TANDBERG D14049.01 Adding a New Traversal Server Zone

103

D 14049.01

07.2007 103

Introduction Getting

Started

System

Overview

System

Configuration

H.323 & SIP

Configuration

Registration

Control

Zones and

Neighbors

Call

Processing

Firewall

Traversal

Bandwidth

Control Maintenance Appe ndices

Firewall

Traversal

Configuring the VCS as a Traversal Server

Overview

The VCS has an optional Border Co ntroller

feature. Once this has been enabl ed, you will

be able to:

Allow your VCS to act as a traversal

server for other VCSs and TANDBE RG

Gatekeepers. You do this by adding a new

traversal server zone on th e VCS, and

configuring it with details of t he traversal

client.

Provide firewall traversal for an y TANDBERG

MXP endpoints registered di rectly with it.

You can configure the protocols and p orts

that will be used.

Enable and configure STUN ser vices.

Configure the ports use d specifically for

firewall traversal serv ices.

The following sections descr ibe how to

configure each of the above opt ions.

•

•

•

•

Adding a New Traversal Server Zone

VCS Configuration > Zones.

You will be taken to the Zones page.

Select New.

You will be taken to the Create Zone page.

xCommand ZoneAdd

•

•

Name

Enter the name you wish to give to this zon e.

The name acts as a unique identif ier, allowing

you to distinguish between zones.

Type

From the Type drop-down m enu, select

TraversalServer.

Create Zone

Click here to create the zone. You will be

taken directly to the Edit Zone pa ge, where

you can configure the traver sal server zone as

required.

TANDBERG VIDEO COMMUNICATION SERVER

ADMINISTRATOR GUIDE

Firewall Traversal

Contents

Main Software version X1.0 D14049.01 July 2007 VIDEO COMMUNICATION SERVER ADMINISTRATOR GUIDE Whats in this ADMINISTRATOR GUIDE? VIDEO COMMUNICATION SERVER Getting Started 13 Viewing System Overview 18 System Configuration 19 Logging 27 Working with H.323 33 Working with SIP 35 Interworking 38 Registration Control 39 Call Processing 60 Administrator Policy 63 User Policy 67 Using TANDBERGs FindMe 72 Alias Searching and Transforming 74 ENUM Dialing 87 Calls to and from Unregistered Endpoints 93 Fallback Alias 94 Disconnecting calls 95 Firewall Traversal 97 Maintenance 122 Regular Expression Reference 178 DNS Configuration 179 LDAP Configuration 180 Bibliography 18 3 Glossary 184 Trademarks and Copyright Disclaimer Copyright Notice Patent Information Disclaimer, Copyrights and License Agreements Safety Instructions and Approvals Environmental Issues TANDBERGs Environmental Policy European Environmental Directives Waste Handling Information for Recyclers Page Introduction Connecting the Cables Whats in the Box? Installation Site Preparations General Installation Precautions Power cable Shielded serial cable Ethernet cable Powering on the VCS Initial Configuration via Serial Cable About Administrator Access Security Considerations Configuring Administrator Access Administrator Account Password Default Administrator Password Using the Web Interface Supported Browsers Using the Command Line Interface (CLI) Viewing System Overview Viewing the Overview Page Understanding the Overview Page Configuring System Settings System Administration Configuration System name About the System Name Session time out (minutes) Configuring Ethernet Settings Ethernet Configuration About Ethernet Speed Ethernet speed About IPv4 to IPv6 Gatewaying Configuring IP Settings IP Configuration IP protocol IPv4 address About DNS Servers DNS Configuration About the DNS Domain Name Configuring DNS Settings Domain name NTP Configuration About the NTP Server Setting the Time Zone Configuring NTP Settings NTP server About SNMP Settings SNMP Configuration Configuring SNMP Settings Location Enabled About the External Manager External Manager Configuration Configuring External Manager Settings Address Path Backing up Configuration Settings Enabling Remote Logging About Remote Logging Setting the Event Log Level About Event Log Levels Level Assigned Events Message Details Field Field Example Description Event Log Format Field Description Viewing the Event Log Events Logged at Level 1 Events Logged at Level 1 cont... Events Logged at Level 2 Events Logged at Level 3 Event Data Fields Field Description Event Data Fields cont... Field Description About H.323 on the VCS Call Time to Live Configuring H.323 Ports Working with H.323 H.323 Overview Time to Live H.323 Endpoint Registration Auto Discover Registration Conflict Mode Working with H.323 Configuring H.323 Auto discover Call signaling TCP port Registration conflict mode SIP protocols and ports SIP Overview Using the VCS as a SIP Registrar Proxying Registration Requests About SIP on the VCS Configuring SIP - Registrations, Protocols and Ports Configuring SIP - Domains About Interworking Interworking Overview Configuring Interworking H.323 <-> SIP interworking mod e Endpoint Registration Registration Overview MCU, Gateway and Content Server Registration Registrations on a VCS Border Controller Registration Overview Finding a VCS with which to Register SIP H.323 Auto discover About Authentication Authentication database Configuring Authentication Authentication username Authentication password Authentication using an LDAP Server Alias Origin Setting Configuring the LDAP Server Directory Securing the LDAP Connection with TLS Server IP address Configuring LDAP Server settings Authentication using a Local Database Credentials Create Credential Configuring the Local Database About Alias Registration H.323 Registering Aliases SIP Registration conflict mode SIP Alias Registration About Allow and Deny Lists Patterns and Pattern Types Allow and Deny Lists Restriction policy Activating use of Allow or Deny Lists Allow and Deny lists Managing Entries in the Allow List Add Allow List Pattern Registration Allow List Allow and Deny lists Managing Entries in the Deny List Registration Deny List Add Deny List Pattern About your Video Communications Network About the Local Zone and its Subzones Local Zone and Subzones Configuring the Local Zone and its Subzones DNS Zone About Zones Zones Default Zone Neighbor Zone Adding Zones Configuring Zones Neighbor TraversalClient TraversalServer ENUM Configuring Zones - All Types Alternate 1 to Alternate 5 address Configuring Neighbor Zones Configuring Traversal Client Zones Retry interval Alternate 1 to Alternate 5 address UDP retry interval UDP retry count Configuring Traversal Server Zones H.323 mode Authentication DNS suffix Configuring ENUM Zones Configuring DNS Zones About Alternates Alternate 1 to Alternate 5 IP addres s Configuring Alternates About Dial Plans Setting up a Dial Plan Flat Dial Plan Structured Dial Plan Hierarchical Dial Plan Locating a Destination Endpoint About the Different Address Types IP address Dialing by IP Address Dialing by Address Types Dialing by H.323 ID or E.164 alias Configuring Hop Counts About Hop Counts Hop Counts About Administrator Policy Administrator Policy and Authentication Enabling the use of Administrator Policy Administrator Policy Mode On Off Source Destination Configuring Administrator Policy via the Web Interface Add New Administrator Policy Add Commit Configuring Administrator Policy via a CPL script Uploading a CPL Script Upload File Select the new policy file Download Policy file What is User Policy? About User Policy Who Must do What Before FindMe Can Be Used? Process Overview User Policy Manager Enabling User Policy on the VCS Off Local Remote Configuring User Policy Manager Path About User Accounts Creating a New User Account Username Initial password FindMe name Changing a User Password New password Confirm password Change Password Restore to Default Deleting a User Account Are you sure...? Using TANDBERGs FindMe About FindMe FindMe User Accounts Individual versus Group FindMe About your FindMe User Account Using TANDBERGs FindMe Configuring your FindMe User Account Ring the primary devices Adding a device to a list Removing a device About Searches About Transforms Local Alias Transform Process If the Transformed Alias is Not Found Locally Replace string Configuring Local Alias Transforms Transforming an Alias Before Searching Locally: Configuration Create Transform Zone Search and Transform Process Zone Searching and Transforming About Zone Transforms About Zone Searching Using Zone Searches and Transforms Together Mode Default Settings Zone searching and alias transforming: configuration Configuring Zone Searches and Transforms Pattern behavior Pattern type Combining Match Types and Priorities Always Query a Zone, Never Apply Transforms Never Query a Zone Filter Queries to a Zone Without Transforming Changing the Prefix or Suffix Before Querying Query a Zone for Two or More Transformed Aliases Query a Zone for Both Original and Transformed Alias About URI Dialing URI Dialing Overview Enabling URI Dialing via the VCS Outgoing Calls Incoming Calls Configuring Matches for DNS Zones Adding and Configuring DNS Zones Configuring DNS Servers Types of DNS Records Required URI Dialing for Incoming Calls Configuring H.323 SRV Records Location SRV Records Call SRV Records URI Dialing for Incoming Calls URI Dialing and Firewall Traversal Example DNS Record Configuration A AAAA Recommended Configuration About ENUM Dialing Enabling ENUM Dialing Outgoing Calls Incoming Calls ENUM Dialing Overview Page Page Configuring ENUM Zones DNS suffix Configuring DNS Servers Configuring DNS NAPTR Records About DNS Domains for ENUM ENUM Dialing for Incoming Calls Calls to an Unregistered Endpoint Recommended Configuration for Firewall Traversal About Unregistered Endpoints Calls from an Unregistered Endpoint Calls to and from Unregistered Endpoints Configuration Example Use of a Fallback Alias example.com Fallback alias Fallback Alias About the Call Control API Call ID Number Call Serial Number Disconnecting calls Overview Identifying a Particular Call Obtaining the Call ID/Serial Number Call ID number Call serial number Disconnecting calls Disconnecting a Call via the Web Interface Disconnecting a Call via the CLI Issues when Disconnecting SIP Calls Disconnect About Firewall Traversal VCS as a Firewall Traversal Server VCS as a Firewall Traversal Client Firewall Traversal Overview VCS and Firewall Traversal Page Firewall Traversal Protocols and Ports Ports for Connections out to the Public Internet STUN Ports Firewall Configuration Firewall Traversal and Authentication Client Type and Client Settings Server Type and Server Settings Configuring the VCS as a Traversal Client Adding a New Traversal Client Zone Configuring the VCS as a Traversal Client Configuring a Traversal Client Zone Retry interval H.323 mode H.323 port H.323 protocol Adding a New Traversal Server Zone Configuring a Traversal Server Zone H.323 mode H.323 port H.323 protocol SIP mode Configuring Traversal for Endpoints H.323 Assent mode H.460.18 mode H.460.19 demux mode H.323 preference Configuring Traversal Server Ports Media demultiplexing RTP por t Media demultiplexing RTCP por t H.323 Assent call signaling port H.323 H.460.18 call signaling port About STUN STUN Services STUN Relay STUN Binding Discovery About ICE Configuring STUN Services STUN Services STUN discovery mode STUN relay port STUN relay mode Example Network Deployment About Bandwidth Control Bandwidth ControlBandwidth Control About Subzones Bandwidth Consumption of Traversal Calls Traversal Calls About the Default Subzone Creating a Subzone Subnet Subnet 1 Subnet 2 - 5 Bandwidth Configuring a Subzone Types of Limitations Limitation Description Can be applied to How Different Bandwidth Limitations are Managed Applying Bandwidth Limitations to Subzones Creating Pipes Create Pipe About Pipes Creating a new pipe Total bandwidth mode Editing Pipes Editing an Existing Pipe Total bandwidth mode Total bandwidth (kbps) Per call bandwidth mode Per call bandwidth (kbps) Creating Links Node 1, Node 2 Pipe 1, Pipe 2 Create Link Default Links Editing Links Editing Links One Pipe, One Link Default LinksApplying Pipes to Links One Pipe, Two or More Links Two Pipes, One Link Automatically Created Links About Downspeeding Default call bandwidth (kbps) Downspeed per call mode Downspeed total mode About the Default Call Bandwidth Bandwidth Control Examples Example Without a Firewall Bandwidth Control Examples Example With a Firewall VCS Border Controller Subzone Configuration Enterprise VCS Subzone Configuration About Upgrading the VCS Software Upgrading Using SCP/PSCP Upgrading Software Backing up the Existing Configuration Before Upgrading Release key Upgrading Upgrading via the Web Interface Page Add option key Add Option Option Keys Adding Options via the Web Interface System Information About Security Select the file containing tr usted CA... Upload CA certificate Select the server private key f ile Select the server certi ficate file System Snapshot Passwords About the System Snapshot Creating a System Snapshot Changing the Administrator Password Shutting Down Restarting About Restarting Restart System About Shutting Down On Off LocalDatabase LDAPDatabase : a remote LDAP LDAP Endpoint Combined On Off Page Direct Indirect Off Auto 10half 10full 100half 100full 1000full None: On Off Reject Overwrite On Off Off RegisteredOnly On Both IPv4 IPv6 Off TLS On Off Off Local Remote HTTP HTTPS Page Off ProxyToKnownOnly ProxyToAny On Off Exact Prex Sufx Strip Page Page Page Page Page On Off Always Pattern Disabled Exact Prex Sufx Leave Strip Page On Off Neighbor TraversalClient TraversalServer ENUM DNS Page 1 2 3 Page Page Page Page Exact Prex Sufx Strip Neighbor TraversalClient TraversalServer ENUM DNS Page Command Reference - xStatusCommand Reference - xStatus Page Page Page Page Page Page Page Page Page Page Page Page address-switch node address otherwise node not-present node Field Page Unsupported CPL Elements CPL Script Actions location proxy reject rule-switch Call Screening of Authenticated Users Call Screening Based on Alias vpengineering Change of Domain Name Call Screening Based on Domain Allow Calls from Locally Registered Endpoints Only Block Calls from Default Zone and Default Subzone Restricting Access to a Local Gateway Regular Expression Reference About Regular Expressions Character Description Example DNS Conguration Verifying the SRV Record BIND 8 & 9 Overview Microsoft DNS Server About the LDAP Databases Downloading the H.350 schemas Adding H.350 Objects Prerequisites Securing with TLS Microsoft Active Directory Installing the H.350 Schemas Securing with TLS Adding H.350 Objects OpenLDAP Prerequisites Installing the H.350 Schemas Bibliography Reference Title Link