H.323
H.323 is the ITU-T packet-based multimedia communications framework used by legacy and current room codecs, gateways, and call-control systems. It combines H.225 signaling and RAS, H.245 media control, and negotiated RTP/RTCP media rather than defining one single firewall port.
Scope: H.323 — select the deployed product/version; optional services require separate selection.
protocol · Catalog reviewed 2026-09-27
By ITU-T · ITU-T H.323; H.225.0; H.245
Infrastructure Requirements
- Call-control or direct endpoint reachability
- NAT/firewall traversal design
- QoS
- negotiated RTP media range
Network & Physical Requirements
| Port / allocation | Transport | Connection / signal flow | Feature and requirement | Evidence |
|---|---|---|---|---|
| 1720 (default) | TCP | Calling endpoint / call-control peer → Called endpoint / call-control peer | Profile requirement · Call signalling H.225 call signaling listener. H.323 H.225 call setup Use the advertised signalling address/port if registration or traversal changes the default. | Source checked 2026-09-27 H.225 Call Control (Setup) SignalingCisco document5244, 2014-09-25 |
| 1718 (default) | UDP Multicast: 224.0.1.41 | H.323 endpoint → H.323 gatekeeper | Optional · Gatekeeper discovery Gatekeeper discovery where an H.323 gatekeeper is used. H.323 automatic gatekeeper discovery Select only when multicast gatekeeper discovery is used; manual gatekeeper configuration is an alternative. | Source checked 2026-09-27 RAS Gatekeeper DiscoveryCisco document5244, 2014-09-25 |
| 1719 (default) | UDP | H.323 endpoint / gatekeeper → H.323 gatekeeper / endpoint | Optional · Gatekeeper RAS H.225 RAS registration, admission, and status with a gatekeeper. H.323 gatekeeper registration/admission Use the RAS address advertised by the gatekeeper; replies and gatekeeper-initiated RAS messages require the corresponding endpoint flow. | Source checked 2026-09-27 H.225 RAS SignalingCisco document5244, 2014-09-25 |
| Negotiated | TCP | H.323 control peer → Peer H.245 listener | Optional · Separate H.245 channel H.245 media-control channel when it is not tunneled in H.225 signaling. H.323 separate H.245 TCP channel Listener is negotiated through H.225. This separate connection is unnecessary when H.245 is tunnelled in call signalling. | Source checked 2026-09-27 H.323 inspection: H.225/H.245 channel negotiationCisco ASA9.17 |
| Negotiated | UDP | Sending media endpoint / traversal server → Receiving media endpoint / traversal server | Profile requirement · Negotiated media Negotiated RTP/RTCP audio and video media ports; use the endpoint or traversal-server range. H.323 RTP/RTCP UDP media Schedule both media directions and RTCP. Use deployed endpoint/traversal ranges; signalling ports alone do not carry media. | Source checked 2026-09-27 H.323 inspection: H.245 media port exchangeCisco ASA9.17 |
Gotchas & IT Notes
- ⚠TCP 1720 is call signaling, not the audio/video media path.
- ⚠H.245 and RTP/RTCP commonly use negotiated dynamic ports unless a product constrains them.
- ⚠Gatekeepers, border controllers, and traversal servers materially change the firewall schedule.