Alcatel-Lucent Security Management Server (SMS) Release 9.4 Technical Overview page 18

Alcatel-Lucent VPN Firewall Brick
• Microsoft NetBIOS [address translation]
• RPC (Remote Procedure Call) [logging, filter by procedure and program, dynamic
channel opening]
These Application Filters are customizable for the particular environment in which they
are being used. Different versions of the same Application Filters can be applied
simultaneously to different traffic as it flows through the Brick. Application Filters are
fully integrated into the Brick Virtual Firewall model, as well as the SMS Object
Model.
Some Application Filters, such as the H.323 App Filter, also support user-configurable
limits on the numbers and timeouts for dynamic channel support.
Important! H.323 VOICE-OVER-IP APPLICATION FILTER NOTES
The H.323 Voice-over-IP Application Filter, along with the H.323 RAS application
filter are of particular note. These features are designed to fully support the H.323
version 2 (2/98) standard, including complex features such as Fast-Start and H.245
tunneling.
These Application Filters include a full ASN.1 PER decoder to fully and
transparently inspect the H.323 and related set of data streams. When dynamic
channels are required, by either endpoint, the Brick device automatically opens a
self-sealing "pinhole" specific to that call. Only a single session will be allowed
through that pinhole; once that session is begun, the pinhole vanishes. If the
pinhole is never used, it will timeout.
Additionally, if Network Address Translation is desired, the Brick device performs
NAT on all addresses, whether in the IP header or H.323 payload. This includes
H.323/Q.931 messages, H.245 messages, and RAS messages.
...................................................................................................................................................................................................................................
1-12
™
Security Appliance Application Filters
260-100-022R9.4
Issue 1, June 2009