-
Cisco Systems EDCS-154011 - page 1
Copy right © 200 1 Cis co Sy stems , Inc. Page 1 of 11 Integrating Cisco Secure PIX Firewall and IP/VC Videoconferencing Networks An IP/V C A ppl icat ion No te Jonathan Roberts Network Consultant Engineer Enterprise Voice, Video Business Unit September 24, 2001 EDCS - 154011 ...
-
Cisco Systems EDCS-154011 - page 2
Copy right © 200 1 Cis co Sy stems , Inc. Page 2 of 11 Table o f conten ts Tab le o f con ten ts ................................................................................................ ............................. 2 Intro duc tion ................................................................................................ ........... ...
-
Cisco Systems EDCS-154011 - page 3
Copy right © 200 1 Cis co Sy stems , Inc. Page 3 of 11 Introduc tion This paper explains how to set up the Cisco Secure PIX firewall for use in Cisco IP/VC H.323 deployments. The configuration that will be shown below will be a two-interface PIX 515 running version 6.01 and utilizing NAT. The goals of this paper are: 1. Describe the issues with fi ...
-
Cisco Systems EDCS-154011 - page 4
Copy right © 200 1 Cis co Sy stems , Inc. Page 4 of 11 Issues with Firewalls and H.323 What makes H.323 so cumbersome to run through a firewall is its use of multiple data ports for a single call. For an H.323 call to take place it must first open an H.225 connection on TCP port 1720, using Q.931 signaling. After this has taken place, the H.245 ma ...
-
Cisco Systems EDCS-154011 - page 5
Copy right © 200 1 Cis co Sy stems , Inc. Page 5 of 11 What is NAT? Network Address Translation (NAT) is designed for IP address simplification and conservation, as it enables private IP internetworks that use nonregistered IP addresses to connect to the Internet. NAT can operate on the PIX or a router, usually connecting two networks together, an ...
-
Cisco Systems EDCS-154011 - page 6
Copy right © 200 1 Cis co Sy stems , Inc. Page 6 of 11 How to configure the Cisco Secure PIX Firewall to allow H.323 traffic For this configuration we will assume the following, which is depicted in figure 1: • The Firewall is a PIX 515 with two interfaces. • A Gatekeeper with an internal IP address of 10.1.1.10 and an external IP address of 2 ...
-
Cisco Systems EDCS-154011 - page 7
Copy right © 200 1 Cis co Sy stems , Inc. Page 7 of 11 Tabl e 1: Two Int erfac e PI X w ith N AT Con figu ratio n Con figu ratio n Des cript ion nameif ethern et0 ou tside s ecurity 0 nameif ethern et1 in side se curity1 00 interfa ce ethe rnet0 10base t interfa ce ethe rnet1 10base t PIX Fire wall pro vide s na mei f an d int erfa ce c omm and st ...
-
Cisco Systems EDCS-154011 - page 8
Copy right © 200 1 Cis co Sy stems , Inc. Page 8 of 11 Breaking down the PIX configuration Fixup protocol Command The first thing that we will look at in the PIX configuration is the H.323 Fixup Protocol. The H.323 fixup on PIX enables users to allow H.323 traffic to pass though the PIX. The two major functions of the fixup are to: 1. NAT the nece ...
-
Cisco Systems EDCS-154011 - page 9
Copy right © 200 1 Cis co Sy stems , Inc. Page 9 of 11 static [ ( internal_if_name , external_if_name ) ] global_ip local_ip [ netmask network_mask ] [ max_conns [ em_limit ]] [ norandomseq ] In the configuration from Table XX, the static command is implemented in this manner: static (inside,outside) 209.165.201.10 10.1.1.10 netmask 255.255.255.25 ...
-
Cisco Systems EDCS-154011 - page 10
Copy right © 200 1 Cis co Sy stems , Inc. Page 10 of 11 IP/VC 3510 MCU with the IP address of 209.165.201.30, port 2720 will need to be opened. Use the following guidelines for specifying a source, local, or destination address: -Use a 32-bit quantity in four-part, dotted-decimal format. -Use the keyword any as an abbreviation for an address and m ...
-
Cisco Systems EDCS-154011 - page 11
Copy right © 200 1 Cis co Sy stems , Inc. Page 11 of 11 deny option in an access-list command statement, PIX Firewall discards the packet and generates the following syslog message: %PIX-4-106019: IP packet from source_addr to destination_addr, protocol protocol received from interface interface_name deny by access-group acl_ID Always use the acce ...
Cisco Systems EDCS-154011についてご質問がありますか?
次のフォームを使用してください
見つけた説明書を読んでもCisco Systems EDCS-154011の問題を解決できない場合、下記のフォームを使用して質問をしましょう。ユーザーのどなたかがCisco Systems EDCS-154011で同様の問題を抱えていた場合、その解決方法を共有したいと考えるかもしれません。