| 12.2 |  | Multimedia Support |
| 12.2.1 |  | Why multimedia is an issue |

| Multimedia applications pose problems when used within a network protected by a firewall. The PIX Security Appliance can be configured to circumvent the issues introduced by multimedia applications. This is important because multimedia applications can be quite complex, and each one behaves in a different way. For instance, a multimedia application may transmit requests on TCP, get responses via UDP or TCP and, use dynamic ports, or use the same port for source and destination.

For this reason, implementing support for all multimedia applications using a single secure method can be very difficult. The following two examples highlight these complexities:

1. With RealAudio, a client sends the originating request to TCP port 7070. The RealAudio server replies with multiple UDP streams anywhere from UDP port 6970 through 7170 on the client machine.
2. A CUseeMe client sends the originating request from TCP port 7649 to TCP port 7648. The CUseeMe datagram is unique in that it includes the legitimate IP address in the header as well as in the payload, and sends responses from UDP port 7648 to UDP port 7648.

In order to cope with issues such as these, the PIX Security Appliance has been designed to dynamically open and close UDP ports for secure multimedia connections. It is therefore unnecessary to reconfigure any application clients or to open a large range of ports, which creates a security risk.

Additionally, the PIX Security Appliance is capable of supporting multimedia with or without NAT. Without the capability to support multimedia with NAT, the firewall would limit multimedia usage to only registered users, or require exposure of inside IP addresses to the Internet. In the past, this lack of support for multimedia with NAT has often forced multimedia vendors to join proprietary alliances with firewall vendors to accomplish compatibility for their applications.