routers that control the flow of data towards the Internet can handle only packets with
routable addresses or public IP addresses.
A terminal located behind the NAT device on the LAN can initiate communication with any other terminal in
the same LAN because the IP addresses within the LAN are routable, meaning that it is possible to have
subnets in a company managed by an internal router. This allows the establishment of audio-video
communications on different branches of the subnet.
Because they have private addresses, and are therefore not accessible from outside the NAT, terminals
on the LAN cannot be reached by externally originating calls. Even if they initiate calls to external
terminals, a problem still arises. When the call is initiated, the IP address of the calling terminal is
contained in the payload of the packet sent. The destination terminal receives call setup packets,
examines them and starts to transmit audio and video towards the terminal from which the call was
received, and from which the IP address was obtained by examining the contents of the received packets.
If this IP address is private, the router for Internet access discards the audio and video packets sent from
the terminal external to NAT towards the internal terminal because the packets sent were non-routable.
The connection between two terminals appears to be successful but in reality the NAT-internal terminal
never receives the audio or video from the external terminal.
Solution for the NAT/Firewall Problem
The only equipment that does not create any of the problems described above is a NAT/firewall H.323-
compatible device. Such a firewall does not block the TCP 1720 port and allows access to the other,
dynamically-determined H.323 ports.
Videoconferencing systems usually have private IP addresses that are not accessible from external
routers. To allow calls to function properly, the network administrator can define static NAT (a permanent
94