Pix 501 and Videoconferencing

[Moonacres]

Hi I am very new with pix's. Here is the problem/question I have. I have a dsl connection on the outside interface (this is a dhcp ip from my ISP) I then have configured the inside of the pix as dhcp as well with a range of IP's. Now I can videoconference out but do not get any incoming video from the far end. I am using a Polycom Ipower 900. If anyone can help me that would be great as I am quite new at this. I have uploaded my config so that you can see what I have setup. Basically it is just the normal setup throuh PDM.

: Saved

: Written by enable_15 at 20:21:08.520 EST Fri Nov 26 2004

PIX Version 6.3(1)

interface ethernet0 10full

interface ethernet1 100full

nameif ethernet0 outside security0

nameif ethernet1 inside security100

enable password xxxx

passwd xxxx

hostname xxxxxxx

domain-name xxxxxxx

clock timezone EST -5

clock summer-time EDT recurring

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol ils 389

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

names

pager lines 84

logging history errors

mtu outside 1500

mtu inside 1500

ip address outside pppoe setroute

ip address inside 192.168.1.1 255.255.255.0

ip audit info action alarm

ip audit attack action alarm

pdm logging informational 100

pdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

timeout xlate 0:05:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:00:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server RADIUS protocol radius

aaa-server LOCAL protocol local

http server enable

http 192.168.1.0 255.255.255.0 inside

snmp-server location Home Office

snmp-server contact xxxxxxx

snmp-server community public

snmp-server enable traps

floodguard enable

telnet 192.168.1.0 255.255.255.0 inside

telnet timeout 5

ssh timeout 5

console timeout 0

vpdn group pppoe_group request dialout pppoe

vpdn group pppoe_group localname xxxxxxxx

vpdn group pppoe_group ppp authentication pap

vpdn username xxxxxxxxx password ********

dhcpd address 192.168.1.40-192.168.1.47 inside

dhcpd lease 3600

dhcpd ping_timeout 750

dhcpd auto_config outside

dhcpd enable inside

terminal width 80

Cryptochecksum:xxxx

[thisisshanky]

You will have to use access-list (or conduits) and static statements to permit any explicit inbound connection coming from the internet...unless you are using a VPN for video conferencing...

[Moonacres]

Thanks for the response,now the question I have is this how would I use access-list? I am still very new to all this so I want to learn. I have read alot but I am not quit understanding how I should add this in.

[thisisshanky]

This link might help

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a008009402f.shtml

In the link, consider that your polycom unit replaces the Host PC thats behing the PIX firewall. You will also need to open up specific ports used by the Polycom for video conferencing..

Looking at this link below,

http://www.cisco.com/en/US/tech/tk652/tk701/technologies_configuration_example09186a0080111c1b.shtml

If its a Polycom viewstation, it uses TCP and UDP ports 3230 through 3235. You need to specify these ports in the ACL that you configure on the PIX firewall.

Hope that makes sense!!

[xe1zvo]

Polycom also uses ports:

TCP: 3230 to 3231, 389, 1503, 1730, 1720

UDP: 3230 to 3235