First of all, i am not quite sure what type of h323 device the Polycom box is , but my guest is probably a gateway/h323 client device. Either way, as far the h323 signaling goes, the dynamism in port assignment and h245 negociations is what makes most firewalls fail miserably when it comes to real time traffic such as voice. Using an ordinary firewall, you can probably get most of the static signaling through by defining the well known ports for them (h225 RAS, and most Q.931 stuff), but when you get down to media negociation (h245) there is no way of predicting what port# the parties will be using, since it is random (dynamic). I haven't worked with PIX FW extensively and i can only guess that it also falls in the category of the other firewalls i have tested and noticed the problem with. Very few companies are working on developing a real-time traffic firewall that can dynamically open pinwholes for voice traffic on a per-call basis, providing for the best security in the industry. I can lead you to one specifically that i test day-in day-out if you are interested.
My guest on what you will try to do next is to check with the Plycom vendor to see what ports to open on your PIX fw, but i can tell you this for sure: by the time you are done opening all the ports (port ranges, to be more specific), you will realize that your firewall has no real purpose, really. That is the catch. The technology is moving; you might want to tag along.
Regards
Eyabane
MCSE, CCNP+VOICE, CCDP
