3Com NBX 100 Administrator's Manual - page 423
Special Issues
423
NBX ConneXtions does not support the Layer 3 (IP) 6-bit TOS/DS priority
field. However, it is usually possible for IP routers to use these priority
schemes if they are configured to prioritize H.323 packets.
Special Issues
This section describes issues related to H.323 telephony in general and to
ConneXtions gateways in particular. These include:
■
Firewall Security
■
Gateway Load
■
Remote Access
■
PBX Connections
■
Class of Service
■
IP Type of Service and Differentiated Services
■
Alternate Gatekeepers
Firewall Security
Firewalls determine which packets can cross the boundary between a
protected network (intranet) and the public internet. The network
administrator specifies crossing privileges according to network needs
and policies. Control criteria consists of direction of transfer, source and
destination address, packet type, and access ports.
Firewalls affect, and are affected by, H.323 gateways. For example,
firewall processing increases packet delay while the complexity of the
H.323 protocol complicates the firewall programming.
The only way to safely avoid firewall delays is to exclude outside internet
access. This means calls can only be made within the secure intranet.
In some business applications, it is possible to eliminate the firewall delay
by setting up a dedicated physical connection between the H.323
gateway and the router. This approach, which requires a second NIC in
the ConneXtions PC system, bypasses the firewall and puts the burden of
discriminating against non-H.323 packets on the gateway. The PC system
that runs the ConneXtions software must be secure.
Systems that must conform to very conservative firewall policies can use a
Virtual Private Network (VPN) if they need to filter incoming H.323 calls
from the public Internet. An alternative is to use a firewall with H.323
proxy support.