> Source: [sk14587](https://support.checkpoint.com/results/sk/sk14587)

# sk14587 - How to configure VoIP (H.323) 

| Property | Value |
|----------|-------|
| Solution ID | sk14587 |
| Date Created | 2002-09-26 |
| Last Modified | 2021-02-15 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Solution

To enable VoIP traffic, proceed as follows:   

1. Define the network objects that will be managed by the VoIP H.323 Gatekeeper. These are:   
   * a network object consisting of either IP phones or "soft phones" (computers with the appropriate software)

   <br />

   * the machine hosting the VoIP H.323 Gatekeeper

   <br />

   * the machine hosting the VoIP H.323 Gateway (optional)

<br />

<br />

1. Define the VoIP H.323 Gatekeeper. To do so:
   * From the Launch Menu, first select Manage then Network Objects.
   * On the pop-up window, click the New button.
   * Select VoIP Domains, then choose VoIP H.323 Domain Gatekeeper from the menu.

<br />

1. In the General page of the VoIP Domain Gatekeeper window, define the Gatekeeper's parameters.   

   Name - Enter the Gatekeeper's name.   

   Comment - Enter a descriptive comment to be displayed when this Gatekeeper is selected in the Object list and in the Network Objects window.   

   Color - Select the color in which this gatekeeper will be displayed in the GUI.   

   Related endpoints domain - Choose the network object that this Gatekeeper will be managing. A Gatekeeper's Related endpoints domain is one or both of the following:   
   * the IP phones connected to the Gatekeeper

   <br />

   * a Gateway.

   <br />

   <br />

   VoIP installed on - Choose the host on which this Gatekeeper is installed. If you have not yet defined the host, click New to define it.

<br />

<br />

1. In the Routing Mode page of the VoIP Domain Gatekeeper window, define object's parameters. Each conversation consists of several connections, one after the other. The first connection is between VoIP Gatekeepers.   

   Allowed Routing Mode - Specify which connections will be re-routed endpoint-to-endpoint.   

   Direct - The H.225 Q.931 connection will be re-routed endpoint-to-endpoint.   

   Call Setup (Q.931) - The H.245 connection will be re-routed endpoint-to-endpoint.   

   Call Setup (Q.931) and Call Control (H.245) - The RTP/RTCP connections (audio, video and their associated control connections) will be re-routed endpoint-to-endpoint. At least one of the choices must be checked.   

   VoIP H.323 Gateway - (Optional)

<br />

<br />

1. Define the VoIP H.323 Gateway. To do so:
   * From the Launch Menu, first select Manage then Network Objects.
   * On the pop-up window, click the New button.
   * Select VoIP Domains, then choose VoIP H.323 Domain Gateway from the menu.

<br />

1. In the General page of the VoIP Domain Gateway window, define the Gateway's parameters.   

   Name - Enter the Gateway's name.   

   Comment - Enter a descriptive comment to be displayed when this Gateway is selected in the Object list and in the Network Objects window.   

   Color - Select the color in which this Gateway will be displayed in the GUI.   

   Related endpoints domain --- Choose the network object that this Gateway will be managing. If each of host's interfaces is dedicated to carrying a different H.323 protocol, then each interface must be defined as a separate network object. The interfaces are then chained using Related endpoints domain.   

   For example, if the host's interfaces are A, B and C, then the chaining is as follows:   

   Interface: A   
   Protocol: H.225   
   Related Endpoints Domain: B   

   <br />

   Interface: B   
   Protocol: H.245   
   Related Endpoints Domain: C   

   <br />

   Interface: C   
   Protocol: RTP/RTCP   
   Related Endpoints Domain: host   

   If B is in A's Related endpoints domain but also functions as a redirecting entity, it should be defined as a VoIP Gateway.   

   VoIP installed on - Choose the host on which this Gateway is installed. If you have not yet defined the host, click New to define it.

<br />

<br />

1. In the Routing Mode page of the VoIP Domain Gateway window, define object's parameters. Each conversation consists of several connections, one after the other. The first connection is between VoIP Gatekeepers.   

   Allowed Routing Mode - Specify which connections will be re-routed endpoint-to-endpoint.   

   Call Setup (Q.931) - The H.245 connection will be re-routed endpoint-to-endpoint.   

   Call Setup (Q.931) and Call Control (H.245) - The RTP/RTCP connections (audio, video and their associated control connections) will be re-routed endpoint-to-endpoint. At least one of the choices must be checked.

<br />

<br />

1. In the Global Properties window \> Log and Alert section, define the VoIP parameters.   

   Log VoIP connection - If checked, additional log entries will be generated for every VoIP connection. The additional log entries contain information about the phone numbers (H.323).   

   <br />

2. In the H.323 protection, change the following parameters under the IPS protections.  
   IPS \> By Protocol \> H.323 \> Edit.   
   - Allow to re-direct connections - Allow conversations to be handed over on both sides.   
   - Disallow blank source phone numbers - Do not accept connections in which the source phone number is blank. - Enable dynamic T.120 - T.120 is application-sharing file transfer. Security Policy Rule Base  

<br />

1. For H.323-based VoIP, define one of the following rules in the Security Policy Rule base. Either:   

   Rule A:   
   Source: VoIP Domain   
   Destination: VoIP Domain   
   Service: H323_ras   
   Action: Accept   

   OR   

   Rule A:   
   Source: host   
   Destination: host   
   Service: H323_ras_only   
   Action: Accept   

   Rule B:   
   Source: endpoint domain   
   Destination: endpoint domain   
   Service: H323   
   Action: Accept   

   Where host is the machine on which the VOIP Domain Gatekeeper is installed. The H323_ras_only service includes only the RAS part of H.323 (without handover), so the second rule allows the conversation.

**Related solutions:**

* [sk95369 - ATRG: VoIP](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk95369)

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content