ALG—H.323 vTCP with High Availability Support for Firewall and NAT
The ALG—H.323 vTCP with High Availability Support for Firewall and NAT feature enhances the H.323 application-level gateway (ALG) to support a TCP segment that is not a single H.323 message. Virtual TCP (vTCP) supports TCP segment reassembly. Prior to this introduction of the feature, the H.323 ALG processed a TCP segment only if it was a complete H.323 message. If the TCP segment was more than one message, the H.323 ALG ignored the TCP segment and the packet was passed without processing.
This module describes how to configure the ALG—H.323 vTCP with high availability (HA) support for firewalls.
Your software release
may not support all the features documented in this module. For the latest
caveats and feature information, see
Bug Search Tool and the
release notes for your platform and software release. To find information about
the features documented in this module, and to see a list of the releases in
which each feature is supported, see the feature information table.
Use Cisco Feature
Navigator to find information about platform support and Cisco software image
support. To access Cisco Feature Navigator, go to
An account on Cisco.com is not required.
Restrictions for ALG—H.323 vTCP with High Availability Support for Firewall and NAT
When an incoming TCP segment is not a complete H.323 message, the H.323 ALG buffers the TCP segment while waiting for the rest of the message. The buffered data is not synchronized to the standby device for high availability (HA).
The performance of the H.323 ALG may get impacted when vTCP starts to buffer data.
Information About ALG—H.323 vTCP with High Availability Support for Firewall and NAT
gateway (ALG), also known as an application-layer gateway, is an application
that translates the IP address information inside the payload of an application
packet. An ALG is used to interpret the application-layer protocol and perform
firewall and Network Address Translation (NAT) actions. These actions can be
one or more of the following depending on your configuration of the firewall
applications to use dynamic TCP or UDP ports to communicate with the server
application-specific commands and offer granular security control over them.
multiple streams or sessions of data between two hosts that are exchanging
network-layer address information that is available in the application payload.
The firewall opens a
pinhole, and NAT performs translation service on any TCP or UDP traffic that
does not carry the source and destination IP addresses in the application-layer
data stream. Specific protocols or applications that embed IP address
information require the support of an ALG.
Basic H.323 ALG Support
H.323 is a recommendation published by the ITU-T defining a series of network elements and protocols for multimedia transmission through packet-based networks. H.323 defines a number of network elements used in multimedia transmission.
Although most H.323 implementations today utilize TCP as the transport mechanism for signaling, H.323 Version 2 enables basic UDP transport.
H.323 Terminal—This element is an endpoint in the network, providing two-way communication with another H.323 terminal or gateway.
H.323 Gateway—This element provides protocol conversion between H.323 terminals and other terminals that do not support H.323.
H.323 Gatekeeper—This element provides services like address translation, network access control, and bandwidth management and account for H.323 terminals and gateways.
The following core protocols are described by the H.323 specification:
H.225—This protocol describes call signaling methods used between any two H.323 entities to establish communication.
H.225 Registration, Admission, and Status (RAS)—This protocol is used by the H.323 endpoint and gateway for address resolution and admission control services.
H.245—This protocol is used for exchanging the capabilities of multimedia communication and for the opening and closing of logical channels for audio, video, and data.
In addition to the protocols listed, the H.323 specification describes the use of various IETF protocols like the Real Time Transport (RTP) protocol and audio (G.711, G.729, and so on) and video (H.261, H.263, and H.264) codecs.
NAT requires a variety of ALGs to handle Layer 7 protocol-specific services such as translating embedded IP addresses and port numbers in the packet payload and extracting new connection/session information from control channels. The H.323 ALG performs these specific services for H.323 messages.
Overview of vTCP for ALG Support
When a Layer 7 protocol uses TCP for transportation, the TCP payload can be segmented due to various reasons, such as application design, maximum segment size (MSS), TCP window size, and so on. The application-level gateways (ALGs) that the firewall and NAT support do not have the capability to recognize TCP fragments for packet inspection. vTCP is a general framework that ALGs use to understand TCP segments and to parse the TCP payload.
vTCP helps applications like NAT and Session Initiation Protocol (SIP) that require the entire TCP payload to rewrite the embedded data. The firewall uses vTCP to help ALGs support data splitting between packets.
When you configure firewall and NAT ALGs, the vTCP functionality is activated.
vTCP currently supports Real Time Streaming Protocol (RTSP) and DNS ALGs.
TCP Acknowledgment and Reliable Transmission
Because vTCP resides between two TCP hosts, a buffer space is required to store TCP segments temporarily, before they are sent to other hosts. vTCP ensures that data transmission occurs properly between hosts. vTCP sends a TCP acknowledgment (ACK) to the sending host if vTCP requires more data for data transmission. vTCP also keeps track of the ACKs sent by the receiving host from the beginning of the TCP flow to closely monitor the acknowledged data.
vTCP reassembles TCP segments. The IP header and the TCP header information of the incoming segments are saved in the vTCP buffer for reliable transmission.
vTCP can make minor changes in the length of outgoing segments for NAT-enabled applications. vTCP can either squeeze the additional length of data to the last segment or create a new segment to carry the extra data. The IP header or the TCP header content of the newly created segment is derived from the original incoming segment. The total length of the IP header and the TCP header sequence numbers are adjusted accordingly.
vTCP with NAT and Firewall ALGs
ALG is a subcomponent of NAT and the firewall. Both NAT and the firewall have a framework to dynamically couple their ALGs. When the firewall performs a Layer 7 inspection or NAT performs a Layer 7 fix-up, the parser function registered by the ALGs is called and ALGs take over the packet inspection. vTCP mediates between NAT and the firewall and the ALGs that use these applications. In other words, packets are first processed by vTCP and then passed on to ALGs. vTCP reassembles the TCP segments in both directions within a TCP connection.
Overview of ALG—H.323 vTCP with High Availability Support
The ALG-H.323 vTCP with High Availability Support for Firewall and NAT feature enhances the H.323 application-level gateway (ALG) to support a TCP segment that is not a single H.323 message. After the H.323 ALG is coupled with vTCP, the firewall and NAT interact with the H.323 ALG through vTCP. When vTCP starts to buffer data, the high availability (HA) function is impacted, because vTCP cannot synchronize the buffered data to a standby device. If the switchover to the standby device happens when vTCP is buffering data, the connection may be reset if the buffered data is not synchronized to the standby device. After the buffered data is acknowledged by vTCP, the data is lost and the connection is reset. The firewall and NAT synchronize the data for HA. vTCP only synchronizes the status of the current connection to the standby device, and in case of errors, the connection is reset.
How to Configure ALG—H.323 vTCP with High Availability Support for Firewall and NAT
Configuring ALG-H.323 vTCP with High Availability Support for NAT
4.ip nat inside
7.ip nat outside
9.ip nat pool
pool-name start-ip end-ip
Defines a standard IP access list and permits access to packets if conditions are matched.
Exits global configuration mode and enters privileged EXEC mode.
The following is sample output from the
show ip nat statistics
Device# show ip nat statistics
Total active translations: 2 (0 static, 2 dynamic; 1 extended)
Hits: 0 Misses: 25
CEF Translated packets: 0, CEF Punted packets: 0
Expired translations: 0
-- Inside Source
[Id: 1] access-list 1 pool pool1 refcount 2
pool pool1: netmask 255.255.255.0
start 10.1.1.10 end 10.1.1.100
type generic, total addresses 91, allocated 1 (1%), misses 0
max entry: max allowed 0, used 0, missed 0
Pool stats drop: 0 Mapping stats drop: 0
Port block alloc fail: 0
IP alias add fail: 0
Limit entry add fail: 0
The following is sample output from the
show ip nat translations
Device# show ip nat translations
Pro Inside global Inside local Outside local Outside global
--- 10.1.1.10 10.2.1.2 --- ---
udp 10.1.1.10:75 10.2.1.2:75 10.1.1.1:69 10.1.1.1:69
Total number of translations: 2
Configuration Examples for ALG—H.323 vTCP with High Availability Support for Firewall and NAT
Example: Configuring ALG-H.323 vTCP with High Availability Support for NAT
Device# configure terminal
Device(config)# interface gigabitethernet 0/0/1
Device(config-if)# ip nat inside
Device(config)# interface gigabitethernet 0/1/1
Device(config-if)# ip nat outside
Device(config)# ip nat pool pool1 10.1.1.10 10.1.1.100 prefix-length 24
Device(config)# ip nat inside source list pool pool1
Device(config)# access-list 1 permit 10.0.0.0 255.255.255.0
Additional References for ALG-H.323 vTCP with High Availability Support for Firewall and NAT
The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.
Feature Information for ALG—H.323 vTCP with High Availability Support for Firewall and NAT
The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to
www.cisco.com/go/cfn. An account on Cisco.com is not required.
Table 1 Feature Information for ALG—H.323 vTCP with High Availability Support for Firewall and NAT
ALG—H.323 vTCP with High Availability Support for Firewall and NAT
Cisco IOS XE Release 3.7S
The ALG—H.323 vTCP with High Availability Support for Firewall and NAT feature enhances the H.323 ALG to support a TCP segment that is not a single H.323 message. vTCP supports segment reassembly. Prior to the introduction of this feature, the H.323 ALG processed a TCP segment only if it was a complete H.323 message. If the TCP segment was more than one message, the H.323 ALG ignored the TCP segment and the packet was passed without processing.