Firewall interface configuration to enable bi-directional VoIP traversal communications

An intelligent network protection gateway device comprising:

• a network address translation (NAT) processing means, configured to be interposed between an internal network and an external network, for providing network-layer protection against unauthorized access by hosts associated with the external network to a plurality of internal hosts associated with the internal network by performing translation of Internet Protocol (IP) addresses associated with the plurality of internal hosts;
• an application-layer protection means, for protecting the plurality of internal host from the external network and for supporting VoIP services without compromising internal network security by actively processing signaling protocols associated with Voice over IP (VoIP) sessions, including
• distinguishing among VoIP packets and non-VoIP packets,
• understanding and parsing the VoIP packets at the application layer, and
• changing data in headers of the VoIP packets and also changing data contents in the VoIP packets corresponding to data changed in the headers to enable bi-directional VoIP communications among one or more of the plurality of internal hosts and one or more of the hosts associated with the external network;
• an external VoIP interface including a plurality of VoIP ports configured to receive incoming VoIP packets each having contained therein an a user alias and an indication regarding one of the plurality of VoIP ports;
• wherein said external VoIP interface further comprises a means for directing the incoming VoIP packets to an appropriate internal host of the plurality of internal hosts by performing port address forwarding based on the port indication to a Session Initiation Protocol (SIP) server within the internal network that maintains a mapping of user aliases to private addresses of the plurality of internal hosts;
• wherein one or more of said NAT processing means and said application-layer protection means includes (i) logic implemented within an application specific integrated circuit (ASIC) of the intelligent network protection gateway device or (ii) a program storage device readable by one or more processors of the intelligent network protection gateway device, tangibly embodying a program of instructions executable by the one or more processors;
• wherein the user alias comprises an email address of a user associated with one of the plurality of internal hosts;
• and
• wherein the mapping maps an e-mail address included in an incoming VoIP message to an internal port number in said internal network.