149, Firewall Traversal | TANDBERG D14049.04 guide

Grey Headline (continued)

TANDBERG VIDEO COMMUNICATIONS SERVER

ADMINISTRATOR GUIDE

Firewall Traversal

This section describes how to configure your VCS Control and VCS Expressway in order to traverse firewalls. It also describes how to configure the additional firewall traversal server functions of a VCS Expressway, including STUN services.

Introduction

Getting Started

Overview and

System

VCS

Zones and

Call

Bandwidth

Firewall

Applications

Maintenance

Appendices

Status

Configuration

Neighbors

Processing

Control

Traversal

D14049.04

149

JULY 2008

Page 149

Image 149

TANDBERG D14049.04 manual 149, Firewall Traversal

Contents

Guide Preamble What’s in this Manual?Introduction Getting Started DNS Overview and Status NTP VCS Configuration Call Processing Zones and Neighbors Bandwidth Control 151 Applications Maintenance Appendices Copyright 2008, Tandberg Legal Notices Approvals Safety Instructions and ApprovalsSafety Instructions Waste Handling Digital User Guides Environmental IssuesTANDBERG’s Environmental Policy Environmental Issues Tandberg VCS Overview VCS and the Tandberg Total Solution VCS Expressway VCS Base ApplicationsVCS Control User Policy FindMe Standard Features Optional FeaturesDual Network Interfaces What’s New in this Version? Using this Administrator Guide Administrator GuideCommand Line Interface Typographical conventions Getting Started Installation Site Preparations InstallationGeneral Installation Precautions Connecting the Cables Powering on the VCS Initial Configuration via Serial Cable Initial Configuration Down key Initial Configuration via Front PanelUP key Overview System Administrator Access Select Administrator Login Using the Web InterfaceWeb Interface Supported Browsers General page features Using the Command Line Interface CLI Command Line Interface Supported CharactersTypes of Commands How Command are Shown in this Guide Overview and Status Viewing the Overview Understanding the Overview Overview System Information Speed EthernetStatus System Ethernet MAC address Viewing the IP Status Understanding the IP Status IP Status Status System Resource Usage Traversal calls Resource UsageViewing the Resource Usage Understanding the Resource Usage Viewing the Registrations Understanding the Registrations Registrations Reason Registration HistoryDuration End Time Publishers Presentities Subscribers PresenceViewing the Presence Status Pages Viewing the Calls Understanding the Calls Calls Status Call History Filter Call HistoryViewing the Call History Understanding the Call History Viewing the Search History Understanding the Search History Search HistoryAbout Searches Status Search History Viewing the Local Zone Understanding the Local Zone Local Zone Status Zones ZonesViewing the Zones Understanding the Zones Status Links LinksViewing the Links Understanding the Links Viewing the Pipes PipesUnderstanding the Pipes Status Pipes Viewing the Stun Relays Understanding the Stun Relays Stun Relays Status Applications ApplicationsViewing the Applications Understanding the Applications Status Warnings Viewing the Warnings Understanding the Warnings Viewing the Event Log Understanding the Event Log Event LogEvent Log Color Coding Event Log Levels Event Log Format Interpreting the Event Log Event Message Details Field Events and Levels Message Rejected Message ReceivedMessage Sent Registration Accepted System Restore error System Backup errorTLS Negotiation Error User session Login failure Viewing the Configuration Log Configuration LogUnderstanding the Configuration Log Types of Configuration Events System Configuration Overview Configuration System AdministrationAbout Administrator Access settings About the System Name XConfiguration Ethernet System Configuration EthernetAbout Ethernet Speed Ethernet speed XConfiguration IP XConfiguration IPProtocol Overview IP ConfigurationXConfiguration IP Route XCommand RouteAdd About IPv4 to IPv6 Gatewaying About LAN Configuration Overview LAN ConfigurationAbout Dual Network Interfaces IPv4 subnet mask About the DNS Domain Name XConfiguration IP DNSAbout DNS Servers XConfiguration NTP Address XConfiguration TimeZone Name System Configuration NTPAbout the NTP Server About the Time Zone About Snmp XConfiguration Snmp External Manager XConfiguration ExternalManagerAbout the External Manager Address About Logging LoggingAbout Remote Logging Remote Logging XConfiguration Log Level Setting the Event Log LevelLog Levels About Event Log Levels VCS Configuration Overview Endpoint Registration 323 XConfiguration H323 Configuring H.323 SIP Overview Using the VCS as a SIP RegistrarAbout SIP on the VCS SIP Registration Expiry SIP protocols and ports Using the VCS as a SIP Proxy ServerUsing the VCS as a SIP Presence Server XConfiguration SIP Configuring SIP Registrations, Protocols and Ports VCS Configuration Protocols SIP Domains Configuring SIP DomainsCancel View/Edit XConfiguration Interworking Mode Configuring InterworkingSave SIP interworking mode Interworking Registration Control MCU, Gateway and Content Server RegistrationRegistration Overview Endpoint Registration 323 Finding a VCS with which to RegisterPreventing automatic registrations H323 Gatekeeper AutoDiscovery Authentication Mode AuthenticationConfiguring Authentication Authentication for Local Registrations About External Registration Credentials Configuring External Registration Credentials Authentication using an Ldap Server Authentication DatabasesAlias Origin Setting XConfiguration Ldap XConfiguration Authentication Ldap Configuring Ldap Server settings Configuring the Local Database Authentication using a Local Database Registering Aliases Attempts to Register using an Existing AliasAbout Alias Registration Alias Registration About Allow and Deny Lists Allow and Deny ListsActivating use of Allow or Deny Lists Removing existing registrations Managing Entries in the Allow List XCommand AllowListAdd XConfigurationAllowList Registration XCommand DenyListAdd XConfigurationDenyList Registration VCS Configuration Registration Deny ListManaging Entries in the Deny List Add Deny List Pattern Zones and Neighbors About your Video Communications Network Example Network DiagramIntroduction Local Zone and Subzones Overview Configuring the Local Zone and its SubzonesBandwidth Management Local Zone Matches VCS Configuration Local Zone Traversal Subzone Configuring the Traversal Subzone PortsTraversal Subzone What are traversal calls? Neighbor Zone About Zones Traversal Client Zone Traversal Server Zone XCommand DefaultLinksAdd Enum Zone DNS Zone Default Zone VCS Configuration Zones Adding Zones Configuring ZonesXCommand ZoneAdd XConfiguration Zones Zone Match1 Match5 Configuring Zones All TypesHop count Configuring Neighbor Zones Retry interval Configuring Traversal Client ZonesAuthentication username Configuring Traversal Server Zones DNS suffix Configuring Enum Zones Configuring DNS Zones Cluster Subzone Clustering, Peers and AlternatesAbout Clustering DNS Configuration Administration Accounts IP configurationPrerequisites System Name Registrations Backup and RestoreSIP Registrations Upgrading to Clustering and FindMe Viewing Peers ConfigurationClustering and Presence Enabling the Replication of FindMe Information Peer 1...Peer 6 address 100Neighboring the Local VCS to a Cluster Dial Plans 101 Call Processing 102 Search Process Call Processing Diagram103 Dialing by Address Types 104Dialing by IP Address Dialing by H.323 or SIP URI Dialing by Enum XConfiguration Zones Zone 1..200 HopCount About Hop Counts Configuring Hop Counts105 Hop Counts Searches and Transforms 106Overview of Searches and Transforms Pre-Search Transforms 107 Configuring Pre-Search TransformsXConfiguration Transform Zone Searching and Transforming 108 Default Settings Configuring Zone Searches and Transforms109 Local Zone Examples 110Combining Match Types and Priorities Never Query a Zone Filter Queries to a Zone Without Transforming 111 Query a Zone for Original and Transformed Alias 112 Query a Zone for Two or More Transformed Aliases 113 Authentication Mode On About Call Policy Administrator Policy and AuthenticationAuthentication Mode Off 114 Enabling the use of Administrator Policy Administrator PolicyVCS Configuration Call Policy Administrator Policy Mode 116 Configuring Administrator Policy via the Web Interface About CPL XSD files 117Uploading a CPL Script H323 118URI Dialing 119 Configuring Matches for DNS ZonesURI Dialing for Outgoing Calls Process XCommand ZoneAdd XConfiguration Zones Zone Adding and Configuring DNS Zones120 Advanced 121 Configuring DNS ServersXConfiguration IP DNS Server URI Dialing for Incoming Calls 122 Recommended Configuration Example DNS Record Configuration123 URI Dialing and Firewall Traversal Overview Process Enabling Enum Dialing 124Enum Dialing Enum Dialing for Outgoing Calls 125Example 7.6.5.4.3.2.1.4.4 Configuring Transforms for Enum Zones Configuring Matches for Enum ZonesMode of PatternMatch Pattern string Pattern type of Prefix 126 Click Create Zone Configuring Enum Zones127 128 129 Configuring DNS Naptr RecordsEnum Dialing for Incoming Calls About DNS Domains for Enum XConfiguration Call Services Recommended Configuration for Firewall Traversal130 Unregistered Endpoints XConfiguration Call Services Fallback Alias Overview Configuration Example Usage131 Fallback Alias Identifying a Particular Call 132Call IDs, Serial Numbers and Tags Disconnecting a Call via the Web Interface Disconnecting CallsIssues when Disconnecting SIP Calls 133 Bandwidth Control 134 Bandwidth Control on the VCS Example Network Deployment 135Bandwidth Control Overview 136 About the Default SubzoneSubzones Specifying the Subzone IP Addresses Subzone Links Creating a Subzone XCommand SubZoneAdd137 138 Configuring a SubzoneXConfiguration Zones LocalZone SubZone Applying Bandwidth Limitations to Subzones 139Types of Limitations How Different Bandwidth Limitations are Managed XCommand LinkAdd Default Links140 About Links Creating Links Editing Links XConfiguration Bandwidth Link141 About Default Links Default LinksPre-Configured Links 142 About Pipes Creating Pipes XCommand PipeAdd143 144 XConfiguration Bandwidth PipeEditing Pipes Editing an Existing Pipe Applying Pipes to Links 145One Pipe, One Link One Pipe, Two or More Links About the Default Call Bandwidth Default Bandwidth and DownspeedingConfiguring Default Call Bandwidth and Downspeeding 146 Example Without a Firewall 147Bandwidth Control Examples VCS Control Subzone Configuration VCS Expressway Subzone Configuration148 Example With a Firewall Firewall Traversal 149 Firewall Traversal Overview 150About Expressway VCS as a Firewall Traversal Client How does it work? VCS Expressway Server Quick Guide to VCS Traversal Client Server Configuration151 Firewall Traversal Protocols and Ports 152Overview Expressway Process Firewall Traversal Protocols SIP Firewall Traversal Protocols 153 Call signalingMedia SIP Ports Authentication and NTP Firewall Traversal and AuthenticationConfiguration Zones Edit Zone, in the Configuration section 154 155 Other Issues 156 Configuring the VCS as a Traversal ClientAdding a New Traversal Client Zone TraversalClient Create Zone 157 Configuring a Traversal Client Zone 158 Configuring the VCS as a Traversal ServerAdding a New Traversal Server Zone TraversalServer Create Zone Client authentication username Configuring a Traversal Server ZoneDemux mode 159 160 Configuring Traversal for EndpointsXConfiguration Zones LocalZone Traversal H323 161 Configuring Traversal Server Ports 162 Stun Services 163 Configuring Stun Services 164 FindMe User Policy 165 XConfiguration Policy UserPolicy Configuring User Policy Manager166 Enabling FindMe on the VCS About User Accounts Creating a New User Account 167Managing FindMe User Accounts 168 Changing a User PasswordViewing Existing User Account Settings Are you sure...? 169Deleting a User Account Accessing the FindMe Configuration Using TANDBERG’s FindMe170 About your FindMe User Account 171 Configuring your FindMe User Account Overview Presence Server 172 Presence User Agent PUA 173Aggregation of Presence Information Registration refresh period Enabled Enabling and Disabling Presence ServicesDisabled 174 Viewing Presence Status 175Publishers Presentities 176 Maintenance Installing and Restarting Overview Upgrading Using SCP/PSCP177 Upgrading Software Upgrading via the Web Interface 178 Software successfully upgraded Software upgrade in progress179 Restart system Downgrading Software Downgrade Procedure Impact on features introduced180 181 XConfiguration Option 1..64 KeyOption Keys Overview Adding Options via the CLI 182 Maintenance Option KeysAdding Options via the Web Interface Add option key Overview Enabling Security 183Security 184 Administration AccountsAdding an Administration Account 185 Editing an Administration AccountAccount Disabled This account can not be used Overview Creating a Backup of your VCS Configuration Backup and Restore186 Limitations 187 Restoring a Previous Backup 188 Error ReportsSystem Snapshot Overview Creating a System Snapshot XCommand Boot Maintenance Restart189 Restarting 190 Maintenance ShutdownShutting Down Overview Shutting Down Overview DefaultValuesSet Level Restoring Default ConfigurationXCommand DefaultValuesSet Level 3 must be 191 Overview Maximum length of Passwords Password EncryptionCommand Line Interface 192 Appendices 193 194 Address-switchCPL Reference Overview of CPL on the VCS Field 195 Otherwise Not-present 196Subfield 197 Rule-switchLocation Reject 198 Call Screening of Authenticated UsersCPL Examples Call Screening Based on Alias Call Screening Based on Domain 199Change of Domain Name Dont accept calls from this source Address Address is=DefaultSubZone Block Calls from Default Zone and Default Subzone200 Allow Calls from Locally Registered Endpoints Only Using the address-switch node Restricting Access to a Local GatewayUsing the rule-switch node 201 Regular Expression Reference 202Overview Common Regular Expressions Matches 0 or more repetitions of the previous match Pattern Variable Reference 203 204 VCS Configuration Protocols H.323VCS Port Reference VCS Ports XConfiguration SIP TCP Port XConfiguration Traversal Server Stun Relay PortXConfiguration SIP TLS Port XConfiguration H323 Gatekeeper CallSignaling PortRange End XConfiguration SIP TCP Outbound Port End XConfiguration SIP TCP Outbound Port StartXConfiguration Traversal Media Port Start 206 207 DNS ConfigurationOverview Microsoft DNS Server Verifying the SRV Record Downloading the Ldap schemas Ldap Configuration208 About the Ldap Databases Adding H.350 Objects 209Securing with TLS Create the Organizational Hierarchy OpenLDAP Include /etc/openldap/schemas/sipidentity.ldif210 Slapadd -l ldif file 211# MeetingRoom1 endpoint 212 Command Reference xConfiguration 213 214 Example Configuration Applications Presence Server Mode On 215 Example xConfiguration Bandwidth Downspeed Total Mode On Example xConfiguration Bandwidth Downspeed PerCall Mode OnExample xConfiguration Bandwidth Link 1 Node1 Name HQ 216 217 Example xConfiguration Bandwidth Pipe 1 Name 512Kb AsdlExample xConfiguration Error Reports Mode Off Example xConfiguration Ethernet 1 IP V4 SubnetMask Example xConfiguration Ethernet 1 IP V4 AddressExample xConfiguration Ethernet 1 Speed Auto Example xConfiguration ExternalManager Address 219 Example xConfiguration H323 Gatekeeper CallTimeToLiveExample xConfiguration H323 Gatekeeper TimeToLive 220 221 222 223 Example xConfiguration Policy UserPolicy Mode Local 224 Example xConfiguration Registration RestrictionPolicy NoneExample Configuration SIP Loop Detect Mode On 225 226 Example xConfiguration SystemUnit Password password123 Example xConfiguration SystemUnit Name Oslo HQ VCSExample xConfiguration TimeZone Name GMT Example xConfiguration Transform 1 Pattern Behavior Replace 228 Example xConfiguration Traversal Server Stun Relay Mode On Example xConfiguration Traversal Server Stun Discovery Port229 Example Traversal Server Stun Relay Port 230 231 Example xConfiguration Zones LocalZone Match 1..5 Priority 232 233 234 235 Example xConfiguration Zones Zone 1 H323 Mode On 236 Example xConfiguration Zones Zone 1 HopCount Example xConfiguration Zones Zone 1 Name UK Sales Office Example xConfiguration Zones Zone 1 Match 1 PriorityExample xConfiguration Zones Zone 1 Neighbor H323 Port 237 238 Example xConfiguration Zones Zone 1 Neighbor Peer 1 AddressExample xConfiguration Zones Zone 1 Neighbor SIP Port 239 Example xConfiguration Zones Zone 1 SIP Mode On 240 Example xConfiguration Zones Zone 3 TraversalServer SIP Port 241 Example xConfiguration Zones Zone 1 Type Neighbor 242 Command Reference xCommand Example xCommand AllowListDelete AllowListId Example xCommand AdminAccountDelete AdminAccountIdExample xCommand boot 243 244 Example xCommand DefaultLinksAdd Example xCommand CredentialDelete CredentialIdExample xCommand DefaultValuesSet Level Example xCommand DenyListDelete DenyListId Example xCommand DomainDelete DomainId Example xCommand DomainAdd DomainName example.comExample xCommand FeedbackDeregister ID 246 247 248 Example xCommand LinkDelete LinkId 249 Example xCommand OptionKeyAdd Key 1X4757T5-1-60BAD5CDExample xCommand OptionKeyDelete OptionKeyId 250 Example xCommand PipeDelete PipeIdExample xCommand RouteDelete RouteId 251 Example xCommand SubZoneDelete SubZoneId2 252 Example xCommand TransformDelete TransformIdExample xCommand ZoneDelete ZoneId 253 Example xCommand ZoneList Alias john.smith@example.com 254 Command Reference xStatus SystemUnit 255 Ethernet 256 NTP 257 Calls 258 259 Registrations 260 Zones 261 262 263 Links 264 Alternates 265 SIP 266 Stun 267 268 269 Bibliography 270 Glossary 271 Fqdn 272 Term Definition Local VCS 273 RTP 274 VCS 275 Contact Information 276