FIREWALL INTERFACE CONFIGURATION TO ENABLE BI-DIRECTIONAL VOIP TRAVERSAL COMMUNICATIONS

• US 20170063803A1
• Filed: 10/26/2016
• Published: 03/02/2017
• Est. Priority Date: 09/20/2002
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Xie, Michael
• Granted Patent: US 9,860,215 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 61/2521 Translation architectures other than single NAT servers
• CPC Class Codes: H04L 61/4535 using an address exchange platform which sets up a session between two nodes, e.g. rendezvous servers, session initiation protocols [SIP] registrars or H.323 gatekeepers
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 65/1043 Gateway controllers, e.g. media gateway control protocol [MGCP] controllers
• CPC Class Codes: H04L 65/1066 Session management
• CPC Class Codes: H04L 65/1101 Session protocols
• CPC Class Codes: H04L 65/1104 Session initiation protocol [SIP]
• CPC Class Codes: H04L 65/1106 Call signalling protocols; H.323 and related
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

Methods and systems for an intelligent network protection gateway (NPG) and network architecture are provided. According to one embodiment, a firewall provides network-layer protection to hosts of a private network against unauthorized access by hosts of an external network by performing network address translation (NAT) processing of Internet Protocol (IP) addresses. The firewall also provides application-layer protection on behalf of the hosts and supports Voice over IP (VoIP) services by processing signaling protocols associated with VoIP sessions. An external VoIP interface of the firewall receives incoming VoIP packets each associated with a VoIP port of the external interface. The packets are directed to an appropriate host by the firewall performing port address forwarding based on a mapping of VoIP ports to private addresses of the hosts.

Claims

1. A method comprising:

providing, by a firewall interposed between a private network and an external network, network-layer protection against unauthorized access by external hosts associated with the external network to a plurality of hosts associated with the private network by performing network address translation (NAT) processing of Internet Protocol (IP) addresses associated with the plurality of hosts;

providing, by the firewall, application-layer protection from the external network on behalf of the plurality of hosts and supporting Voice over IP (VoIP) services by processing signaling protocols associated with VoIP sessions, including

distinguishing among VoIP packets and non-VoIP packets,

parsing the VoIP packets, and

enabling bi-directional VoIP communications among one or more of the plurality of hosts and one or more of the external hosts by performing content-aware NAT, including changing data in headers of the VoIP packets and also changing data contents in the VoIP packets corresponding to the data changed in the headers;

receiving, by an external VoIP interface of the firewall, a plurality of incoming VoIP packets each being associated with one of a plurality of VoIP ports;

causing each of the plurality of incoming VoIP packets to be directed to an appropriate host of the plurality of hosts by performing by the firewall port address forwarding based on a mapping of the plurality of VoIP ports to corresponding private addresses of the plurality of hosts.

2. The method of claim 1 wherein the firewall comprises an intelligent network protocol gateway.

3. The method of claim 1, wherein said changing data in headers of the VoIP packets further comprises changing a source IP address and a port number in the headers of the VoIP packets.

4. The method of claim 1, wherein said distinguishing among VoIP packets and non-VoIP packets is based on a standard port address.

5. The method of claim 1, further comprising conducting through the external VoIP interface a network meeting between an external network user and at least two network users associated with the private network.

6. The method of claim 1, further comprising conducting through the external VoIP interface a network meeting between a user associated with the private network and at least two external network users.

7. The method of claim 1, further comprising implementing said firewall as an application specific integrated circuit (ASIC).

8. An intelligent network protection gateway device comprising:

a network address translation (NAT) processing means, configured to be interposed between a private network and an external network, for providing network-layer protection against unauthorized access by external hosts associated with the external network to a plurality of hosts associated with the private network by performing translation of Internet Protocol (IP) addresses associated with the plurality of hosts;

an application-layer protection means, for protecting the plurality of host from the external network and for supporting Voice over IP (VoIP) services by processing signaling protocols associated with VoIP sessions, including

distinguishing among VoIP packets and non-VoIP packets,

parsing the VoIP packets within the application-layer protection means, and

enabling, by the application-layer protection means, bi-directional VoIP communications among one or more of the plurality of hosts and one or more of the external hosts by performing content-aware NAT, including changing data in headers of the VoIP packets and also changing data contents in the VoIP packets corresponding to the data changed in the headers;

an external VoIP interface including a plurality of VoIP ports configured to receive incoming VoIP packets each associated with one of the plurality of VoIP ports;

wherein said external VoIP interface further comprises a means for directing the incoming VoIP packets to an appropriate host of the plurality of hosts by performing port address forwarding based on a mapping of the plurality of VoIP ports to private addresses of the plurality of hosts;

wherein one or more of said NAT processing means and said application-layer protection means includes (i) logic implemented within an application specific integrated circuit (ASIC) of the intelligent network protection gateway device or (ii) a program storage device readable by one or more processors of the intelligent network protection gateway device, embodying a program of instructions executable by the one or more processors.

9. The intelligent network protection gateway device of claim 8 wherein the mapping maps an e-mail address included in an incoming VoIP message to an internal port number in the private network.

10. The network protection gateway device of claim 8, wherein said distinguishing among VoIP packets and non-VoIP packets is based on a standard port address.

11. The network protection gateway device of claim 8, wherein the external VoIP interface facilitates network meetings among an external network user and at least two users associated with the private network.

12. The network protection gateway device of claim 8, wherein the external VoIP interface facilitates network meetings among a user of the private network and at least two external network users.

13. An intelligent network protection firewall comprising:

a firewall logically interposed between a private network and an external network and to provide network-layer protection against unauthorized access by external hosts associated with the external network to a plurality of hosts associated with the private network by performing network address translation (NAT) processing of Internet Protocol (IP) addresses associated with the plurality of hosts, the firewall providing application-layer protection from the external network on behalf of the plurality of hosts and supporting Voice over IP (VoIP) services by actively processing signaling protocols associated with VoIP sessions, including;

distinguishing among VoIP packets and non-VoIP packets,

parsing the VoIP packets within an operating system kernel of the firewall, and

performing content-aware NAT within the firewall by changing data in headers of the VoIP packets and also changing data contents in the VoIP packets corresponding to the data changed in the headers to enable bi-directional VoIP communications among one or more of the plurality of hosts and one or more of the external hosts;

the firewall comprising a plurality of VoIP ports coupled to an external VoIP interface of the firewall, the external VoIP interface (i) receiving incoming VoIP packets each associated with one of the plurality of VoIP ports and (ii) directing the incoming VoIP packets to a host of the plurality of hosts by performing port address forwarding based on a mapping of the plurality of VoIP ports to private addresses of the plurality of hosts.

14. The intelligent network protection firewall of claim 13, wherein the firewall distinguishes among the VoIP packets and the non-VoIP packets based on a standard port address.

15. The intelligent network protection firewall of claim 13, wherein the external VoIP interface facilitates network meetings among an external network user and at least two users associated with the private network.

16. The intelligent network protection firewall of claim 13, wherein the external VoIP interface facilitates network meetings among a user associated with the private network and at least two external network users.