Gateway Load - 3Com 3C10402B Administrator's Manual

482 A D: C
PPENDIX ONNE

Gateway Load

X H.323 G
TIONS ATEWAY
These descriptions focus on the firewall-protected approach, and offer
guidelines for programming a firewall that can be used to support H.323
connections that are accessible to the public internet.
Outbound Calls
Most firewalls do not restrict outbound packets or IP packets that
respond to outbound initiatives. They are configured for unrestricted
outbound packets with unrestricted reply packets. They do not have to be
changed to support outbound H.323 calls from a system.
Inbound Calls
Firewalls usually discriminate against incoming packets. The network
administrator configures a list of acceptable sources for each destination
address within a protected network. The configuration list includes a list
of entries that the firewall compares to the IP address of the local H.323
gateway and the IP address of an external caller. The configuration list
also discriminates for or against specific types of packets. IP addresses
and packet types must match for packets to pass.
The H.323 protocol uses TCP packets for call setup, and UDP packets to
carry the voice payload. Each type of packet includes an array of port
addresses that are used during the connection. Ports 1720 negotiates
which of the other available ports is used to carry the connection.
The ConneXtions gateway uses these default port assignments:
For UDP traffic, ConneXtions uses ports 8000-8099 by default. Calls
■
require four UDP ports each.
ConneXtions uses ports 1025-5000 for TCP traffic. You can configure
■
TCP ports during installation.
During ConneXtions installation, you can configure the TCP ports that are
used for incoming calls. For outgoing calls, no control is possible. Port
1720 must be preserved.
You must configure a firewall to accommodate both TCP and UDP ports
on the same system.
If the gateway system NIC is attached to a LAN with heavy packet traffic
(more than 700 non-H.323 packets per second), the extra address
processing burden, which requires processing power, can slow down the