Subject: Re: [Ieprep] a practical VoIP issue

From: RJ Atkinson <[email-masked]>
Date: Sun, 1 Dec 2002 15:43:01 -0500

On Saturday, Nov 30, 2002, at 15:57 America/Montreal, King, Kimberly S. 
wrote:
>> Apparently VoIP systems use a wide range of dynamically
>> assigned UDP ports, which most firewalls block and which
>> most NATs cannot cope with properly.
>>
>> 	If one really wants to be able to use Internet
>> infrastructure during an emergency, designing a VoIP system
>> that can do NAT/Firewall traversal might be a pretty important 
>> component.
>
> There exist SIP aware firewalls that can cope with NAT and dynamically
> assigned UDP ports.  Are you suggesting something different?

	That is interesting and helpful, but maybe not sufficient.

	Not all VoIP deployments use SIP, for openers.

	Most *deployed* firewalls don't open enough of the UDP ports
*because the policy choice of the firewall operator is to block
those ports*.  I don't see how it VoIP service will automatically work
through a majority of deployed firewalls as long as it needs so many 
ports
left wide open for an adversary.

	For pre-planned VoIP deployments, this can be worked through by
getting policies changed, upgrading firewall capabilities, and so forth.
For IEprep use of VoIP, the reality is that most access links have a 
firewall
on the customer end and that firewall is likely to be pre-configured in 
a
manner that blocks IEprep use of VoIP.

	I actually think that this kind of issue (including NAT Traversal,
which is closely related) is a huge architectural headache for The
Internet.  I don't see any sort of quick fix, but it is a real problem.

Ran

_______________________________________________
Ieprep mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ieprep