Source: http://www.microsoft.com/windows/NetMeeting/Corp/reskit/Chapter4/default.asp
This chapter describes how Microsoft® Windows® NetMeeting® 3
works with an organization's existing firewall security. You will learn
about NetMeeting requirements for TCP and UDP connections, as well as the IP
ports needed to establish a NetMeeting connection.
 |
|
Note: Components of a Secured System
Components of a Secured System A firewall is a set of security mechanisms that an organization implements, both logically and physically, to prevent unsecured access to an internal network. Firewall configurations vary from organization to organization. Most often, the firewall consists of several components, which can include a combination of the following:
Very rarely is a firewall a single component, although a number of newer commercial firewalls attempt to put all of the components into a single computer. The following illustration shows a firewall configuration. 
For most organizations, an Internet connection is part of the firewall. The firewall identifies itself to the outside network as a number of Internet Protocol (IP) addresses, or as capable of routing to a number of IP addresses, all associated with Domain Name Service (DNS) entries. The firewall might respond as a host, resulting in a virtual computer, or pass on packets bound for these hosts to assigned computers. NetMeeting and FirewallsYou can configure firewall components in a variety of ways, depending on your organization's specific security policies and overall operations. While most firewalls are capable of allowing primary (initial) and secondary (subsequent) Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) connections, they might be configured to support only specific connections based on security considerations. For example, some firewalls allow only primary TCP connections, which are considered the most secure and reliable. To enable NetMeeting 3 multipoint data conferencing—program sharing, Whiteboard, Chat, file transfer, and directory access—your firewall only needs to pass through primary TCP connections on assigned ports. NetMeeting audio and video features require secondary TCP and UDP connections on dynamically assigned ports. Therefore, if you establish connections through firewalls that accept only primary TCP connections, you will not be able to use the audio or video features of NetMeeting. Establishing a NetMeeting Connection with a FirewallWhen you use NetMeeting to call other users over the Internet, several IP ports are required to establish the outbound connection. The following table shows the ports, their functions, and the resulting connection.
If you use a firewall to connect to the Internet, it must be configured so that the IP ports are not blocked. To establish outbound NetMeeting connections through a firewall, the firewall must be configured to do the following:
The H.323 call setup protocol dynamically negotiates a TCP port for use by the H.323 call control protocol. Also, both the audio call control protocol and the H.323 call setup protocol dynamically negotiate UDP ports for use by the H.323 streaming protocol, called the Real-Time Transfer Protocol (RTP). In NetMeeting, two UDP ports are determined on each side of the firewall for audio and video streaming, for a total of four ports for inbound and outbound audio and video. These dynamically negotiated ports are selected arbitrarily from all ports that can be assigned dynamically. NetMeeting directory services require port 389. Microsoft Internet Locator Service (ILS) servers, which support the Lightweight Directory Access Protocol (LDAP) for NetMeeting, also require port 389. Microsoft Proxy Server ExampleThis section provides a guideline for setting up the Microsoft Proxy Server to enable the necessary ports for NetMeeting outbound calls. For additional information about configuring the Microsoft Proxy Server, refer to the Microsoft® Proxy Server Installation and Administration Guide. Microsoft Proxy Server and Microsoft Internet Information Services are run on Windows NT 4.0 (with Service Pack 3 or greater). The Microsoft Internet Service Manager is part of Internet Information Services. To configure the Microsoft Proxy Server for NetMeeting
Some firewalls cannot support an arbitrary number of virtual internal IP addresses, or cannot do so dynamically. With these firewalls, you can establish outbound NetMeeting connections from computers inside the firewall to computers outside the firewall, and you can use the audio and video features of NetMeeting. Other people, though, cannot establish inbound connections from outside the firewall to computers inside the firewall. Typically, this restriction is due to limitations in the network implementation of the firewall. Note: Some organizations might have security or policy concerns that require them to limit how fully they support NetMeeting in their firewall configuration. These concerns might be based on network capacity planning or low confidence in the firewall technology being used. For example, security concerns might prohibit an organization from accepting any inbound or outbound flow of UDP data through their firewall. Because these UDP connections are required for NetMeeting audio and video features, disabling this function excludes audio and video features in NetMeeting for calls through the firewall. The organization can still use NetMeeting data conferencing features—such as program sharing, file transfer, Whiteboard, and Chat—for calls through the firewall by allowing only TCP connections on ports 522 and 1503. For more information about firewall design, policy, and security considerations for firewall design in general, see Building Internet Firewalls, D. Brent Chapman and Elizabeth D. Zwicky, O'Reilly & Associates, Inc., 1995. |
