nat and video conference

[Sarg .]

hello guys any known issues or things i should look out fof when deploying a ciso video telepresnce over nat between two sites using h323?

[awinter2]

Max,

what endpoints do you intend to use? Are you planning to register these endpoints to an H323 gatekeeper/SIP proxy such as the VCS or will these devices be used in Direct mode?

Regards

Andreas

[Sarg .]

well actually there is going to be a video conference system connection between a sony and SEMC.  conference systems is likely to use H323.

[Sarg .]

i am open to suggestions. i am just trying to find out before hand. i think i should re-ask this question and say ' how would you do it or what stratgy or solution would you follow '

[awinter2]

Max,

for Cisco Telepresence endpoints (At least the former TANDBERG endpoints) behind NAT, the ideal solution would be to deploy a VCS Expressway in which these endpoints register with. The Expresswat will assist the endpoints assuring that signalling and media will safely traverse firewalls and NAT.

Regards

Andreas

[Paulo Souza]

Max,

The best secured and easy practice is to do what Andreas has suggested. That is indisputable!

But I got another solution that should work for you:

Cisco endpoints have the option to configure a NAT address to be used by the endpoint. When you set this feature, the codec will put the NAT Address in the "H323 header" (that must be the same address used by outside interface of the NAT device), so, H323 calls will work perfectly even if you have a NAT in the path, you have only to open the required ports in your firewall.

If your endpoint is not Cisco and does not have that feature, so, you should have a NAT device that supports ALG (Advanced Layer Gateway). Then, the NAT device will "nat" the call correctly.

Why am I telling you that? Look, when you have NAT into the H323 or SIP call path, you must understand that, the NAT device will only change the source address inside the layer 3 header (OSI model), but into the application layer, H323 and SIP also carry the real source address of the endpoint. Then, when the remote side receive the packets, it will look at the H323 or SIP header and it will response to the address found in application layer, not to the address found in layer 3. So the response sent by the remote side will not match to the NAT table of the NAT Device, it will reject communication. That's why you must to have a router/firewall with ALG support, by doing that, your equipment will be able to understand and route correctly H323 and SIP calls.

Do you see how complicated is traversing firewall? That's why it's a great idea using Cisco VCS Expressway solution. It's secured, easy and functional.

Regards,

Paulo Souza

[Sarg .]

Thanks guys