Hey everyone,


I have a question. Anyone ever set up there pix to do h323 video confrencing without having to poke holes throught it. We are looking to let ourselves connect to anyone on the net. This creats the problem if it was just between offices then it would be easy just create a vpn. WE want it to be able to accept inbound sessions.

Thanks
Drizzits

Report this post to a moderator

I wouldn`t think there would be a way without VPN.
Otherwise you would need to create static NAT mappings and allow specific ports incoming access through the firewall.
If you have enough address space you could place your video conference machine on your DMZ, yes it would be more vulnerable but your LAN would be more secure.

__________________
Check out my music at
www.chodan.com
Rural Development in Eastern Ky.
www.centertech.com
"It is our decisions that show us what we truly are in life, not our abilities."

Report this post to a moderator

fixup protocol h323 1720

Report this post to a moderator

The problem is not really outgoing its incoming. Darthfeces from what I understand that if you use fixup h323 that will only help with outgoing h323 it still wont accept incoming. THat what I was told I will be trying it tomorrow I will let you know if it works.

Drizzits

Report this post to a moderator

Thats why I suggested a static NAT mapping.
So your incoming H.323 will know what address to attach to.
Not to mention fixup protocol h323 1720 is on by default.

__________________
Check out my music at
www.chodan.com
Rural Development in Eastern Ky.
www.centertech.com
"It is our decisions that show us what we truly are in life, not our abilities."

Report this post to a moderator

access-list 101 permit tcp host any any eq h323


access-group 101 in interface outside

does this sound right to you all?

__________________
Check out my music at
www.chodan.com
Rural Development in Eastern Ky.
www.centertech.com
"It is our decisions that show us what we truly are in life, not our abilities."

Report this post to a moderator

yes,
i didn't read through the question ... my bad

Report this post to a moderator

The way i did this is.. i took a 224 mask network address i owned and busted it up to..two 240's. put one as my DMZ and assigned 192.168's to my networks behind the fiewall. Then i setup DNAT entries into selected fakesorts inside my network.. and mapped them to one of my IP in my other 240.. this works out really well.. it gives me tight control and it's totally transparent to the users..
-Catfisch

Report this post to a moderator

quote:

---

Originally posted by catfisch
The way i did this is.. i took a 224 mask network address i owned and busted it up to..two 240's. put one as my DMZ and assigned 192.168's to my networks behind the fiewall. Then i setup DNAT entries into selected fakes: ports inside my network.. and mapped them to one of my IP in my other 240.. this works out really well.. it gives me tight control and it's totally transparent to the users..
-Catfisch

---

__________________
Check out my music at
www.chodan.com
Rural Development in Eastern Ky.
www.centertech.com
"It is our decisions that show us what we truly are in life, not our abilities."

Report this post to a moderator

Thanks.. chodan.. and it's free! -Catfisch

Report this post to a moderator