2

Selecting Permit non-SIP packets on signaling port enables applications such as Apple iChat and MSN Messenger, which use the SIP signaling port for additional proprietary messages. This checkbox is disabled by default.

3

If the SIP Proxy Server is being used as a B2BUA, enable the Enable SIP Back-to-Back User Agent (B2BUA) support setting. This option is disabled by default and should be enabled only when the firewall can see both legs of a voice call (for example, when a phone on the LAN calls another phone on the LAN).

4

Use the SIP Signaling inactivity time out (seconds) and SIP Media inactivity time out (seconds) options to define the amount of time a call can be idle (no traffic exchanged) before the firewall blocks further traffic. A call goes idle when placed on hold. The default time value for:

5

Use the Additional SIP signaling port (UDP) for transformations setting to specify a non-standard UDP port to carry SIP signaling traffic. Normally, SIP signaling traffic is carried on UDP port 5060. However, a number of commercial VOIP services use different ports, such as 1560. When this setting is non zero (0, the default), the security appliance performs SIP transformation on these non-standard ports.

6

Click Accept.

2

Select Only accept incoming calls from Gatekeeper to ensure all incoming calls go through the Gatekeeper for authentication. The Gatekeeper refuses calls that fail authentication.

3

In the H.323 Signaling/Media inactivity time out (seconds) field, specify the amount of time a call can be idle before the firewall blocks further traffic. A call goes idle when placed on hold. The default time is 300 seconds (5 minutes).

4

The Default WAN/DMZ Gatekeeper IP Address field has a default value of 0.0.0.0. Enter the default H.323 Gatekeeper IP address in this field to allow LAN-based H.323 devices to discover the Gatekeeper using the multicast address 225.0.1.41. If you do not enter an IP address, multicast discovery messages from LAN-based H.323 devices go through the configured multicast handling.

5

Click Accept.

2

For View Style, click All Rules.

3

Click the Add button. The Add Rule dialog displays.

4

In the General tab, select Allow from the Action list to permit traffic.

5

Select the from and to zones from the From Zone and To Zone drop-down menus.

6

Select the service or group of services affected by the access rule from the Service drop-down menu.

7

Select the source of the traffic affected by the access rule from the Source drop-down menu. Selecting Create New Network displays the Add Address Object dialog.

8

If you want to define the source IP addresses that are affected by the access rule, such as restricting certain users from accessing the Internet, select Range in the Type: drop-down menu.

9

Select the destination of the traffic affected by the access rule from the Destination drop-down menu. Selecting Create New Network displays the Add Address Object dialog.

10

From the Users Allowed drop-down menu, add the user or user group affected by the access rule.

11

Select a schedule from the Schedule drop-down menu if you want to allow VoIP access only during specified times. The default schedule is Always on. You can specify schedule objects on the System > Schedules page.

12

Enter any comments to help identify the access rule in the Comments field.

13

Click the Bandwidth tab.

14

Select Bandwidth Management, and enter the Guaranteed Bandwidth in Kbps.

15

Enter the maximum amount of bandwidth available to the Rule at any time in the Maximum Bandwidth field.

16

Assign a priority from 0 (highest) to 7 (lowest) in the Bandwidth Priority drop-down menu. For higher VoIP call quality, ensure VoIP traffic receives HIGH priority.

17

Click Add.