Netmeeting Ports

[cyee]

I'm looking for a CCO or other reference that lists ports required to permit Microsoft Netmeeting INCOMING calls to be permitted (and configured on a PIX). The incoming calls will be to a single inside host with a static address available on the outside.

TIA

[a.kiprawih]

Hi,

To establish outbound NetMeeting connections through a firewall, the firewall must be configured to do the following:

* Pass through primary TCP connections on ports 389, 522, 1503, 1720, and 1731.

* Pass through secondary TCP and UDP connections on dynamically assigned ports (1024-65535).

Click on the following url to get more details:

http://www.microsoft.com/windows/NetMeeting/Corp/reskit/Chapter4/default.asp

Cheers!

AK

[a.kiprawih]

"The incoming calls will be to a single inside host with a static address available on the outside..."

I assumed you already have static map of your internal IP to a public IP Address

Pls make sure you have ACL that permit ALL related tcp service ports as follow:

1. Outside interface - outside ACL

Permit all Netmeeting ports (refer previous post) to reach the Public IP (e.g x.x.x.x) of your statically mapped inside address (y.y.y.y), and bind it to the outside interface.

For example:

access-list outside permit tcp host 200.200.200.200 host x.x.x.x eq 389 ---> allow single host, or

access-list outside permit tcp 200.200.200.0 255.255.255.0 host x.x.x.x eq 389 ---> allow subnet, or

access-list outside permit tcp any host x.x.x.x eq 389 ---> allow any IP

bind ACL to outside interface:

access-group outside in interafce outside

2. If you have ACL on the inside interface, permit the following ports for outbound connections:

Port Function Outbound Connection

389 Internet Locator Service (ILS) TCP

522 User Location Service TCP

1503 T.120 TCP

1720 H.323 call setup TCP

1731 Audio call control TCP

Dynamic H.323 call control TCP

Dynamic H.323 streaming Real-Time Transfer Protocol (RTP) over UDP

access-list inside permit tcp host any eq 389

*replace keyword 'any' with single host IP or subnet + mask

Bind ACL to inside interface:

access-group inside in interface inside

Hope this can help.

rgds,

AK