Internet Security Appliance User's Guide

Chapter 30 ALG Screen
ZyWALL 5/35/70 Series User’s Guide
533
• You must configure the firewall and port forwarding to allow incoming (peer-to-peer)
calls from the WAN to a private IP address on the LAN, DMZ or WLAN. The following
example shows H.323 signaling (1) and audio (2) sessions between H.323 devices A and
B.
Figure 317 H.323 ALG Example
• With multiple WAN IP addresses on the ZyWALL, you can configure different firewall
and port forwarding rules to allow incoming calls from each WAN IP address to go to a
specific IP address on the LAN, DMZ or WLAN. Use policy routing to have the H.323
calls from each of those LAN, DMZ or WLAN IP addresses go out through the same
WAN IP address that calls come in on. The policy routing lets the ZyWALL correctly
forward the return traffic for the calls initiated from the LAN IP addresses.
For example, you configure firewall and port forwarding rules to allow LAN IP address A
to receive calls through public WAN IP address 1. You configure different firewall and
port forwarding rules to allow LAN IP address B to receive calls through public WAN IP
address 2. You configure corresponding policy routes to have calls from LAN IP address
A go out through WAN IP address 1 and calls from LAN IP address B go out through
WAN IP address 2.
Figure 318 H.323 with Multiple WAN IP Addresses
• When you configure the firewall and port forwarding to allow calls from the WAN to a
specific IP address on the LAN, you can also use policy routing to have H.323 calls from
other LAN, DMZ or WLAN IP addresses go out through a different WAN IP address. The
policy routing lets the ZyWALL correctly forward the return traffic for the calls initiated
from the LAN, DMZ or WLAN IP addresses.
For example, you configure the firewall and port forwarding to allow LAN IP address A to
receive calls from the Internet through WAN IP address 1. You also use a policy route to
have LAN IP address A make calls out through WAN IP address 1. Configure another
policy route to have H.323 calls from LAN IP addresses B and C go out through WAN IP
address 2. Even though only LAN IP address A can receive incoming calls from the
Internet, LAN IP addresses B and C can still make calls out to the Internet.