Eyeball Any-Firewall™ Technology VoIP, video telephony, and the industry’s highest call completion rate www.eyeball.com Copyright 2005 Seamless VoIP and Video Telephony Internet-based VoIP and video telephony is poised for phenomenal growth in both consumer and enterprise markets. VoIP and video telephony services provide the following advantages over traditional PSTN systems: • Richer communication experience using voice, video, presence, and text • Robust feature set, including 3-way calls, call hold, call transfer, click-to-call, unified messaging etc. • Mobility - seamless access of unified service from anywhere, anytime • Potentially higher voice quality compared to PSTN • Better price Communication features such as voice calls, video calls, unified messaging, video conferencing and collaboration may be accessed from broadband or Wi-Fi phones, PCs, PDAs, mobile handsets, set-top-boxes or enterprise-class dedicated video conference endpoints. The widespread use of the Internet has spurred the growth of VoIP and video telephony services. Data transmission for voice and video between computers on the Internet is problematic, to say the least, as most end-points are protected by firewalls and other security aids. Firewalls block incoming packets from unknown sources and prevent reliable, on-the-fly communications. Since not all incoming calls can be from known, pre-established calling parties – a means to ensure successful calls given the realities of the Internet must be implemented. A critical issue for VoIP and video telephony communications is whether data packets can traverse NATs, firewalls, and proxies and connect callers using different firewall products and configurations, with zero intervention required by the calling parties. Regardless of the reason, calls blocked by firewalls translate into subscriber frustration, increased support costs, subscriber churn, and missed revenue opportunities. Unlike expensive, labor-intensive, and/or modest technical workarounds that often fail to work with all standard firewalls, or deliver a reliable call completion rate, Eyeball Networks’ exclusive Any-Firewall™ Technology provides the industry’s highest call completion rate regardless of firewalls traversed by all parties in a call. Any-Firewall™ Technology ensures that Internet calls can effectively traverse through firewalls, NAT (Network Address Translation), PAT (Port Address Translation), and proxy configurations without subscriber interaction or firewall reconfiguration. Critical advantages of Any-Firewall™ Technology include: □ Delivers the industry’s highest call completion rate □ Voice and video calls are completed regardless of the firewall product and network connection being used □ Interoperable with all standard firewall, NAT, PAT, and proxy products □ Connects callers even if they are using different firewall products (as well as modems, routers, proxies, NATs and PATs) □ Does not require any specific port or ports to remain open (a serious security breach), nor does it require any other firewall modifications Page 2 Eyeball Any-Firewall™ Technology □ Is fully compatible with IETF standards and drafts, including STUN, TURN and ICE as well as HTTP tunneling, each of which provide a limited means of enabling call completion □ Has been successfully tested against a complete range of NATs, firewalls, and proxies □ Requires no knowledge of firewalls □ Makes anywhere, any time VoIP and video telephony calling a reality Firewalls, IP Addresses, and Voice/Video Telephony Firewalls Firewalls protect computers and networks from intruders and potentially harmful network traffic. Firewalls typically sit at the border between one computer network and another, or, in the case of personal firewall products, they protect individual computers from harm. Although there are several different types of firewalls, the most common one is based on "packet filtering". This type of firewall examines network traffic at the packet level, deciding whether or not to let the packet enter or leave a network. If a packet passes a firewall's pre-defined filtering rules, it is forwarded on to its intended destination. If it doesn’t pass, the packet is simply discarded. Firewalls play a key role in voice/video telephony because of their ability to block data packets and because they can make changes to the IP addresses and port numbers contained in those packets. Global vs. Virtual IP Addresses Every computer connected to the Internet is assigned an IP address so that it can be uniquely identified. IP addresses are normally “global”, meaning that the address can be understood by any other computer on the Internet. However, on local area networks, or LANs, organizations may choose to use private, or virtual, IP addresses. Virtual IP addresses are not global, and can only be understood by other computers and components attached to the same LAN. Virtual IP addresses help alleviate the growing problem of insufficient IP address spaces to meet demand. Virtual IP addresses are important to Internet-based communications because connection problems can arise when one or more users in a session are using a virtual IP address. NAT/PAT Firewalls Computers on a LAN normally cannot communicate with systems on the Internet directly because they have not been assigned global IP addresses. Network Address Translation (NAT) and Port Address Translation (PAT) are specifications that enable computers using virtual IP addresses on a LAN to access the public Internet. This technique in effect allows an organization to share one or more global IP addresses among many computers that each use virtual IP addresses. NAT/PAT is supported by many common enterprise and personal firewalls in use today. Page 3 Eyeball Any-Firewall™ Technology NAT/PAT firewalls use multiple IP addresses, both internal and external, to communicate with computers on the LAN and the Internet. The firewall performs the function of mapping each virtual IP address to one or more global IP addresses. Network packets have headers containing network information, including the source IP address and port number as well as the destination IP address and port number of the packet. Packets that are sent through NAT/PAT firewalls will have the source IP address and port number altered by the firewall. This process is also known as port masquerading. Figure 1: VoIP packets passing through NAT/PAT firewalls have the source IP address altered before being routed to their destination. Figure 1 above highlights what happens when a LAN user with a virtual IP address tries to communicate with another user on the Internet. Outgoing packets sent by the LAN user are modified by the NAT/PAT firewall so that the virtual IP address and port number are replaced with a global IP address and port number. The same process also happens in reverse, with incoming packets having their destination IP address and port number modified to the virtual IP address of the LAN user. If the firewall of the LAN user were to forward outgoing packets without modifying the header, incoming packets for the LAN user would be incorrectly addressed to the virtual IP address. The firewall would filter these packets out because it will only forward packets addressed to the LAN user’s global IP address. This causes the call to fail. Network and port address translation techniques have a direct impact on whether two or more users are able to connect for voice/video calls. A communications solution that is not designed to account for the effects of NAT/PAT will not consistently connect calls. Page 4 Eyeball Any-Firewall™ Technology Why VoIP Data Packets Get Blocked by Firewalls There are numerous reasons why VoIP calls may not be able to pass through a firewall. Sometimes callers are behind firewalls that explicitly block any type of connection that isn’t simply a request for a web page. Or, the VoIP endpoint may use proprietary protocols that require special support from a firewall before functioning correctly. Both of these situations require firewall configuration by administrators, which is not always possible or desirable when VoIP and video calls take place amongst a wide-ranging Internet population. Figure 2: Connection failure for voice and video call resulting from a NAT/PAT firewall. Another common reason data packets are blocked is that an endpoint is unable to determine the correct “global” IP address and port number of the other endpoint because of the use of NAT/PAT firewalls and virtual IP addresses. Figure 2 illustrates this problem using a scenario where two participants try to connect for a call with endpoints and server software that do not incorporate Any-Firewall™ Technology. In this scenario both users are on LANs using virtual IP addresses and both are behind NAT/PAT firewalls. When users login to the video communications server, the server takes note of each endpoint’s public IP address and TCP port number. If a user tries to call another user, the server informs each endpoint of the other’s IP address and port number so the endpoints know where they should try to connect. In this example, the data packets sent by user A are altered by the NAT/PAT firewall and user A’s internal IP address and port number are replaced by a public IP address and port number. User B’s firewall will reject the packet because it is being sent unsolicited to user B’s internal IP address and port number. The same process happens in reverse when user B tries to send a packet to user A. The end result is that neither user is able to connect because each is unable to send packets to the right destination port number because of port masquerading by the firewall. Again the call fails. Page 5 Eyeball Any-Firewall™ Technology Solving NAT/PAT Issues Some video communications solutions and protocols address such port masquerading problems by requiring certain firewall conditions be met before calls can be completed. A common solution is that the video software or protocol will require specific port numbers be left “open” in the firewall.