ichat throught FW1

[jeff.oliver@uleth.ca]

All,

Has anyone been able to get ichat (apple's IM client) to work through FW1, specifically the audio and video portions of it? The text chat works fine.

Jeff

[pointcheck]

One side can be behind a Checkpoint FW with NAT. The other side needs to be:

1) Not behind a firewall or NAT with Apple host firewall turned off.
2) Not behind a firewall or NAT with Apple host firewall on and iChat ports open.
3) Behind a firewall with iChat ports open on both firewall and Apple host.
4) Behind a firewall with NAT that has UPnP NAT translation. This is a Linksys, Netgear, D-Link, SOHO-type firewall. (NOT ANOTHER CHECKPOINT DOING NAT!)

The main thing is that one side needs to have ports "opened" either manually or by a protocol. The other side nothing special needs to be done.

Good Luck.

[SingChung]

Originally Posted by pointcheck

One side can be behind a Checkpoint FW with NAT. The other side needs to be:

4) Behind a firewall with NAT that has UPnP NAT translation. This is a Linksys, Netgear, D-Link, SOHO-type firewall. (NOT ANOTHER CHECKPOINT DOING NAT!)

Is it confirmed that Checkpoint cannot do uPnP? I have been trying to use remote assistance across the Checkpoint firewall without any success and I believe it has got to do with uPnP.

[Bob_Zimmerman]

I'm pretty sure that Check Point explicitly does not do UPnP. I mean, the protocol is the very definition of a security hole. Its entire purpose is to make changes to your network infrastructure with no administrator interaction. That's commonly known as a Very Bad Idea™ when it comes to corporate-level firewall software.

As for the original poster's question, really it depends on how it is that you're connecting through the firewall. The audio and video connections are handled by a sort of peer-to-peer SIP. One problem I've seen is that VPN-1 tends to NAT SIP connections on its own and if your peers don't know about this, it can break the call. You should probably talk with Check Point's technical support and ask them about "early SIP NAT".