Filtering | HP VCX Software guide

Chapter 4. How To Conﬁgure SIP

Filtering

To allow SIP trafﬁc through the Telecommuting Module, you must change the Default Pol- icy For SIP Requests on the Filtering page.

As the Telecommuting Module does not manage any SIP domains, there are no Local SIP Domains. This means that you must select Process all for this setting.

Basic Conﬁguration

The Telecommuting Module must be able to look up SIP domains in DNS. DNS servers are entered on the Basic Conﬁguration page under Basic Conﬁguration.

51

Image 59

HP VCX Software manual Filtering

Contents

Version 3Com Telecommuting ModulePage United States Government Legend Page Table of Contents Page Part I. Introduction to 3Com VCX IP Telecommuting Module Page Conﬁguration alternatives What is a Telecommuting Module?Introduction to 3Com VCX IP Telecommuting Module DMZ/LAN Conﬁguration DMZ Conﬁguration Standalone Conﬁguration Quick guide to 3Com VCX IP Telecommuting Module installation Introduction to 3Com VCX IP Telecommuting Module About settings in 3Com VCX IP Telecommuting Module Introduction to 3Com VCX IP Telecommuting Module Installation with a serial cable Installing 3Com VCX IP Telecommuting ModuleInstallation Installation with magic pingPage Page Page Page Installation with a diskette Page Page Remember to lock up the Telecommuting Module Turning off a Telecommuting Module Installing 3Com VCX IP Telecommuting Module Log on again Conﬁguring 3Com VCX IP Telecommuting ModuleLogging on Site Map NavigationLog out Network Conﬁguration AdministrationSIP Services Basic Conﬁguration Virtual Private Networks Quality of ServiceOverview of conﬁguration Failover Preliminary and permanent conﬁguration Page Mask/Bits IP address No. of computers Mask Bits Name queries in 3Com VCX IP Telecommuting ModulePage Conﬁguring 3Com VCX IP Telecommuting Module Part II. How To Page Networks and Computers How To Conﬁgure SIPDMZ Telecommuting Module, SIP server on the WAN Surroundings Interoperability Basic Settings Routing Filtering Save/Load Conﬁguration DMZ Telecommuting Module, SIP server on the LAN Networks and Computers Basic Settings Routing Standalone Telecommuting Module, SIP server on the WAN Basic Settings Filtering Standalone Telecommuting Module, SIP server on the LAN Client Settings Basic Settings Interoperability DMZ/LAN Telecommuting Module, SIP server on the WAN Basic Settings Filtering DMZ/LAN Telecommuting Module, SIP server on the LAN Interoperability Filtering LAN Telecommuting Module Surroundings Filtering Remote SIP Connectivity Firewall How To Conﬁgure SIP Outgoing Calls How To Conﬁgure Advanced SIP Show One Number When Calling Show Different Numbers When Calling Incoming Calls Page Authentication by Accounts a.k.a SIP Trunk via SIP accounts Page Page Page Incoming Calls Page Multiple Operators Least Cost Routing Page Multiple PBXs How To Conﬁgure Advanced SIP How To Conﬁgure Advanced SIP Page Page Page Page Name of this Telecommuting Module Basic ConﬁgurationBasic Conﬁguration General Policy For Ping To Your 3Com VCX IP Telecommuting Module Default domain IP PolicyDNS Servers Look up all IP addresses again Access ControlCancel Save Conﬁguration Transport User Authentication For Web Interface AccessConﬁguration Allowed Via Interface Conﬁguration via Https Conﬁguration via Http DNS Name Or Network Address Conﬁguration ComputersConﬁguration via SSH Via IPsec Peer Network addressNetmask/Bits Range Radius Secret Radius ServersRadius server Port Status for Radius Servers IdentiﬁerContact IP Address Consecutive sends ScoreSent requests Received replies Value Conﬁguration of a Radius server Node location Snmp v1 and v2cTelecommuting Module IP address to respond to Snmp requests Contact person Community Access via SNMPv1 and SNMPv2cAccess via SNMPv3 Snmp User PasswordAuthentication Snmp Traps Version Resource MonitoringTrap sending function Trap receiver CPU Load Trap Levels Download the 3Com MIBSIP Sessions Trap Levels SIP User Registrations Trap Levels Use DynDNS Dynamic DNS updateDynDNS service DynDNS General Conﬁguration Username IP address for updatesUser, Smtp Server Wildcard hostnames Ofﬂine URL redirection DNS Name DNS Names to Update at DynDNSSmtp server is backup Smtp server Certiﬁcate CertiﬁcatesPrivate Certiﬁcates Name Create certiﬁcate or certiﬁcate request CA Certiﬁcates CA Certiﬁcate TimeoutsAdvanced Timeout for Icmp connections Timeout for one-way UDP connectionsTimeout for two-way UDP connections Timeout for established TCP connections DMZ/LAN Conﬁguration Change Telecommuting Module Type to Telecommuting Module Type conﬁgurationCurrent Telecommuting Module Type Change type Test Preliminary Conﬁguration AdministrationDuration of limited test mode Save/Load Conﬁguration Apply conﬁguration BackupShow Message About Unapplied Changes Save/Load CLI Command File Reload Factory Conﬁguration Show ConﬁgurationRevert to Old Conﬁgurations Abort All Edits Old password User AdministrationPassword For the ’admin’ Account Account Type New password, Conﬁrm passwordChange administration password Other Accounts Currently Logged In Administrators Step UpgradeUpgrade Log Out Table Look Try the upgradeAccept upgrade Abort upgrade Edit Column Change Time Zone Date and Time Set date and time manually Change Date and Time ManuallyDate Time Synchronize time with NTP NTP Servers To Use If NTP Is EnabledChange Date and Time With NTP Automatic Restart of the SIP Module Reboot Your 3Com VCX IP Telecommuting ModuleRestart Restart the SIP Module Administration Administration 118 Networks and Computers Network Conﬁguration Lower Limit NameSubgroup Create Upper LimitInterface/VLAN Delete Row Interface Default GatewayMain Default Gateways Priority Gateway Reference Hosts Policy For Packets From Unused Gateways Interface name Interface Network Interface 1Physical device Obtain IP Address Dynamically Directly Connected Networks Vlan Name AliasBroadcast address Vlan Id Static Routing Router Routed network Named VLANs Vlan Interface Status Interface Status PPPoE Client Status Dhcp Client Status Keep Alive AuthenticationPPPoE Log class for PPPoE negotiations SurroundingsLCP echo-request interval Additional Negotiators Data InterfacesNetwork Select a data interface here Network Conﬁguration 136 Display log LoggingDisplay Log Search the Log Packet Selection Support Report All IP protocols Packet Type SelectionIP Address Selection Protocol/Port Selection Icmp IP addresses SIP Packet SelectionCall-ID SIP Methods Time Limits Show newest at top Show ThisExport the Log Clear form Log RST Display Load Unit Packet LoadTime Period Direction Value View diagram DiagramDiagram Size Diagram Heading Log class for broadcast packets Inbound TrafﬁcLog class for non-SIP packets Log class for spoofed packets Log class for Dhcp requests Log class for email errorsLog class for Radius errors Log class for Snmp errors Log class for ESP packets VPN EventsLog class for IPsec key negotiations Log class for IPsec key negotiation debug messages SIP Events Other Local Log Log ClassesEmail Address Syslog Log Sending Syslog Servers Smtp ServerStatus for Outbound Email Reverts the ﬁelds to the previous conﬁguration 157 Logging 158 SIP Module SIP ServicesAdministration of SIP Basic Settings Comment Additional SIP Signaling PortsProvisioning Relay Transport SIP Servers To Monitor SIP Media Port RangePublic IP address for NATed Telecommuting Module Server SIP Logging Log class for SIP signaling Relaxed Refer-To InteroperabilityLoose Routing Except this from translation Remove Via HeadersTranslation Exceptions SIP Server Always Translate This Expires HeaderForce Translation URI Encoding User Matching Signaling Order of Re-INVITEsLoose Username Check Force Record-Route for All Requests Accept RTP/AVP With sdescriptionsTransmit RTP/AVP With sdescriptions Force Record-Route for Outbound Requests Accept TCP Marked As TLS Force Remote TLS Connection Reuse Remove Headers in 180 Responses Allow Large UDP Packets Preserve RFC 2543 Hold Forward Cancel BodyUse Cancel Body In ACK Convert Escaped Whitespaces in URIs Allow RFC 2069 AuthenticationOpen Port 6891 For File Transfer Ports and the maddr Attribute Keep User-Agent Header When Acting as B2BUAStrip ICE Attributes Session Conﬁguration Session timerTimeout for SIP over TCP/TLS Sessions and Media Limitation of sender of media streams Media ConﬁgurationAllowed number of concurrent sessions Limitation of RTP Codecs This Codec Is Allowed CodecsType Name Ring Tone for Local Ringback Local RingbackMusic on Hold Redirection Local Ringback Played at Call Transfer SIP blacklist interval Default timeout for Invite requestsMaximum timeout for Invite requests Requests Maximum number of retransmissions for non-INVITE requests Base retransmission timeout for SIP requestsRemote SIP Connectivity Maximum number of retransmissions for Invite requests Stun ports Stun ServerStun server Stun server IP addresses IP Address for Remote Clients Remote Clients Signaling ForwardingRemote NAT Traversal Remote NAT traversal NAT keepalive method NAT timeout for UDPNAT timeout for TCP Forward Signaling from IP Address SIP Methods SIP Trafﬁc Auth MethodTrafﬁc To Allow Action FilteringSender IP Filter Rules From Network Allow Content TypesDefault Policy For SIP Requests Content Type Header Filter Rules Local SIP Domains Default Header Filter PolicyLocal Registrar Domain Local SIP User Database Register From Authentication and AccountingAuthentication Name SIP User Database Authentication settings Network Asserted-IdentityUse P-Asserted-Identity Trusted Domains Emergency Number Dial PlanRadius Accounting Use Dial Plan Reg Expr Matching From Header Tail Matching Request-URIPreﬁx Head Min. Tail Forward To Subno Replacement URI Dial Plan Enum Root Request-URIForward To Add Preﬁx Register in Dial Plan Methods in Dial PlanMethod Enum Root Routing DNS Override For SIP Requests Port WeightSIP Routing Order Relay To Routing Function Class 3xx Message Processing User Static RegistrationsRequests To User Also Forward To Sip/sips Local Refer HandlingAlways handle Refer locally For clients not supporting Refer From URIs For Which Refer is Handled Locally For clients not supporting replacesFor dialogs with speciﬁed From URI For dialogs with speciﬁed User-Agent header Restrict Incoming Callers User RoutingAlias Action ForwardSend To Voice Mail Voice Mail Server Domain or IP Address Outbound ProxyFrom Domain Request-URI Domain Gateway Tel URIs Monitored SIP Servers Registrar and Session StatusActive Sessions Registered from Registered UsersMonitored SIP server Monitored SIP server status IP Address Selection ToolsPacket Capture Network Interface Selection Tools Any Icmp Test Results Check NetworkCollect data Check NetworkPage Tools 222 SIP over TCP/TLS Firewall and Client ConﬁgurationDMZ type SIP over UDP SIP clients DMZ/LAN type Standalone type SIP clients Part IV Com VCX IP Telecommuting Module Serial Console Page Main Menu Basic AdministrationConnecting to the serial console Wipe email logs Set passwordCommand line interface Exit admin Deactivate other interfaces Physical device name Conﬁgure from multiple computers Conﬁgure from a single computer Password Wipe email logs Exit admin Set password Basic Administration 236 Help and Troubleshooting Command Line ReferenceCommand Reference Modifying Tables Revert-edits List-tablesLoad-factory Modify-row Table Deﬁnitions Conﬁg.authlogclass Conﬁg.allowconﬁgConﬁg.allowviainterface Conﬁg.mgmtlogclass Conﬁg.authenticationConﬁg.httpservers Conﬁg.httpsservers Fentalwaysfentinterfaces Failover.ifacerefhostsFent.alwaysfent Fentalwaysfentexceptions Fent.mediarelease Fent.mapsignaladdressField Name Field Type Explanation Enabled OnOffToggle Fent.fentkeepalive ﬁrewall.dhcplogclass ﬁrewall.defaultpolicyﬁrewall.blindroutepolicy ﬁrewall.broadcastlogclass ﬁrewall.pingpolicy ﬁrewall.networkgroupsﬁrewall.ownlogclass ﬁrewall.timeclasses ﬁrewall.servicesﬁrewall.policylogclass ﬁrewall.spooﬁnglogclass Idsips.predeﬁnedipsrules Idsips.active Ipsec.espahlogclass Idsips.ratelimitedipsIpsec.cryptodef Ipsec.espproposals Ipsec.nattkeepalive Ipsec.ikelogclassIpsec.ikeproposals Ipsec.ipsecnets Field Name Field Type Ipsec.plutologclassIpsec.plutoverboselogclass Ipsec.radiusauthserver Ipsec.x509cacerts Ipsec.tunnelednetsIpsec.userauthlogclass Misc.dyndns Misc.conntracktimeoutsIpsec.x509cert Misc.dnsservers Field Name Field Type Explanation DomainName Misc.dyndnsnameMisc.fversion Misc.ntpservers Monitor.emailalertlogclass Monitor.cpuloadlevelalarmMisc.unitname Misc.usentp Monitor.logclasses Monitor.memorylevelalarmMonitor.radiuserrorslogclass Monitor.hardwarelogclass Monitor.snmpagentlogclass Monitor.siplevelalarmsMonitor.snmpagentaddress Monitor.snmppacketlogclass Monitor.snmpcontactpersonMonitor.snmpmanagementstations Monitor.snmpnodelocation Monitor.snmpv1v2cauth Monitor.snmpv1v2caccessMonitor.snmpv3access Monitor.snmptrapsending Network.aliasaddresses Network.extradefaultgatewaysMonitor.syslogservers Monitor.watchdogs Network.pppoe Network.interfacesNetwork.localnets Field Name Field Type Explanation Server DnsIpAddress Network.routetestserversNetwork.routes Network.vlans Pptp.pptplogclass Password.adminusersPptp.pptpenable Pptp.grelogclass Field Name Field Type Explanation PPTPOwnIpReference Pptp.pptpserveripPptp.pptpusers Pptp.pptpneglogclass Qos.classes Qos.bandwidths Qos.egressqueueing Qos.egressdefaultqueueingQos.ingressdefaultqueueing Qos.tagging Qos.ingressqueueingQos.sipcac Qos.status Sip.allowedcodecs Sip.acceleratedtlsSip.active Sip.addexpireheader Sip.codecﬁltering Sip.defaultgatewaySip.authmethods Sip.b2buaofferfromtemplate Field Name Field Type Explanation DnsIpAddress Sip.emergencySip.externradiusdb Sip.externalrelay Sip.forwardtoheader Sip.forwardcancelbodySip.ﬁxﬁletransferport Sip.forcemodify Field Name Field Type Explanation Action Sipﬁlteractionsel Sip.headerﬁlterdefaultSip.headerﬁlterrules Sip.ignoreuriportwhenmaddr Sip.localdomains Sip.largeudpSip.lcscompanion Sip.listen Sip.mediaencryptionpolicy Sip.looserefertoSip.looseusernamecheck Sip.lrtrue Field Name Field Type Explanation Portslower PortNumber Sip.mediaencryptionsettingsSip.mediaencryptionsuite Sip.mediaports Sip.mfull Sip.mediatimeoutsSip.mediarestriction Sip.message Sip.musiconhold Sip.optiontimeoutSip.mimetypes Sip.monitorserver Sip.preserve2543hold Field Name Field Type Explanation Timeout OptionTimeoutSip.outboundproxy Sip.percent20towhitespace Sip.relayrules Sip.radiusacctSip.recurseon3xxinb2bua Sip.registrarlimits Sip.ringback Sip.removeviaSip.replyconﬁg Sip.rewritetoforregisterindp Sip.rrouteoutbound Sip.routeusesportSip.routingorder Sip.rroutealways Sip.sipalias Sip.signaladdressfordestinationSip.siperrorslogclass Sip.sessionlimits Sip.sipmessagelogclass Sip.sipsignalinglogclassSip.siplicenselogclass Sip.sipmedialogclass Sip.surroundings Sip.tcptimeoutSip.sttype Sip.stripiceattributes Sip.tlsservercfg Sip.tlssettingsSip.tlscacerts Sip.tlsclientcfg Field Name Field Type Explanation Uriencodingsel Sip.transactionconﬁgSip.trusteddomain Sip.uriencoding Sip.uaregister Sip.usecancelbodyinackSipswitch.accounts Sipswitch.b2buatransferenable Field Name Field Type Explanation User AliasAlias Sipswitch.b2buatransferfromuserSipswitch.dialplan Sipswitch.dialplanenable Field Name Field Type Explanation Enabled Fallbacksel Sipswitch.dialplanmethodsSipswitch.enumroot Sipswitch.forwardto Field Name Field Type Explanation Url SipWildcardUrl Sipswitch.incomingunauthSipswitch.requestfrom Sipswitch.requestto Sipswitch.users Sipswitch.userrouting Voipsm.voipsm Sipswitch.voicemailUserdb.radiuslocalendpoint Userdb.radiusservers Voipsm.voipsmdomains AdminPasswordAdminTypeSel Field Types AuthData AdminUserAliasAlias AliasIpReference AliasUser DnsDynIpNetworkInterface DnsDynIpOtherHost CaReferenceCertReference CryptoDefReference DepUsableVlanInterface DnsDynIpAddress EspCryptoReference FirewallLogclassReference DyndnsPasswordDyndnsServiceSel EnumReference IpsecAuthSel InterfaceSelInviteRetransmitCount IpsRuleName MaxReg IsakmpSALifeLogclassReference MaxMessageSizeInteger OnOffToggleOn NonemptyStringOnOffButton OnOffToggle OptDepOwnIpReference OptDnsAutoRuntimeReachableHost OptDnsIpAddressOptComment OptDSCPInteger OptIpsecPeerReference OptForwardToReferenceOptIcmpRangeList OptIpsecNetReference OptPercentFloat OptPasswordOptServicesReference OptPercent OptTimeclassReference OptionTimeoutOptSipUserDomain OptString Percent PptpPasswordRegTimeout PPTPOwnIpReference SIPRadiusSel SessionTimeoutSipUserDomainDefaultAll SipUserPassword SubGroup SnmpPasswordTimerAFloat SipWildcardUrl Accountvoicemailsel Accounttypesel Bypasstransportsel AddexpireheaderselAutonegsel Blindsel Fentkeepalivesel ConﬁgauthselDpactionsel Fallbacksel Mediaencryptionsuitesel FunctionselFwtypesel Hitsnumber Qostypesel PingpolicyselPolicysel Pqueuesel Rfc2782priority Rfc2782weightRegexpwithAt Restfuncsel Sipsel SipauthdirselSipﬁlteractionsel Sipfunctionsel Sttypesel SnmptrapversionselSnmpv3authsel Snmpv3privacysel Tlsservermethods SysloglevelselTlsclientmethods Voipsmmethodsel TlsconfselTrusteddomaintransportsel Uriencodingsel Windownumber CLI command examplesAdd and change ﬁrewall rules Apply a conﬁguration Part V. Appendices Page SIP Protocol Why use SIP?Appendix A. More About SIP Conﬁguring the 3Com VCX IP Telecommuting Module Managing Your Own SIP DomainSIP and Firewalls Page Conﬁguring the SIP Clients Conﬁguring the PBXConﬁguring the DNS Server Establishing a SIP session SIP SessionsSIP in 3Com VCX IP Telecommuting Module Contact SIP Packet Headers Route Content-TypeVia Record-Route Appendix A. More About SIP 328 Trafﬁc discarded as spoofed Appendix B. TroubleshootingNetwork troubleshooting No trafﬁc shown in the log SIP Trunking calls via SIP operator SIP troubleshootingSIP users can’t register on the Telecommuting Module SIP users can’t register through the Telecommuting Module Call is established, but there is no voice Administration troubleshooting Destination IP addressport is known bad. Skipping SIP errorsLog Messages SIP send failure -1 on socket -1 event number Stopped SIP TCP server IPsec key negotiationsStarting SIP TCP server at port Starting SIP UDP server at port Conﬁguration server logins Name Port/protocol Description List of the most important reserved ports WWW Cmip Krcmd Kerberos encrypted remote shell -kfall Type Name List of Icmp types Icmp type Name Code Description Icmp codesType Name Reference Unreachable for Type Protocol number Keyword Internet protocols and their numbers IP intervals Set bits Mask IP address class Class IP in- tervals Reserved IP addressesPage ARP Appendix D. Deﬁnitions of terms DMZ 349 Https NAT Nntp 353 PPP SIP Uucp 357 Appendix D. Deﬁnitions of terms 358 Terms Appendix E. License ConditionsSoftware developed by Peter Åstrand BSD derived licenses Software developed by Carnegie Mellon University Software developed by Cisco Systems Software developed by Gregory M Christy Software developed by Digital Equipment Corporation Software developed by Jason Downs Dhcp license Software developed by Brian Gladman Preamble Software developed by Google, IncGNU General Public License GPL Version 2, June GNU General Public License 367 368 No Warranty IBM Public License Software developed in the GIE Dyade cooperation Software developed by Ingate Systems Software developed by Tommi Komulainen USA GNU Library General Public License Lgpl v 374 GNU Library General Public License 376 377 Page 379 380 Version 2.1, February GNU Lesser General Public License Lgpl v 382 GNU Lesser General Public License 384 385 386 Page Glibc Tzdata 2006a 388 Software in the GNU C distribution Appendix E. License Conditions Appendix E. License Conditions 392 More software in the GNU C distribution 394 License exceptions for gcc/libgcc2.c Disclaimer License exceptions for libstdc++License for lilo License Software developed by Paul Mackerras Software developed at M I T Software developed by Pedro Roque Marques Part 1 CMU/UCD copyright notice BSD like License for Net-SNMP Part 4 Sun Microsystems, Inc. copyright notice BSD Part 5 Sparta, Inc copyright notice BSD Part 6 Cisco/BUPTNIC copyright notice BSD License for OpenSSH License for NTP 404 Appendix E. License Conditions 406 407 Snprintf replacement Copyright Patrick Powell 409 License for OpenSSL License for OpenSWAN Release Derived Year Owner GPL- compatible? From Python license Terms and Conditions for Accessing or Otherwise Using Python Beopen Python Open Source License Agreement Version Cnri License Agreement for Python CWI License Agreement for Python 0.9.0 Through License for Python Imaging Library License for Rdisc More software developed by RSA Data Security, Inc Software developed by RSA Data Security, Inc License for SSL Software developed by Sun Microsystems, Inc License for stunnel License for Sun RPC More software developed by Sun Microsystems, Inc Software developed by Trusted Information Systems, Inc License for termcap Software developed by Paul Vixie Software developed by Andrew Tridgell Vovida Software License, Version Vovida Software License vSoftware developed by Rayan S Zachariassen Software developed at University of California License for zlib Openswan-kernel 427 Appendix E. License Conditions Appendix E. License Conditions Readlink Appendix E. License Conditions 430 Appendix F. Obtaining Support for Your 3Com Products Register Your Product to Gain Service BeneﬁtsSolve Problems Online Purchase Extended Warranty Professional Services Asia, Paciﬁc Rim Telephone Technical Support and Repair Access Software DownloadsContact Us Telephone Technical Support and Repair Country Telephone Number Latin America Telephone Technical Support and Repair US and Canada Telephone Technical Support and Repair Index For administration Conﬁguration logins From the Telecommuting Module MIBs