TANDBERG D14049.04 Network Card User Manual


 
150
D14049.04
JULY 2008
Grey Headline (continued)
TANDBERG VIDEO COMMUNICATIONS SERVER
ADMINISTRATOR GUIDE
Introduction Getting Started
Overview and
Status
System
Conguration
VCS
Conguration
Zones and
Neighbors
Call
Processing
Bandwidth
Control
Firewall
Traversal
Appendices
Applications Maintenance
Firewall Traversal Overview
The purpose of a rewall is to control the IP trafc entering your
network. Firewalls will generally block unsolicited incoming
requests, meaning that any calls originating from outside your
network will be prevented. However, rewalls can be congured
to allow outgoing requests to certain trusted destinations, and
to allow responses from those destinations. This principle is
used by TANDBERG’s Expressway™ solution to enable secure
traversal of any rewall.
The Expressway™ solution consists of:
a TANDBERG VCS Expressway or TANDBERG Border Controller 1.
located outside the rewall on the public network or in the
DMZ, which acts as the rewall traversal server
a TANDBERG VCS Control, TANDBERG Gatekeeper, MXP 2.
endpoint or other traversal-enabled endpoint located in a
private network, which acts as the rewall traversal client.
The two systems work together to create an environment where
all connections between the two are outbound, i.e. established
from the client to the server, and thus able to successfully
traverse the rewall.
How does it work?
The traversal client constantly maintains a connection via
the rewall to a designated port on the traversal server. This
connection is kept alive by the client sending packets at regular
intervals to the server. When the traversal server receives
an incoming call for the traversal client, it uses this existing
connection to send an incoming call request to the client.
The client then initiates the necessary outbound connections
required for the call media and/or signaling.
This process ensures that from the rewall’s point of view, all
connections are initiated from the traversal client inside the
rewall out to the traversal server.
The VCS Expressway has all the functionality of a VCS Control (including being able to act as a rewall traversal client). However, its
main feature is that it can act as a rewall traversal server for other TANDBERG systems and any traversal-enabled endpoints that are
registered directly to it. It can also provide STUN Discovery and STUN relay services to endpoints with STUN clients. These features
are enabled as follows:
In order for the VCS Expressway to act as a rewall traversal server for TANDBERG systems, you must create and congure a new
traversal server zone on the VCS Expressway for every system that is its traversal client. See Conguring the VCS as a Traversal
Server for full instructions.
In order for the VCS Expressway to act as a rewall traversal server for traversal-enabled endpoints (i.e. TANDBERG MXP endpoints
and any other endpoints that support the ITU H.460.18 and H.460.19 standards), no additional conguration is required. See
Conguring Traversal for Endpoints for more information on the options available.
To enable STUN Discovery and STUN Relay services, see
STUN Services.
To recongure the default ports used by the VCS Expressway, see
Conguring Traversal Server Ports.
Your VCS can act as a rewall traversal client on behalf of SIP and H.323 endpoints registered to it, and any gatekeepers that are
neighbored with it.
In order to act as a rewall traversal client, the VCS must be congured with information about the system(s) that will be acting as its
rewall traversal server. See the section on Conguring the VCS as a Traversal Client for full details on how to do this.
About Expressway™
!
In order for rewall traversal to function correctly, the VCS Expressway must have one traversal server zone congured on it
for each client system that is connecting to it (this does not include traversal-enabled endpoints which register directly with
the VCS Expressway; the settings for these connections are congured in a different way). Likewise, each VCS client must
have one traversal client zone congured on it for each server that it is connecting to. The ports and protocols congured for each
pair of client-server zones must be the same. (See Quick Guide to VCS Traversal Client - Server Conguration for a summary of the
conguration on each system.) Because the VCS Expressway listens for connections from the client on a specic port, we recommend
that you create the traversal server zone on the VCS Expressway before you create the traversal client zone on the VCS Control.
The rewall traversal server used by the VCS client can
be a TANDBERG VCS Expressway, or (for H.323 only) a
TANDBERG Border Controller.
VCS as a Firewall Traversal Client
VCS as a Firewall Traversal Server
In most cases, you will use a VCS Control as a rewall
traversal client. However, a VCS Expressway can also
act as a rewall traversal client.