Filter
Top Products
146
D14049.03
MAY 2008
Grey Headline (continued)
TANDBERG VIDEO COMMUNICATIONS SERVER
ADMINISTRATOR GUIDE
Introduction Getting Started
Overview and
Status
System
Conguration
VCS
Conguration
Zones and
Neighbors
Call
Processing
Bandwidth
Control
Firewall
Traversal
Maintenance Appendices
Firewall Traversal Overview
The purpose of a rewall is to control the IP trafc entering your
network. Firewalls will generally block unsolicited incoming
requests, meaning that any calls originating from outside your
network will be prevented. However, rewalls can be congured
to allow outgoing requests to certain trusted destinations, and
to allow responses from those destinations. This principle is
used by TANDBERG’s Expressway™ solution to enable secure
traversal of any rewall.
The Expressway™ solution consists of:
a TANDBERG VCS Expressway or TANDBERG Border Controller 1.
located outside the rewall on the public network or in the
DMZ, which acts as the rewall traversal server
a TANDBERG VCS Control, TANDBERG Gatekeeper, MXP 2.
endpoint or other traversal-enabled endpoint located in a
private network, which acts as the rewall traversal client.
The two systems work together to create an environment where
all connections between the two are outbound, i.e. established
from the client to the server, and thus able to successfully
traverse the rewall.
How does it work?
The traversal client constantly maintains a connection via
the rewall to a designated port on the traversal server. This
connection is kept alive by the client sending packets at regular
intervals to the server. When the traversal server receives
an incoming call for the traversal client, it uses this existing
connection to send an incoming call request to the client.
The client then initiates the necessary outbound connections
required for the call media and/or signaling.
This process ensures that from the rewall’s point of view, all
connections are initiated from the traversal client inside the
rewall out to the traversal server.
The VCS Expressway has all the functionality of a VCS Control (including being able to act as a rewall traversal client). However, its
main feature is that it can act as a rewall traversal server for other TANDBERG systems and any traversal-enabled endpoints that are
registered directly to it. It can also provide STUN Discovery and STUN relay services to endpoints with STUN clients. These features
are enabled as follows:
In order for the VCS Expressway to act as a rewall traversal server for TANDBERG systems, you must create and congure a new
•
traversal server zone on the VCS Expressway for every system that is its traversal client. See Conguring the VCS as a Traversal
Server for full instructions.
In order for the VCS Expressway to act as a rewall traversal server for traversal-enabled endpoints (i.e. TANDBERG MXP endpoints
•
and any other endpoints that support the ITU H.460.18 and H.460.19 standards), no additional conguration is required. See
Conguring Traversal for Endpoints for more information on the options available.
To enable STUN Discovery and STUN Relay services, see
•
STUN Services.
To recongure the default ports used by the VCS Expressway, see
•
Conguring Traversal Server Ports.
Your VCS can act as a rewall traversal client on behalf of SIP and H.323 endpoints registered to it, and any gatekeepers that are
neighbored with it.
In order to act as a rewall traversal client, the VCS must be congured with information about the system(s) that will be acting as its
rewall traversal server. See the section on Conguring the VCS as a Traversal Client for full details on how to do this.
About Expressway™
!
In order for rewall traversal to function correctly, the VCS Expressway must have one traversal server zone congured on it
for each client system that is connecting to it (this does not include traversal-enabled endpoints which register directly with
the VCS Expressway; the settings for these connections are congured in a different way). Likewise, each VCS client must
have one traversal client zone congured on it for each server that it is connecting to. The ports and protocols congured for each
pair of client-server zones must be the same. (See Quick Guide to VCS Traversal Client - Server Conguration for a summary of the
conguration on each system.) Because the VCS Expressway listens for connections from the client on a specic port, we recommend
that you create the traversal server zone on the VCS Expressway before you create the traversal client zone on the VCS Control.
The rewall traversal server used by the VCS client can
be a TANDBERG VCS Expressway, or (for H.323 only) a
TANDBERG Border Controller.
VCS as a Firewall Traversal Client
VCS as a Firewall Traversal Server
In most cases, you will use a VCS Control as a rewall
traversal client. However, a VCS Expressway can also
act as a rewall traversal client.