H.323 Inspection Overview; How H.323 Works - Cisco PIX 500 Series Configuration Manual

H.323 Inspection

H.323 Inspection Overview

H.323 inspection provides support for H.323 compliant applications such as Cisco CallManager and
VocalTec Gatekeeper. H.323 is a suite of protocols defined by the International Telecommunication
Union for multimedia conferences over LANs. The security appliance supports H.323 through Version
4, including H.323 v3 feature Multiple Calls on One Call Signaling Channel.
With H323 inspection enabled, the security appliance supports multiple calls on the same call signaling
channel, a feature introduced with H.323 Version 3. This feature reduces call setup time and reduces the
use of ports on the security appliance.
The two major functions of H.323 inspection are as follows:
•
•

How H.323 Works

The H.323 collection of protocols collectively may use up to two TCP connection and four to six UDP
connections. FastConnect uses only one TCP connection, and RAS uses a single UDP connection for
registration, admissions, and status.
An H.323 client may initially establish a TCP connection to an H.323 server using TCP port 1720 to
request Q.931 call setup. As part of the call setup process, the H.323 terminal supplies a port number to
the client to use for an H.245 TCP connection. In environments where H.323 gatekeeper is in use, the
initial packet is transmitted using UDP.
H.323 inspection monitors the Q.931 TCP connection to determine the H.245 port number. If the H.323
terminals are not using FastConnect, the security appliance dynamically allocates the H.245 connection
based on the inspection of the H.225 messages.
Within each H.245 message, the H.323 endpoints exchange port numbers that are used for subsequent
UDP data streams. H.323 inspection inspects the H.245 messages to identify these ports and dynamically
creates connections for the media exchange. RTP uses the negotiated port number, while RTCP uses the
next higher port number.
The H.323 control channel handles H.225 and H.245 and H.323 RAS. H.323 inspection uses the
following ports.
•
•
•
You must permit traffic for the well-known H.323 port 1720 for the H.225 call signaling; however, the
H.245 signaling ports are negotiated between the endpoints in the H.225 signaling. When an H.323
gatekeeper is used, the security appliance opens an H.225 connection based on inspection of the ACF
message.
After inspecting the H.225 messages, the security appliance opens the H.245 channel and then inspects
traffic sent over the H.245 channel as well. All H.245 messages passing through the security appliance
undergo H.245 application inspection, which translates embedded IP addresses and opens the media
channels negotiated in H.245 messages.
Cisco Security Appliance Command Line Configuration Guide
25-38
NAT the necessary embedded IPv4 addresses in the H.225 and H.245 messages. Because H.323
messages are encoded in PER encoding format, the security appliance uses an ASN.1 decoder to
decode the H.323 messages.
Dynamically allocate the negotiated H.245 and RTP/RTCP connections.
1718—Gate Keeper Discovery UDP port
1719—RAS UDP port
1720—TCP Control Port
Chapter 25 Configuring Application Layer Protocol Inspection
OL-12172-03