Configuring Stun Services | TANDBERG D14049.01 specs

Firewall Traversal

TANDBERG VIDEO COMMUNICATION SERVER ADMINISTRATOR GUIDE

Configuring STUN Services

To configure the STUN Binding Discovery and STUN Relay services:

•VCS Configuration > Border Controller > STUN.

You will be taken to the STUN page.

•xConfiguration Traversal Server

STUN

STUN Services

STUN discovery mode

Determines whether the VCS will offer STUN

Discovery services to traversal clients.

STUN discovery port

Specifies the port on the VCS on which it will be listening for STUN Discovery requests.

STUN relay mode

Determines whether the VCS will offer STUN

Relay services to traversal clients.

STUN relay port

Specifies the port on the VCS on which it will be listening for STUN relay requests.

STUN relay media port start

Specifies the lower port in the range to be used for STUN media relay.

STUN relay media port end

Specifies the upper port in the range to be used for STUN media relay.

Save

Click here to save your changes.

Introduction

Getting

System

System

H.323 & SIP

Registration

Zones and

Call

Firewall

Bandwidth

Maintenance

Appendices

Started

Overview

Configuration

Configuration

Control

Neighbors

Processing

Traversal

Control

D 14049.01

108

07.2007

Image 108

TANDBERG D14049.01 manual Configuring Stun Services, XConfiguration Traversal Server

Contents

Video Communication Server Administrator Guide System Configuration Getting Started Table of Contents Administrator Policy Using TANDBERG’s FindMeCall Processing User Policy Enum Dialing Disconnecting calls Calls to and from Unregistered EndpointsFallback Alias Firewall Traversal Maintenance DNS Configuration 79Ldap Configuration 80 Regular Expression Reference 78 Trademarks and Copyright Copyright 2007, Tandberg Disclaimer, Copyrights and License Agreements DisclaimerPatent Information Safety Instructions and Approvals Safety InstructionsApprovals Environmental Issues Environmental Issues Main Product Features Standard FeaturesOptional Features Introduction Connecting the Cables Getting StartedTandberg VCS Powering on the VCS Initial Configuration via Serial Cable System Administrator Access Using the Web Interface Supported Browsers Using the Command Line Interface CLI ViewingText goesSystemhere Overview Viewing the OverviewUnderstanding the Overview Systemtext Configuration Configuring System SettingsAbout Admin Access settings System Administration Configuration Configuring Ethernet Settings Ethernet ConfigurationXConfiguration Ethernet About Ethernet Speed Configuring IP Settings IP ConfigurationXConfiguration IP XConfiguration IPProtocol About IPv4 to IPv6 Gatewaying DNS Configuration Configuring DNS SettingsXConfiguration IP DNS About DNS Servers Configuring NTP Settings Setting the Time ZoneNTP Configuration XConfiguration NTP Address XConfiguration TimeZone Name Configuring Snmp Settings About Snmp SettingsSnmp Configuration XConfiguration Snmp Configuring External Manager Settings External Manager ConfigurationXConfiguration ExternalManager About the External Manager Backing up Configuration Settings Logging Logging Overview Viewing the Event Log Event LogEvent Log Format Message Details Field Events Logged at Level DNS Events Logged at Level 1 Event Data Fields TCP UDP TLSSIP 225 245 For Register requests the AOR for the Register request Number of bytes sent/received in the messageRequest/granted registration expiry duration Limitations of standard syslog timestamps WorkingText goeswithhereH.323 Overview Endpoint Registration Configuring H.323 XConfiguration H323 WorkingText goeswithhereSIP SIP Overview Configuring SIP Registrations, Protocols and Ports XConfiguration SIP Configuring SIP Domains XCommand DomainAdd XConfiguration SIP Domains Configuring Interworking XConfiguration Interworking ModeInterworkingesText here Overview MCU, Gateway and Content Server Registration RegistrationText goes hereControlEndpoint Registration Registration Overview Finding a VCS with which to Register 323Preventing automatic registrations H323 Gatekeeper AutoDiscovery About Authentication AuthenticationConfiguring Authentication XConfiguration Authentication Authentication using an Ldap Server Alias Origin SettingConfiguring the Ldap Server Directory Securing the Ldap Connection with TLS Configuring Ldap Server settings XConfiguration Ldap XConfiguration Authentication Authentication using a Local Database Configuring the Local DatabaseNew Create Credential Attempts to Register using an Existing Alias About Alias RegistrationRegistering Aliases Alias Registration XConfiguration Registration RestrictionPolicy About Allow and Deny ListsPatterns and Pattern Types Allow and Deny Lists XCommand AllowListAdd XConfiguration Registration AllowList Managing Entries in the Allow List XCommand DenyListAdd XConfiguration Registration DenyList Managing Entries in the Deny ListAdd Deny List Pattern Registration Deny List Managing Zones, Neighbors and Alternates About your Video Communications NetworkExample Configuring the Local Zone and its Subzones Local Zone and SubzonesAbout the Local Zone and its Subzones Zones Adding Zones Configuring Zones XCommand ZoneAddXConfiguration Zones Zone Create Zone Configuring Zones All Types Hop countMatch1 Match5 Configuring Neighbor Zones SIP port Configuring Traversal Client Zones Retry intervalProtocol SIP transport Configuring Traversal Server Zones Configuring Enum Zones Configuring DNS ZonesDNS suffix Determines whether H.323 calls will be allowed to this zone About Alternates Configuring Alternates XConfiguration AlternatesAlternate 1 to Alternate 5 IP address Setting up a Dial Plan About Dial PlansFlat Dial Plan Structured Dial Plan CallText Processinggoeshere Locating a Destination EndpointProcess Dialing by Address Types Configuring Hop Counts XConfiguration Zones Zone 1..200 HopCountAbout Hop Counts Hop Counts Administrator Policy About Administrator PolicyAdministrator Policy and Authentication Authentication Mode On Enabling the use of Administrator Policy To enable Administrator PolicyAdministrator Policy Mode Administrator Policy Mode to take effect Configuring Administrator Policy via the Web Interface Configuring Administrator Policy via a CPL script Uploading a CPL ScriptAbout CPL XSD files Downloading policy files UserText goesPolicyhere About User Policy Configuring User Policy Manager XConfiguration Policy UserPolicyEnabling User Policy on the VCS Username About User Accounts Managing FindMe User AccountsCreating a New User Account Changing a User Password Viewing Existing User Account Settings Deleting a User Account To change delete a FindMe user accountTick the box next to the account you wish to delete Click here to delete the selected accounts Using TANDBERG’s FindMe FindMe User Accounts Accessing the FindMe ConfigurationAbout your FindMe User Account About FindMe Configuring your FindMe User Account AliasText goSearchingshere and Transforming Configuring Local Alias Transforms XConfiguration Transform Zone Searching and Transforming Configuring Zone Searches and Transforms Default SettingsZone searching and alias transforming configuration Combining Match Types and Priorities ExamplesNever Query a Zone Always Query a Zone, Never Apply Transforms Filter Queries to a Zone Without Transforming Changing the Prefix or Suffix Before QueryingUser@example.com User@exampleusa.com Query a Zone for Both Original and Transformed Alias Query a Zone for Two or More Transformed Aliases URITextDialinggoeshere URI Dialing Overview Configuring Matches for DNS Zones URI Dialing for Outgoing CallsAn AlwaysMatch, or Adding and Configuring DNS Zones XCommand ZoneAdd XConfiguration Zones ZoneClick Create Zone Assigns a name to this zone Configuring DNS Servers XConfiguration IP DNS Server URI Dialing for Incoming Calls Example DNS Record Configuration Recommended ConfigurationURI Dialing and Firewall Traversal ENUMText goesDialinghere About Enum DialingEnum Dialing Overview Enum Process Prerequisites Enum Dialing for Outgoing Calls Configuring Matches for Enum Zones Configuring Transforms for Enum ZonesMode of PatternMatch Pattern string Pattern type of Prefix Configuring Enum Zones For Enum zones, this will be Enum Configuring DNS Servers Configuring DNS Naptr Records About DNS Domains for EnumEnum Dialing for Incoming Calls Configuration Recommended Configuration for Firewall TraversalCallsText gtoesandherefrom Unregistered Endpoints Calls to an Unregistered Endpoint XConfiguration Call Services Fallback Alias FallbackText goesAliashereFallback Alias Example Use of a Fallback Alias DisconnectingText goes herecalls Identifying a Particular Call Disconnecting a Call via the Web Interface Disconnecting a Call via the CLIIssues when Disconnecting SIP Calls Disconnect Firewall Traversal Firewall Traversal OverviewAbout Firewall Traversal VCS as a Firewall Traversal Client VCS as a Firewall Traversal Server Firewall Traversal Protocols and Ports Ports for Connections out to the Public Internet Stun Ports323 Firewall Traversal and Authentication VCS Configuring the VCS as a Traversal Client Adding a New Traversal Client ZoneFrom the Type drop-down menu, select TraversalClient Create Zone Configuring a Traversal Client Zone Alternate 1 Alternate 5 Address Configuring the VCS as a Traversal Server Adding a New Traversal Server ZoneTraversalServer Create Zone Configuring a Traversal Server Zone Demux modeTCP retry count Interval Configuring Traversal for Endpoints XConfiguration Zones LocalZone Traversal H323 Configuring Traversal Server Ports Assent call signaling port323 H.460.18 call signaling port Media demultiplexing RTP port Stun Services About StunStun Binding Discovery Stun Relay Configuring Stun Services XConfiguration Traversal Server Bandwidthth Controll About Bandwidth ControlExample Network Deployment Subzones XCommand SubZoneAdd BandwidthControlCreating a Subzone Configuring a Subzone To configure a subzoneXConfiguration Zones LocalZone SubZone Subnet 2 Applying Bandwidth Limitations to Subzones Types of LimitationsHow Different Bandwidth Limitations are Managed Per call inter Limits the bandwidth of any individual call XCommand PipeAdd About PipesCreating a new pipe Creating Pipes XConfiguration Bandwidth Pipe Editing an Existing PipeEditing Pipes Default Links XCommand LinkAddAbout Links Creating Links Creating a New Link XConfiguration Bandwidth Link Editing LinksEditing Links Default Links Bandwidth ControlApplying Pipes to Links About the Default Call Bandwidth Configuring the Default Call Bandwidth and DownspeedingAbout Downspeeding Bandwidth Control Examples Example Without a Firewall VCS Border Controller Subzone Configuration Enterprise VCS Subzone ConfigurationExample With a Firewall MaintenanceText goes here Backing up the Existing Configuration Before UpgradingUpgrading Using SCP/PSCP Upgrading Software Upgrading via the Web Interface Upgrading XConfiguration Option 1..64 Key S 0 Option KeysAbout Adding Extra Options Adding Options via the CLI Adding Options via the Web Interface Add option keyAdd Option Click Add Option About Security Enabling SecuritySecurity Passwords System SnapshotAbout the System Snapshot Creating a System Snapshot XCommand Boot RestartingAbout Restarting About Shutting Down CommandText goes hereReference xConfiguration HttpHttps SSH Total Mode On/Off AliasOrigin LDAP/Endpoint/CombinedRequest Off the call will be rejected One call Far end were registered directly to the local system Fallback Alias S 0 H323 Gatekeeper CallSignaling TCPPort NTP Option Key S 0 Tration will not be permitted On the VCS will act as a DIP registrarOff the VCS will not act as a SIP registrar 137 Snmp CommunityName S 0 Rtcp RTPStun For any one call to or from an endpoint in the Default Between two endpoints within the Default SubzoneTraversal Server For any one call between two endpoints within Intra Mode None/Limited/Unlimited To or from an endpoint in this subzone Limit Sets the total bandwidth limit in kbps of this subzoneName S 1 Assigns a name to this subzone Subnet Address S 0 Zones LocalZone Traversal H323 Cont Order to keep the firewall’s NAT bindings openRetryCount VCS will attempt to send a TCP probe to the VCS Enum 145 Transport TCP/TLS TCP TCP will be usedTLS TLS will be used Plexing mode for calls from the traversal client Zones TraversalClientOff Each call will use a separate pair of ports for Zones TraversalServer TCPProbe KeepAliveInterval Cont CommandText goes hereReference xCommand XCommand Description ParametersList, the registration will be permitted PatternType Exact/Prefix/Suffix/Regex XCommand Description ParametersList, the registration will not be permitted Event/AuthenticationFailure Status/EthernetStatus/NTP Status/LDAP LinkAdd LinkDelete Locate OptionKeyAdd OptionKeyDelete Pipe1 S 1Pipe2 S 1 153 SubZoneAdd SubZoneDelete PerCallInterMode None/Limited/UnlimitedPerCallInter To Limited TransformAdd TransformDelete ZoneAdd ZoneDelete Each transform ZoneList CommandText goes hereReference xStatus Option Key S 1 Description S 1 Server Address IPv4Addr/IPv6Addr Domain S 0 NTP External Manager Status On/Off URL S 1,255 Expression S 1,127 0..15 entries 160 161 Contact S 1,255 Path URI 1..10 S 1,255 Zones 163 164 165 166 167 IPv4 Status Active/Inactive/Failed Address IPv4AddrStatus Active/Inactive/Failed Address IPv4Addr IPv6 Status Active/Inactive/Failed Address IPv6Addr 169 Address-switch node CPLText ReferencgoeshereAddress Otherwise node Authentication Mode On SetupField Subfield URIUrl-ID 323 ID H323-ID Dialled Digits DialedDigits Rule-switch CPL Script Actions LocationUnsupported CPL Elements Proxy Call Screening of Authenticated Users CPL ExamplesCall Screening Based on Alias Vpengineering Call Screening Based on Domain Change of Domain Name Block Calls from Default Zone and Default Subzone Allow Calls from Locally Registered Endpoints Only Restricting Access to a Local Gateway RegularText goesExpressionhere Reference About Regular ExpressionsWill match against any sequence of characters For a detailed description of regular expression syntax see DNSText goesConfiguhereation Overview Microsoft DNS ServerVerifying the SRV Record Bind 8 LDAPText goesConfigurationhere About the Ldap Databases Downloading the H.350 schemas Installing the H.350 Schemas Microsoft Active DirectoryAdding H.350 Objects Securing with TLS . Copy the OpenLDAP files to the OpenLDAP schema directory . Add the ldif file to the server using the commandOpenLDAP Add the H.350 Objects Bibliography Reference Title Link Glossary Term Definition IRQ LANLRQ NAT Session Initiation Protocol Protocol used to monitor network devicesFirewall NAT traversal for SIP. Defined by RFC 3489 Reliable communication protocol defined by RFC 791 187