Cisco Technology, Inc.

Anupama Anand

Jianxin Wang

Hien Thi Thai

In one embodiment, two way communication between an IP phone behind a firewall and an IP phone behind a translation device is established. A network security device receives a remote packet from the translation device. The header of the remote packet includes the address of the translation device, and a payload of the remote packet includes an embedded remote address and the media port of the IP phone behind the translation device. A memory stores the media port matched with the address of the translation device. When the network security device receives a local packet from the IP phone behind the firewall destined for the IP phone behind the translation device, a controller rewrites the destination port of the local packet with the media port.

Differentiation of multiple media endpoints behind an address translation device

Apparatus, methods, and other embodiments associated with securing and authenticating multiple devices behind a network address translation (NAT) device are described. One example method includes controlling a phone proxy to provide security credential information to an Internet Protocol (IP) phone located behind the NAT device. The credentials may be selectively provided in response to receiving a certificate request from the IP phone. The certificate request includes IP phone identifying addresses. The method may also include controlling the phone proxy to update an entry in a secure IP phone data store to relate together the IP phone identifying addresses, a source port associated with the IP phone, and the fact that credential information was provided to the IP phone. This entry can mark the IP phone as an authorized phone. The entry may be addressable as a function of a least a portion of the IP phone identifying addresses.

Growing community of inventors

San Jose, CA, United States of America

Anupama Anand