1、 International Telecommunication Union ITU-T Series HTELECOMMUNICATION STANDARDIZATION SECTOR OF ITU Supplement 10(05/2008) SERIES H: AUDIOVISUAL AND MULTIMEDIA SYSTEMSProxy-aided NAT/FW traversal scheme for ITU-T H.323 multimedia systems ITU-T H-series Recommendations Supplement 10 ITU-T H-SERIES R
2、ECOMMENDATIONS AUDIOVISUAL AND MULTIMEDIA SYSTEMS CHARACTERISTICS OF VISUAL TELEPHONE SYSTEMS H.100H.199 INFRASTRUCTURE OF AUDIOVISUAL SERVICES General H.200H.219 Transmission multiplexing and synchronization H.220H.229 Systems aspects H.230H.239 Communication procedures H.240H.259 Coding of moving
3、video H.260H.279 Related systems aspects H.280H.299 Systems and terminal equipment for audiovisual services H.300H.349 Directory services architecture for audiovisual and multimedia services H.350H.359 Quality of service architecture for audiovisual and multimedia services H.360H.369 Supplementary s
4、ervices for multimedia H.450H.499 MOBILITY AND COLLABORATION PROCEDURES Overview of Mobility and Collaboration, definitions, protocols and procedures H.500H.509 Mobility for H-Series multimedia systems and services H.510H.519 Mobile multimedia collaboration applications and services H.520H.529 Secur
5、ity for mobile multimedia systems and services H.530H.539 Security for mobile multimedia collaboration applications and services H.540H.549 Mobility interworking procedures H.550H.559Mobile multimedia collaboration inter-working procedures H.560H.569 BROADBAND, TRIPLE-PLAY AND ADVANCED MULTIMEDIA SE
6、RVICES Broadband multimedia services over VDSL H.610H.619 Advanced multimedia services and applications H.620H.629 IPTV MULTIMEDIA SERVICES AND APPLICATIONS FOR IPTV General aspects H.700H.719 IPTV terminal devices H.720H.729 IPTV middleware H.730H.739 IPTV application event handling H.740H.749 IPTV
7、 metadata H.750H.759 IPTV multimedia application frameworks H.760H.769 IPTV service discovery up to consumption H.770H.779 For further details, please refer to the list of ITU-T Recommendations. H series Supplement 10 (05/2008) i Supplement 10 to ITU-T H-series Recommendations Proxy-aided NAT/FW tra
8、versal scheme for ITU-T H.323 multimedia systems Summary Supplement 10 to ITU-T H-series Recommendations describes a proxy-aided network address translation/firewall (NAT/FW) traversal mechanism in the ITU-T H.323 multimedia system. The proxy described in this supplement implements the ITU-T H.323 a
9、pplications NAT/FW traversal by way of translating the address, ports and the related contents in the payloads and/or in the Internet Protocol (IP) headers, in which the ITU-T H.323 protocol remains intact. In addition, the proxy can also facilitate the real-time transport protocol/real-time transpo
10、rt control protocol (RTP/RTCP) media flows traverse the NAT/FW among the entities in communication. Source Supplement 10 to ITU-T H-series Recommendations was agreed on 2 May 2008 by ITU-T Study Group 16 (2005-2008). ii H series Supplement 10 (05/2008) FOREWORD The International Telecommunication Un
11、ion (ITU) is the United Nations specialized agency in the field of telecommunications, information and communication technologies (ICTs). The ITU Telecommunication Standardization Sector (ITU-T) is a permanent organ of ITU. ITU-T is responsible for studying technical, operating and tariff questions
12、and issuing Recommendations on them with a view to standardizing telecommunications on a worldwide basis. The World Telecommunication Standardization Assembly (WTSA), which meets every four years, establishes the topics for study by the ITU-T study groups which, in turn, produce Recommendations on t
13、hese topics. The approval of ITU-T Recommendations is covered by the procedure laid down in WTSA Resolution 1. In some areas of information technology which fall within ITU-Ts purview, the necessary standards are prepared on a collaborative basis with ISO and IEC. NOTE In this publication, the expre
14、ssion “Administration“ is used for conciseness to indicate both a telecommunication administration and a recognized operating agency. Compliance with this publication is voluntary. However, the publication may contain certain mandatory provisions (to ensure e.g. interoperability or applicability) an
15、d compliance with the publication is achieved when all of these mandatory provisions are met. The words “shall“ or some other obligatory language such as “must“ and the negative equivalents are used to express requirements. The use of such words does not suggest that compliance with the publication
16、is required of any party. INTELLECTUAL PROPERTY RIGHTS ITU draws attention to the possibility that the practice or implementation of this publication may involve the use of a claimed Intellectual Property Right. ITU takes no position concerning the evidence, validity or applicability of claimed Inte
17、llectual Property Rights, whether asserted by ITU members or others outside of the publication development process. As of the date of approval of this publication, ITU had not received notice of intellectual property, protected by patents, which may be required to implement this publication. However
18、, implementers are cautioned that this may not represent the latest information and are therefore strongly urged to consult the TSB patent database at http:/www.itu.int/ITU-T/ipr/. ITU 2009 All rights reserved. No part of this publication may be reproduced, by any means whatsoever, without the prior
19、 written permission of ITU. H series Supplement 10 (05/2008) iii CONTENTS Page 1 Scope 1 2 References. 1 3 Definitions 2 3.1 Terms defined elsewhere 2 3.2 Terms defined in this supplement. 2 4 Abbreviations and acronyms 3 5 Overview 3 6 General architecture 4 6.1 General function description 4 6.2 N
20、etwork locations. 6 6.3 General description of the ITU-T H.323 parameter translations 7 7 ITU-T H.323 NAT/FW traversal with proxy in the private network . 7 7.1 General description. 7 7.2 Call flows of the ITU-T H.323 NAT/FW traversal with proxy in the private network. 8 8 ITU-T H.323 NAT/FW travers
21、al with proxy on the edge of private and public networks 16 8.1 General description. 16 8.2 Call flows of the ITU-T H.323 NAT/FW traversal with proxy on the edge of private and public networks . 16 9 Security considerations. 22 H series Supplement 10 (05/2008) 1 Supplement 10 to ITU-T H-series Recom
22、mendations Proxy-aided NAT/FW traversal scheme for ITU-T H.323 multimedia systems 1 Scope This supplement describes a proxy-aided NAT/FW traversal mechanism as a NAT traversal solution for ITU-T H.323 multimedia systems. A proxy is a logical functional entity with one or more addresses in one or mor
23、e realms. It provides translation of the IP header as well as the translation of ports and addresses in the message payloads. A proxy is logically located on the edge of different realms, while it can be physically deployed in many different places in the network (private or public). The scheme desc
24、ribed in this supplement addresses end-to-end ITU-T H.323 communications and does not address ITU-T H.323 functionalities above the transport level. The method described in this supplement is complementary to other NAT/FW traversal solutions, such as those described in the ITU-T H.460-series Recomme
25、ndations. The proxy-aided NAT/FW traversal scheme highlights potential issues with deploying those ITU-T H.323 NAT/FW traversal solutions and describes how those solutions are applied in such cases. 2 References ITU-T H.225.0 Recommendation ITU-T H.225.0 (2006), Call signalling protocols and media s
26、tream packetization for packet-based multimedia communication systems. ITU-T H.245 Recommendation ITU-T H.245 (2006), Control protocol for multimedia communication. ITU-T H.323 Recommendation ITU-T H.323 (2006), Packet-based multimedia communications systems. ITU-T H.460.17 Recommendation ITU-T H.46
27、0.17 (2005), Using H.225.0 call signalling connection as transport for H.323 RAS messages. ITU-T H.460.18 Recommendation ITU-T H.460.18 (2005), Traversal of H.323 signalling across network address translators and firewalls. ITU-T H.460.19 Recommendation ITU-T H.460.19 (2005), Traversal of H.323 Medi
28、a across network address translators and firewalls. IETF RFC 2663 IETF RFC 2663 (1999), IP Network Address Translator (NAT) Terminology and Considerations. IETF RFC 3022 IETF RFC 3022 (2001), Traditional IP Network Address Translator (Traditional NAT). IETF RFC 3103 IETF RFC 3103 (2001), Realm Speci
29、fic IP: Protocol Specification. 2 H series Supplement 10 (05/2008) IETF RFC 3304 IETF RFC 3304 (2002), Middlebox Communications (midcom) Protocol Requirements. IETF RFC 3489 IETF RFC 3489 (2003), STUN - Simple Traversal of User Datagram Protocol (UDP) Through Network Address Translators (NATs). 3 De
30、finitions 3.1 Terms defined elsewhere This supplement uses the following terms defined elsewhere: 3.1.1 gatekeeper (GK) ITU-T H.323: The gatekeeper (GK) is an ITU-T H.323 entity on the network that provides address translation and controls access to the network for ITU-T H.323 terminals, gateways an
31、d MCUs. The gatekeeper may also provide other services to the terminals, gateways and MCUs such as bandwidth management and locating Gateways. 3.1.2 network address translation (NAT) IETF RFC 2663: Network address translations (NATs) provide the address or port mapping between the public network and
32、 the private network. NAT allows hosts in a private network to transparently communicate with destinations in an external network and vice versa. 3.1.3 static network address translation IETF RFC 2663: It refers to the NATs configured with static address assignment, namely, there is one-to-one addre
33、ss mapping for hosts between a private network address and an external network address for the lifetime of NAT operation. 3.1.4 dynamic network address translation IETF RFC 2663: It refers to the NATs configured with dynamic address assignment, namely, external addresses are assigned to private netw
34、ork hosts or vice versa, dynamically based on usage requirements and session flow determined heuristically by NAT. When the last session using an address binding is terminated, NAT would free the binding so that the global address could be recycled for later use. 3.1.5 realm IETF RFC 2663: An addres
35、s realm is a network domain in which the network addresses are uniquely assigned to entities such that datagrams can be routed to them. Routing protocols used within the network domain are responsible for finding routes to entities given their network addresses. Note that this Supplement is limited
36、to describing NAT in the IPv4 environment and does not address the use of NAT in other types of environment (e.g., IPv6 environments). 3.1.6 zone ITU-T H.323: A zone is the collection of all terminals (Tx), gateways (GW), and multipoint control units (MCUs) managed by a single gatekeeper (GK). A zon
37、e includes at least one terminal, and may or may not include gateways or MCUs. A zone has one and only one gatekeeper. A zone may be independent of network topology and may be comprised of multiple network segments which are connected using routers (R) or other devices. 3.2 Terms defined in this sup
38、plement This supplement defines the following term: 3.2.1 proxy: A proxy is the functional entity which can aid the ITU-T H.323 multimedia applications in traversing the NAT/FW installations. It can identify and then translate all the ITU-T H.323 signalling messages (based on TCP or UDP) by modifyin
39、g the address-related contents in the ITU-T H.323 application-specific payloads and/or in the IP headers to be valid in the address realm, into which the messages are routed. After this, the proxy will forward these messages to their destinations. Besides the signalling messages processing, the prox
40、y can also facilitate the RTP/RTCP media flow among the entities in communication. H series Supplement 10 (05/2008) 3 4 Abbreviations and acronyms This supplement uses the following abbreviations and acronyms: ACF Admission Confirm ALG Application Level Gateway ARJ Admission Reject ARQ Admission Req
41、uest DoS Denial of Service FW Firewall GCF Gatekeeper Confirmation GK Gatekeeper GRJ Gatekeeper Reject GRQ Gatekeeper Request GW Gateway IP Internet Protocol IPSec Internet Protocol Security MPF Media Proxy Function NAT Network Address Translator OLC openLogicalChannel message ITU-T H.245 RAS Regist
42、ration, Admission and Status RCF Registration Confirmation RRJ Registration Reject RRQ Registration Request RSIP Realm Specific Internet Protocol RTP Real-time Transport Protocol RTCP Real-time Transport Control Protocol SINN Server Involvement in NAT Navigation SPF Signalling Proxy Function STUN Si
43、mple Traversal of UDP over NATs TCP Transmission Control Protocol TE Terminal UDP User Datagram Protocol URQ Unregistration Request 5 Overview Network address translators (NATs) provide a lot of benefits to solving the problems of the exhaustion of IPv4 addresses and have been widely deployed during
44、 the past decade. However, the presence of NATs can hamper many existing IP applications and then create problems for some multimedia services based on some certain protocols, which cannot naturally traverse the NATs 4 H series Supplement 10 (05/2008) devices, and then result in call failures. To so
45、lve such problems, NAT/FW traversal schemes have emerged as required, and been deployed into the networks in recent years. During the implementation of NAT/FW traversal schemes, it was found that some of them may more or less affect the current networks, which include the modification of NATs such a
46、s application level gateway (ALG); modification of clients such as simple traversal of UDP through NATs (STUN, defined in IETF RFC 3489); modification of NATs and servers such as middlebox communications (midcom, defined in IETF RFC 3304); modification of servers such as server involvement in NAT na
47、vigation (SINN); modification of NATs and clients such as realm specific IP (RSIP, IETF RFC 3103). In a nutshell, for the legacy networks, all of the techniques above require upgrades to one or more existing entities, including terminals, and/or servers and/or NATs, which might become a tremendous t
48、ask to accomplish. This supplement offers a new proxy-aided NAT/FW traversal scheme, by simply adding a functional entity into the network to aid the multimedia-related protocols traversing the NAT/FW. In the ITU-T H.323 applications context, the proxy should be able to identify and then translate a
49、ll the signalling messages (based on TCP or UDP) by modifying the address-related contents in the ITU-T H.323 application-specific payloads and/or in the IP headers to be valid in the address realm, into which the messages are routed, and then forward them to the destinations. The signalling referred to includes ITU-T H.225.0 RAS, ITU-T H.225.0 call signalling and ITU-T H.245. Besides the signalling processing, the proxy can also facilitate the RTP/RTCP media flow among the entities in communication. Proxy
