Option 1 Bypass the Firewall

The simplest way to deal with videoconferencing and firewalls is to assign your videoconferencing system a static IP address outside the firewall. This removes any potential for the firewall to cause a problem. This is only wise to do if you are using a non-PC based videoconferencing appliance because if someone were to compromise the system, there is not much they can do to an appliance. However, if a PC-based videoconferencing system is compromised, the attacker could potentially do much more damage to your network and attached clients.

A second strategy is to open only the ports that videoconferencing uses only for the specific IP address of your videoconference system. The following are some common ports used by videoconferencing systems. You should consult your user manual for ports specific to your device as it will provide a tighter range. Also consult with your firewall administrator and explain you need to open firewall ports for H.323. (Administration tools and remote login ports for your specific system are likely not listed here and may need to be opened if you want to administer your system remotely.)

NAT (Network Address Translation)

Videoconferencing systems do not work well with NAT unless the NAT is set up for videoconferencing. Even then it may not work unless your videoconferencing system supports NAT.

NAT provides an internal IP address for network devices that is hidden to those outside your internal network. NAT is not the best solution for your videoconferencing system. But if you must use NAT, then you need to assign a static internal private NAT address to your videoconferencing system and map that to a static external public address. The static external public address is necessary for remote videoconferencing systems to call you.

Videoconferencing systems that support NAT will have a place to enter the external IP address that translates to its internal NAT address in its setup menu. This makes the videoconferencing system aware of the NAT you are using and it will compensate. (NOTE: not all videoconferencing systems support this feature.)

For more detailed information than what is presented here, the following articles are useful:

http://www.teamsolutions.co.uk/tsfirewall.html
and
http://www.giac.org/practical/GSEC/Steve_Cypher_GSEC.pdf