Firewall interface configuration and processes to enable bi-directional VoIP traversal communications

• US 20040059942A1
• Filed: 09/20/2002
• Published: 03/25/2004
• Est. Priority Date: 09/20/2002
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Xie, Michael
• Granted Patent: US 7,716,725 B2
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: H04L 61/2521 Translation architectures other than single NAT servers
• CPC Class Codes: H04L 61/4535 using an address exchange platform which sets up a session between two nodes, e.g. rendezvous servers, session initiation protocols [SIP] registrars or H.323 gatekeepers
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 65/1043 Gateway controllers, e.g. media gateway control protocol [MGCP] controllers
• CPC Class Codes: H04L 65/1066 Session management
• CPC Class Codes: H04L 65/1101 Session protocols
• CPC Class Codes: H04L 65/1104 Session initiation protocol [SIP]
• CPC Class Codes: H04L 65/1106 Call signalling protocols; H.323 and related
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

A firewall for interfaced between an internal and an external networks. The firewall includes a VoIP processor for detecting an outgoing VoIP packet sent from the internal network for changing data in a header of the VoIP packet and also changing data contents in the VoIP packet corresponding to data changed in the header to enable a bi-directional VoIP communication. In a preferred embodiment, the VoIP processor changes a source IP address and a port number in the header of the VoIP packet and also changes the data contents in the VoIP packet corresponding to the source IP address and the port number changed in the header to enable a bi-directional VoIP communication. In another preferred embodiment, the firewall further includes an external VoIP interface comprising a plurality of VoIP ports for receiving multiple incoming VoIP packets each designated with one of the VoIP ports. And, the VoIP processor further includes a VoIP port versus internal address table for identifying an internal address in the internal network for directing each of the incoming VoIP packets to the internal address identified.

Claims

1. A firewall for interfacing between an internal and an external networks comprising:

a VoIP processing means for detecting an outgoing VoIP packet sent from said internal network for changing data in a header of said VoIP packet and also changing data contents in said VoIP packet corresponding to data changed in said header to enable a bi-directional VoIP communication.

2. The firewall of claim 1 wherein:

said VoIP processing means changing a source IP address and a port number in said header of said VoIP packet and also changing said data contents in said VoIP packet corresponding to said source IP address and said port number as that changed in said header to enable a bi-directional VoIP communication.

3. The firewall of claim 1 further comprising:

an external VoIP interface comprising a plurality of VoIP ports for receiving multiple incoming VoIP packets each designated with one of said VoIP ports; and

said VoIP process means further comprising a VoIP port versus internal address table for identifying an internal address in said internal network for directing each of said incoming VoIP packets to said internal address identified.

4. The firewall of claim 1 wherein:

said firewall is an application aware firewall provided for detecting said outgoing VoIP packet.

5. The firewall of claim 1 wherein:

said firewall is an application aware firewall provided for detecting said outgoing VoIP packet based on a standard port address.

6. The firewall of claim 1 further comprising:

an external VoIP interface for mapping an e-mail address included in an incoming VoIP message to an internal port number in said internal network.

7. The firewall of claim 1 further comprising:

an external VoIP interface for coordinating with said VoIP processing means for conducting a network meeting between an external network user and at least two internal network users.

8. The firewall of claim 1 further comprising:

an external VoIP interface for coordinating with said VoIP processing means for conducting a network meeting between an internal network user and at least two external network users.

18. The method of claim 1 further comprising:

conducting a network meeting between an internal network user and at least two external network users.

9. A network protection gateway device comprising:

an application awareness means for recognizing a VoIP message and a VoIP processing means for parsing and processing said VoIP message for enabling a protected bi-direction VoIP communication.

10. The network protection gateway device of claim 9 further comprising:

an application specific integrated circuit (ASIC) for implementing said network protection gateway therein.

11. A method for transmitting a VoIP packet from an internal network through a firewall to an external network comprising a step of:

detecting an outgoing VoIP packet sent from said internal network for changing data in a header of said VoIP packet and also changing data contents in said VoIP packet corresponding to data changed in said header to enable a bi-directional VoIP communication.

12. The method of claim 11 wherein:

said step of changing said data in said header of said VoIP packet comprising a step of changing a source IP address and a port number in said header of said VoIP packet and said step of changing said data contents in said VoIP packet further comprising a step of changing said data contents in said VoIP packet corresponding to said source IP address and said port number changed in said header to enable a bi-directional VoIP communication.

13. The method of claim 11 further comprising:

providing a plurality of VoIP ports to an external VoIP interface for receiving multiple incoming VoIP packets each designated with one of said VoIP ports; and

identifying an internal address in said internal network corresponding to said VoIP port designated in each of said incoming VoIP packets for directing each of said incoming VoIP packets to said internal address identified.

14. The method of claim 11 further comprising a step of:

configuring said firewall as an application aware firewall for detecting said outgoing VoIP packet.

15. The method of claim 11 further comprising a step of:

configuring said firewall as an VoIP-aware firewall for detecting said outgoing VoIP packet based on a standard port address.

16. The method of claim 11 further comprising:

mapping an e-mail address included in an incoming VoIP message to an internal port number in said internal network.

17. The method of claim 11 further comprising:

conducting a network meeting between an external network user and at least two internal network users.

19. A method for configuring a network protection gateway (NPG) device comprising:

providing an application awareness means in said NPG for recognizing a VoIP message and a means for parsing and processing said VoIP message for enabling a protected bi-direction VoIP communication.

20. The method of claim 19 further comprising:

implementing said NPG as an application specific integrated circuit (ASIC).