Considerations for firewalls and streaming media service

About this section

Some administrators are reluctant to open ports on their firewalls because they are concerned that doing so will compromise security. This section compares NetCache vulnerability to attacks to those of computers running general operating systems and discusses the reasons why blocking streaming media-specific ports presents a problem. Network Appliance recommends that you share the information in this section with your firewall administrator.

Firewall security and a NetCache appliance

Security breaches are less likely to occur through a NetCache appliance than through a general-purpose operating system such as Solaris. One reason is that NetCache has fewer UDP ports open than the general-purpose operating systems have open. Additionally, the Data ONTAP^TM operating system is not as widely distributed as an operating system such as Solaris. Therefore, it is not as likely that a potential intruder will be able to write a Data ONTAP-specific script to breach security.

Firewall requirements in a multicast streaming environment

Multicast uses UDP with special IP addresses. UDP and IGMP must be enabled on the firewall to ensure that multicast can work through a firewall.

Correspondence between stream quality and protocols

Media players attempt to contact the streaming server using the protocols in the following table, in the order shown. As the table shows, blocking UDP or TCP streaming ports, or both, seriously degrades the quality of the streaming media you can deliver to clients.

Order	Protocol	Quality for streaming media
1	UDP	Best
2	TCP	Not as good as when UDP is used
3	HTTP	Poorest

Need for an HTTP port for streaming service

You must open a TCP port for HTTP traffic on the firewall (for example, TCP port 80), whether or not you have blocked streaming media TCP and UDP ports on the firewall, for the following reasons:

If streaming media TCP and UDP ports are blocked on the firewall, client media players will try to use HTTP for streaming service. No streaming service is possible if the HTTP port is also blocked.
Some client media players might be configured for HTTP transport. If TCP port 80 is blocked, no streaming service is possible for those clients.
Note
If you are using transparent proxying to redirect requests to a streaming media cache, you must set your L4 or L7 switch or WCCP router to redirect TCP port 80 requests also.

Effect of blocked ports on stream caching and splitting

The effect of blocking streaming media TCP and UDP ports on the streaming service that NetCache can provide depends on the location of the firewall in relation to the clients and the streaming media cache, as the following table shows.

Location of the streaming media cache	TCP and UDP streaming ports blocked; TCP port 80 open
One or more firewalls are between the clients and the streaming media cache.	Splitting and caching of streaming requests occur. (NetCache contacts the streaming server using TCP and encapsulates the streams it returns to the client in HTTP.)
The streaming media cache and the clients are inside the firewall.	Only proxying of streaming requests over HTTP occurs. No splitting or caching can occur.

Location of the streaming media cache

TCP and UDP streaming ports blocked; TCP port 80 open

One or more firewalls are between the clients and the streaming media cache.

Splitting and caching of streaming requests occur.

(NetCache contacts the streaming server using TCP and encapsulates the streams it returns to the client in HTTP.)

The streaming media cache and the clients are inside the firewall.

Only proxying of streaming requests over HTTP occurs. No splitting or caching can occur.

In both cases, because HTTP is used for streaming service, the quality of the streams returned to clients is degraded.

Obtaining details about port settings for streaming media

See the streaming media chapter in the Guide to Caching Protocols and Services for specific information about the minimum ports to open on your firewall to support streaming media caching. The requirements differ, depending on whether you are using MMS, RealNetworks RTSP, or Apple QuickTime RTSP.

NetCache configuration related to firewalls

How you configure your streaming media cache behind a firewall depends on whether the firewall is transparent or nontransparent, as the following table shows.

Type of firewall	Streaming media cache configuration
Transparent	No explicit configuration is necessary to pass requests through the firewall.
Nontransparent, running as a proxy	You must include the firewall in the cache hierarchy of the streaming media cache.