H.323

The H.323 standard stipulates the components, protocols, and procedures that provide multimedia communication services (audio, video, and data) over IP-based networks. Four kinds of H.323 components provide point-to-point and point-to-multipoint multimedia communication services:

• Terminals— Endpoints on the network that provide real-time two-way communications. For example, Cisco IP Phones.

• Gateways— Provide translation between circuit-switched networks and packet-based networks, enabling the endpoints to communicate.

• Gatekeepers— Responsible for call control and routing services to H.323 endpoints, system management, and some security policies.

• Multipoint control units (MCUs)— Maintain all the audio, video, data, and control streams between all the participants in the conference.

Figure 8-7 shows a basic network topology that illustrates the components of H.323.

Figure 8-7. H.323 Components

[View full size image]

H.323 Protocol Suite

Figure 8-8 illustrates the H.323 protocol suite:

• The G.7xx components are audio codecs.

• The H.26x components are video codecs. The standard is H.261.

  Audio and video components sit on top of the Real-Time Transport Protocol (RTP).

• The T.12x protocols are used in real-time exchange of data. One example is an online whiteboard application.

Figure 8-8. H.323 Protocols

[View full size image]

In Figure 8-8, the protocols are illustrated in relation to the respective OSI layers.

The H.323 suite of protocols may use up to two TCP connections and four to six UDP connections:

• RTP uses the Real-Time Transport Control Protocol (RTCP) to control and synchronize streaming audio and video. It allows the application to adapt the flow to specific network conditions.

• Terminals and gatekeepers use Registration, Admission, and Status (RAS) Protocol to exchange information about call registrations, admissions, and terminations. This protocol communicates over UDP.

  Note

  The FastConnect H.323 feature uses only one TCP connection, and RAS uses UDP requests and responses for registration, admissions, and status.

  
  

• H.225 is a protocol used to establish connections between two terminals. It runs over TCP.

• H.245 is a protocol used between two terminals to exchange control messages. These messages include flow control and channel management commands.

• Clients may request a Q.931 call setup over TCP port 1720 to H.323 servers. During the call setup process, the H.323 terminal provides the TCP port number for the client to use for an H.245 connection.

  Note

  The initial packet is transmitted over UDP if H.323 gatekeepers are used.

  
  

• The Cisco ASA can monitor the Q.931 TCP connection to determine the H.245 port number. It dynamically allocates the H.245 connection based on the inspection of the H.225 messages if FastConnect is not used.

• The terminals negotiate the port numbers to be used for subsequent UDP streams within each H.245 message. The Cisco ASA also monitors the H.245 messages to know about these ports and to create the necessary connections.

The following are the key TCP and UDP ports in H.323 inspection:

• Gatekeeper discovery— UDP port 1718

• RAS— UDP port 1719

• Control port— TCP port 1720

H.323 Version Compatibility

Cisco ASA is compatible with H.323 versions 1, 2, 3, and 4. Figure 8-9 and Figure 8-10 show a major difference between older versions of H.323 and H.323v3 and higher.

Figure 8-9. Call Setup Pre-H.323v3

[View full size image]

Figure 8-10. H.323v3 Call Setup Features

[View full size image]

H.323v3 and higher supports multiple calls on one signaling connection. It accomplishes this by examining the call reference value (CRV) within the Q.931 message, as shown in Figure 8-10. This results in reduced call setup and clearing times.

Enabling H.323 Inspection

To enable H.323 inspection for H.225, use the inspect h323 h225 command. For RAS, use the inspect h323 ras command. Example 8-11 shows both commands.

Example 8-11. H.323 Inspection Commands

policy-map asa_global_fw_policy

 class inspection_default

  inspect h323 h225

  inspect h323 ras

The Cisco ASA can translate the necessary embedded IP addresses in the H.225 and H.245 packets. It also can translate H.323 connections. It uses an ASN.1 decoder to decode the H.323 Packet Encoding Rules (PER) encoded messages. The Cisco ASA also dynamically allocates the negotiated H.245, RTP, and RTCP sessions.

Additionally, the Cisco ASA analyses the TPDU Packet (TPKT) header to define the length of the H.323 messages. In H.323, Q.931 messages are exchanged over a TCP stream demarcated by TPKT encapsulations. It maintains a data structure for each connection also containing the TPKT length for the following H.323 messages.

Direct Call Signaling and Gatekeeper Routed Control Signaling

Two control-signaling methods are defined in the ITU-T H.323 recommendation:

• Direct Call Signaling (DCS)

• Gatekeeper Routed Control Signaling (GKRCS)

Cisco ASA supports both methods. The Cisco ASA inspects DSC and GKRCS to ensure that the negotiation messages and correct fields are transferred between the respective devices. GKRCS inspection is done when H.323 inspection is enabled in the Cisco ASA. No additional configuration is needed.

T.38

T.38 is the protocol used with Fax over IP (FoIP). This protocol is part of the ITU-T H.323 VoIP architecture. Cisco ASA supports inspection of this protocol. Because T.38 is a part of the H.323 protocol, inspection will be done if H.323 inspection is enabled on the Cisco ASA. No additional configuration is needed.