Video Conferencing and Firewalls

Transcription

1 Video Conferencing and Firewalls Out with the Old, in with the New Video Conferencing is leaving ISDN for a better transport medium, IP. It s been happening for a long time in Europe but now ISDN is well and truly behind us. The majority of AuDeo s installations are now of IP only devices and we re seeing people disconnecting their ISDN lines in favour of IP. ISDN will be missed, with ISDN you know where you stand, you dial a number connect a call and most of the time it worked. What won t be missed are the expensive line installation, rental and call rates, limited bandwidth and not to mention international call charges. IP is what your computer uses to communicate to anything on your network or the Internet. It is the protocol that ensures that information you send is router properly to its destination, from your PC to your Router and Firewall over your Internet connection onto the World Wide Web. So, what s so great about IP? When compared to ISDN it is cheaper and faster, you don t have call charges by the minute and everyone already has it. Whether everyone is using it for their Video Conferencing is another matter, this is largely due to firewalls and the problems that they can cause with video. These problems are what this article hopes to help you fix. What s the problem with Firewalls? Simply put, firewalls are security devices that block any unauthorised traffic entering your network and potentially causing harm. By their nature they block anything they don t recognise, this can often include Video Conferencing traffic. If you have a Video Conference system on your network and try making a call out to someone over the Internet without making any configuration changes it will almost certainly fail, this is due to a few things which all derive from a firewall, all in the name of security. Here are a few symptoms you can expect: Not receiving any video Not receiving any audio The call never connects, it keeps ringing and ringing or just disconnects straight away Blue screens PC Presentation don t work

2 We see these problems on a daily basis and help people overcome them with one of three methods. However, just because you ve put in the appropriate means to get past your firewall doesn t mean the person your calling has. What are my options? Network Address Translation (NAT) A NAT configuration requires rules to be configured on your firewall device that stop it from blocking specific traffic to your Video Conferencing device. Your Video Conferencing system also needs its configuration modified so that it is able to make successful calls. Easy to set up if you have someone with the skills Negatives Requires one IP address per Video Conferencing system Firewall changes can stop the Video Conferencing from working AuDeo cannot support your firewall Stops most systems from working over the internal network Public IP Connection You can connect your Video Conferencing equipment directly to the Internet, this means that you re beyond its security control and can freely make calls over the Internet. Relatively easy to set up Free to set up if you have existing network equipment

3 Negatives Puts your system on the public Internet Won t work on most all-in-one Router firewalls Requires one IP address dedicated per Video Conference system Prevents you from making internal calls over your network Video Firewall Traversal System All the major Video Conferencing manufactures have a firewall traversal device. These are video aware firewalls that sit parallel with your normal firewall and enable your Video Conferencing systems to bypass your firewall whilst still allowing internal calls and remaining secure. Fully supported solution AuDeo would install and configure the equipment Uses one public IP address for all internal systems Allows both internal and external calls Negatives It isn t a free solution So what should I do? With a few choices that all seem to have the same result this is a very good question. Of course using a video firewall traversal system is the preferred option but not necessarily always the most viable. If you only have on or two video systems then it is probably better to put them on a Public IP connection, or set up a NAT The Technical Part If your interest was only to understand the options available to you, you can stop reading now. If you are using this document to help fix a problem that you have, then keep reading. We ve outlines the methods required to configure any of the three options. If you have any questions or problems please do not hesitate to contact our technical support team on , please have your systems serial number ready. Network Address Translation (NAT) Configuring a system to work with NAT requires changes on both the firewall and Video Conference system. Your Video Conference system needs to be told about its assigned public IP address so that during call setup it can tell the far end system to return packets to the public IP address instead of its private IP address. In making this configuration change you stop the system from being able to make internal calls as it will also tell the internal systems to return packets to its public IP address.

4 H.323 Port Ranges 80 Static TCP HTTP Interface (optional) 1720 Static TCP H.323 call setup (Must be bidirectional) Dynamic TCP H Dynamic UDP RTP (Video Data) Dynamic UDP RTP (Audio Data) Dynamic UDP RTCP (Control Information) The Dynamic ranges above are what Video Conferencing systems will use out of the box. These can be restricted to a smaller port range by accessing the systems settings and enabling fixed port parameter. The system will then tell you the port range it will use. NAT Configuration on a Polycom VSX or HDX system 1. From your home screen go to the System Menu 2. Select Admin Settings 3. Select Network 4. Select IP 5. Select Firewall 6. Enable Fixed Ports 7. Set NAT configuration to Auto or Manual a. If set to manual, enter the systems public IP address b. If set to auto, check that the correct public IP address has been detected 8. Configure your firewall to allow H.323 traffic based on the H.323 ports above as well as the fixed port ranges you ve just configured on your video conference system 9. Perform test calls in both directions Public IP Connection You will need to connect your Video Conferencing system directly into a public Internet service. Then configure its IP Configuration so that it has a public address and the appropriate subnet mask, default gateway and DNS configuration. Once completed, perform test calls to a known working system. Video Firewall Traversal System A video firewall traversal system is a video aware firewall that sits parallel to your existing firewall it only allows video traffic through it and uses extensions to identify your internal systems. An incoming call would dial the video firewalls public IP address prefixed with the extension of the video system they wish to reach. AuDeo engineers would install and configure one of these devices as they re specialist products. Once up and running they will continue to carry out their function with little to no extra management overhead.

5 For further information please contact us on or for further information. Polycom Video Border Proxy Firewall Traversal System Cisco Video Infrastructure