User's Manual

Firewall
Configuring the Application Level Gateway
Cisco ISA500 Series Integrated Security Appliance Administrator Guide 209
6
Configuring the Application Level Gateway
The security appliance can function as an Application Level Gateway (ALG) to
allow certain NAT un-friendly applications (such as SIP or H.323) to operate
properly through the security appliance.
If Voice-over-IP (VoIP) is used in your organization, you should enable the H.323
ALG or SIP ALG to open the ports necessary to enable the VoIP through your voice
device. The ALGs are created to work in a NAT environment to maintain the
security for privately addressed conferencing equipment protected by your voice
device.
You can use both H.323 and SIP ALGs at the same time, if necessary. To determine
which ALG to use, consult the documentation for your VoIP devices or
applications.
STEP 1 Click Firewall -> Application Level Gateway.
The Application Level Gateway window opens.
STEP 2 Enter the following information:
• SIP Protocol Support: SIP ALG can rewrite the information within the SIP
messages (SIP headers and SDP body) to make signaling and audio traffic
between the client behind NAT and the SIP endpoint possible. Check this
box to allow the SIP sessions to pass through the security appliance, or
uncheck this box to block the SIP sessions.
NOTE Enable SIP ALG when voice devices such as UC 500, UC 300, or SIP
phones are connected to the network behind the security appliance.
• H323 Support: H.323 is a standard teleconferencing protocol suite that
provides audio, data, and video conferencing. It allows for real-time point-to-
point and multipoint communication between client computers over a
packet-based network that does not provide a guaranteed quality of
service. Check this box to allow the H.323 sessions to pass through the
security appliance, or uncheck this box to block the H.323 sessions.
STEP 3 Click Save to apply your settings.