Firewall interface configuration to enable bi-directional VoIP traversal communications

摘要

Methods and systems for an intelligent network protection gateway (NPG) and network architecture are provided. According to one embodiment, a firewall provides network-layer protection to internal hosts against unauthorized access by hosts of an external network by performing network address translation (NAT) processing of Internet Protocol (IP) addresses. The firewall changes data in headers of VoIP packets and corresponding data contents of the VoIP packets, to enable bi-directional VoIP communications. An external VoIP interface of the firewall receives incoming VoIP packets having a user alias (e.g., an email address) and an indication regarding a VoIP port of external interface. The packets are directed to an appropriate internal host by the firewall performing port address forwarding based on the port indication to a media gateway within the internal network that maintains a mapping of user aliases to private addresses of the internal hosts.

主权项

1. A method comprising:
providing, by a firewall interposed between an internal network and an external network, network-layer protection against unauthorized access by hosts associated with the external network to a plurality of internal hosts associated with the internal network by performing network address translation (NAT) processing of Internet Protocol (IP) addresses associated with the plurality of internal hosts; providing, by the firewall, application-layer protection from the external network on behalf of the plurality of internal hosts and supporting VoIP services without compromising internal network security by actively processing signaling protocols associated with Voice over IP (VoIP) sessions, including
distinguishing among VoIP packets and non-VoIP packets,understanding and parsing the VoIP packets within an operating system kernel of the firewall, andperforming content-aware NAT within the operating system kernel by changing data in headers of the VoIP packets and also changing data contents in the VoIP packets corresponding to data changed in the headers to enable bi-directional VoIP communications among one or more of the plurality of internal hosts and one or more of the hosts associated with the external network; providing a plurality of VoIP ports to an external VoIP interface of the firewall; receiving by the external VoIP interface incoming VoIP packets each having associated therewith a user alias and an indication regarding one of the plurality of VoIP ports; causing each of said received multiple incoming VoIP packets to be directed to an appropriate internal host of the plurality of internal hosts by performing by the firewall port address forwarding based on the port indication to a media gateway within the internal network that maintains a mapping of user aliases to private addresses of the plurality of internal hosts.