🚀 go-pugleaf

In article <ak6c3c$qgr$1@panix2.panix.com>,
Melinda Shore <shore@panix.com> wrote:
[sent too soon]
>>Notably, without NAT, the same problem still exists. Even if I have an 
>>organization that uses exclusively public IP's, I still have to open the 
>>firewall for the H.323 traffic, where someone could potentially install 
>>a server instead of taking their phone calls.

Firewalls really are not very good security devices for reasons
like this, which is part of the reason that I'm an advocate
for allowing authenticated, authorized endpoints to make
requests directly of a firewall and have the firewall say
"yes" or "no."  Even today there are people who are using
bogus H.323 and SIP signaling to open pinholes for them.  The 
firewall vendors are responding by 1) examining signaling
more closely, and 2) adding heuristics so that if, say, in
an H.323 call an H.245 channel is allocated but media streams
are never opened, the pinholes are closed.  All of this 
pushes up the cost and comlexity of firewalls and isn't
completely reliable.  It also forces you to send signaling
streams in the clear, which is bad with SIP and really 
terrible in H.323 (DTMF is carried in H.245 messages).  A
security model that prevents you from protecting application
traffic really isn't a very good security model.
-- 
     Melinda Shore - Software longa, hardware brevis - shore@panix.com
          If you send me harassing email, I'll probably post it