The firewall opens a pinhole, and NAT performs translation service on any TCP or UDP traffic that does not carry the source and destination IP addresses in the application-layer data stream. Specific protocols or applications that embed IP address information require the support of an ALG.

H.323 is a recommendation published by the ITU-T defining a series of network elements and protocols for multimedia transmission through packet-based networks. H.323 defines a number of network elements used in multimedia transmission.

Although most H.323 implementations today utilize TCP as the transport mechanism for signaling, H.323 Version 2 enables basic UDP transport.

• H.323 Terminal—This element is an endpoint in the network, providing two-way communication with another H.323 terminal or gateway.

• H.323 Gateway—This element provides protocol conversion between H.323 terminals and other terminals that do not support H.323.

• H.323 Gatekeeper—This element provides services like address translation, network access control, and bandwidth management and account for H.323 terminals and gateways.

The following core protocols are described by the H.323 specification:

• H.225—This protocol describes call signaling methods used between any two H.323 entities to establish communication.

• H.225 Registration, Admission, and Status (RAS)—This protocol is used by the H.323 endpoint and gateway for address resolution and admission control services.

• H.245—This protocol is used for exchanging the capabilities of multimedia communication and for the opening and closing of logical channels for audio, video, and data.

In addition to the protocols listed, the H.323 specification describes the use of various IETF protocols like the Real Time Transport (RTP) protocol and audio (G.711, G.729, and so on) and video (H.261, H.263, and H.264) codecs.

NAT requires a variety of ALGs to handle Layer 7 protocol-specific services such as translating embedded IP addresses and port numbers in the packet payload and extracting new connection/session information from control channels. The H.323 ALG performs these specific services for H.323 messages.

When a Layer 7 protocol uses TCP for transportation, the TCP payload can be segmented due to various reasons, such as application design, maximum segment size (MSS), TCP window size, and so on. The application-level gateways (ALGs) that the firewall and NAT support do not have the capability to recognize TCP fragments for packet inspection. vTCP is a general framework that ALGs use to understand TCP segments and to parse the TCP payload.

vTCP helps applications like NAT and Session Initiation Protocol (SIP) that require the entire TCP payload to rewrite the embedded data. The firewall uses vTCP to help ALGs support data splitting between packets.

When you configure firewall and NAT ALGs, the vTCP functionality is activated.

vTCP currently supports Real Time Streaming Protocol (RTSP) and DNS ALGs.

ALG is a subcomponent of NAT and the firewall. Both NAT and the firewall have a framework to dynamically couple their ALGs. When the firewall performs a Layer 7 inspection or NAT performs a Layer 7 fix-up, the parser function registered by the ALGs is called and ALGs take over the packet inspection. vTCP mediates between NAT and the firewall and the ALGs that use these applications. In other words, packets are first processed by vTCP and then passed on to ALGs. vTCP reassembles the TCP segments in both directions within a TCP connection.

The ALG-H.323 vTCP with High Availability Support for Firewall and NAT feature enhances the H.323 application-level gateway (ALG) to support a TCP segment that is not a single H.323 message. After the H.323 ALG is coupled with vTCP, the firewall and NAT interact with the H.323 ALG through vTCP. When vTCP starts to buffer data, the high availability (HA) function is impacted, because vTCP cannot synchronize the buffered data to a standby device. If the switchover to the standby device happens when vTCP is buffering data, the connection may be reset if the buffered data is not synchronized to the standby device. After the buffered data is acknowledged by vTCP, the data is lost and the connection is reset. The firewall and NAT synchronize the data for HA. vTCP only synchronizes the status of the current connection to the standby device, and in case of errors, the connection is reset.

1.    enable


2.    configure terminal


3.    class-map type inspect match-any class-map-name


4.    match protocol protocol-name


5.    match protocol protocol-name


6.    exit


7.    policy-map type inspect policy-map-name


8.    class type inspect class-map-name


9.    inspect


10.    exit


11.    class class-default


12.    exit


13.    zone security zone-name


14.    exit


15.    zone-pair security zone-pair-name source source-zone destination destination-zone


16.    service-policy type inspect policy-map-name


17.    exit


18.    interface type number


19.    zone member security zone-name


20.    end

Device> enable 

Device# configure terminal 

Device(config)# class-map type inspect match-any h.323-class 

Device(config-cmap)# match protocol h323 

Device(config-cmap)# match protocol h323ras 

Device(config-cmap)# exit 

Device(config)# policy-map type inspect h.323-policy 

Device(config-pmap)# class type inspect h.323-class 

Device(config-pmap-c)# inspect 

Device(config-pmap-c)# exit 

Device(config-pmap)# class class-default 

Device(config)# exit 

Device(config)# zone security inside 

Device(config-sec-zone)# exit 

Device(config)# zone-pair security inside-outside source inside destination outside 

Device(config-sec-zone-pair)# service-policy type inspect h.323-policy 

Device(config-sec-zone-pair)# exit 

Device(config)# interface gigabitethernet 0/0/1 

Device(config-if)# zone member security inside 

Device(config-if)# end