IOS MCM GK/Proxy Placement

Question

Are there any issues with a Cisco IOS MCM GK/Proxy with one interface placed on the 'internal' network (which endpoints register with) and a second interface placed in a firewall DMZ (and the MCM acting as an H.323 proxy). The firewall then does static NAT (a 1:1 mapping) with the address on the interface and a real-world IP address. The firewall is H.323 aware. The other alternative is to place the 'outside' interface directly on the external network (effectively in parallel with the firewall), but this is the less-preferred option.
With the parallel model (described as co-edge in the documentation), is it possible to secure the router with suitable ACLs to prevent traffic being routed through it and limit traffic terminated on it, or sourced from it to H.323?

Answer 1

With your approach you may have the MCM as H.323 Proxy and NAT (on the Firewall) both the MCM Proxy and the NAT will essentially do the same (address hiding). The F/W also has to be H.323 aware (ALG).
You may want to consider a IP-IP gateway to serve your requirement. It can have a GK on the same router and do H.323 RAS, signalling and Media reorigination, thus doing address hiding. ACL on the router can give you firewalling for the router. You may choose to still use your firewall if you want a single security device.
http://cisco.com/en/US/partner/products/sw/voicesw/ps5640/index.html
The IP-IP gateway can support Voice and Video calls and can support RSVP CAC, this can be a single box solution.