Abstract. WJR; Reviewed: WCH 3/4/2003. Solution & Interoperability Test Lab Application Notes 2003 Avaya Inc. All Rights Reserved.

Transcription

1 Configuring the Avaya VSU Series of VPN Gateways to Support an IP Trunk Between an Avaya IP Office Server and Avaya IP600 Internet Protocol Communication Server Issue 1.0 Abstract These Application Notes describe how to configure an Avaya VSU 100 Gateway and Avaya VSU 5000 Gateway for a Voice over IP (VOIP) trunk between an Avaya IP403 Office Server and Avaya IP600 Internet Protocol Communication Server. An Avaya P130 Workgroup Switch and an Avaya P333T Stackable Switch are used for the Layer 2 switched networks. Avaya P333R Multilayer Switches with Avaya X330W-2DS1 Router Expansion Modules provide T1 Wide Area Network (WAN) connectivity. 1 of 28

2 * 8 # * 8 # 1. Introduction These Application Notes describe how to configure an Avaya VSU 100 Gateway and Avaya VSU 5000 Gateway to create a Virtual Private Network (VPN) for Voice over IP (VoIP) traffic between an IP Office Server and an IP600 Server. The configuration of Avaya Cajun Network Switches with the Avaya X330W-2DS1 Router Expansion Modules to implement a Point-to-Point Protocol (PPP) over a T1 Wide Area Network (WAN) is also described. Separate voice and data Virtual Private Networks (VPNs) can be configured because of the way the IP Security (IPSec) protocol is used. The IPSec protocol will discard packets that arrive out of order past a certain window to prevent replay attacks. If low and high priority traffic share this type of IPSec tunnel, and the low priority traffic gets held up due to congestion, it can get discarded at the tunnel far end due to the replay attack prevention, even though there is adequate bandwidth. Figure 1 shows the network configuration described in these Application Notes. Digital Telephone / 24 IP Office Server.2 P333R Switch with X330W- 2DS1 Module Analog Telephone P130 Switch.199 PC1/Office Manager.101 IP Telephone 1 PPP/T VSU 100 Gateway 802.1Q Trunk VSU 5000 Gateway P333T Switch with X330W- 2DS1 Module PC2 IP Telephone / 24 Digital Analog Telephone Telephone IP600 Server Figure 1: Virtual Private Network Configuration 1.1. Background: Layer 3 Quality of Service Settings In this configuration, the Differentiated Services Code Point (DSCP) in the IP header will be the key to determining a packet s priority. The DSCP field is 6 bits plus two Currently Unused (CU) bits as shown below DSCP CU 2 of 28

3 DSCP: differentiated services codepoint CU: currently unused Some systems, like the X330W-2DS1 module, use the decimal value of the 6 bit DSCP field in administration. Others, like the IP Office Server use the hexadecimal value of the 8 bit byte. So, it is important to know how to translate between types. For this configuration, 3 DSCP values were used: For Voice RTP traffic, least delay tolerant, set DSCP for Expedited Forwarding o DSCP value = = Decimal 46 (Byte Value=0xB8) For Voice TCP signaling, packet loss sensitive, set DSCP for Assured Forwarding ): o DSCP value = = Decimal 38 (Byte Value=0x98) For all others, DSCP = Equipment and Software Validated The following equipment and software were used for the sample configuration provided: Equipment Software Avaya IP Office Server Firmware Manager Software 1.3 (10) 3.3 (4) Avaya IP600 Internet Protocol Communication Server R010c Avaya IP Telephones 1.6 Avaya 6400 Series Telephone - Avaya X330W-2DS1 Router Access Module Avaya 333T Stackable Switch 3.11 Avaya P333R Multilayer Switch 3.11 Avaya P133 G2 Workgroup Ethernet Switch Avaya VSU 5000 Gateway Avaya VSU 100 Gateway Avaya X330W-2DS1 Router Access Module Configuration This section provides the instructions for configuring the X330W-2DS1 modules. Connect from the PC to the X330W-2DS1 console interface via a console cable and run a terminal emulator, such as Hyperterminal, to access the command line interface. 3 of 28

4 Step 1: Create an IP access list and set the QOS policy source Configuration Description ip access-list-name 100 "phone" ip access-list-dscp operation "fwd6" ip access-list-dscp operation fwd7 ip access-list-dscp trust 100 trust-dscp! set qos policy-source local The access list includes the trust-dscp line to ensure that the module looks to the DSCP field for priority rather than the layer 2 priority field. The decimal values of the 6-bit DSCP field are consistent with the VSU markings for Expedited Forwarding (Decimal 46) and Assured Forwarding (Decimal 38). Though not shown here, it is good form to ensure that all of the DSCP values are set to the desired forwarding priority. The module will read policy rules for prioritization from this configuration (local) rather than an external server. Figure 2: IP Access List Step 2: Configure the T1 Interface Configuration ds-mode t1! controller T1 2 linecode b8zs framing esf clock source internal cablelength short 133ft channel-group 0 timeslots 1-4 speed 64 Description In this configuration, the second T1 interface was used. The first 4 timeslots are joined in a channel group and set to use the full 64 Kbps for data. Figure 3: T1 Interface 4 of 28

5 Step 3: Configure the Serial Interface Configuration Description! The interface Serial 2:0 is a logical interface Serial 2:0 interface associated with the second T1 description "T1 2 to IP Office WAN Mod" interface. The bandwidth is set to 256 Kbps to bandwidth 256 correspond to the T Kbps channelgroup encapsulation ppp 0. PPP protocol is enabled. Access ip access-group 100 in group 100, defined earlier in the configuration ip access-group 100 out file, is applied bi-directionally to the ip address interface.! Figure 4: Serial Interface Step 4: Configure the FastEthernet port Configuration Description! interface FastEthernet 1 description "IP600 LAN via VSU5000 Public" For the X330W-2DS1 module on the IP600 Server side, the fast Ethernet interface is set to , which will be used as the ip address default route in the VSU 5000 gateway. (For ip routing-mode rt_primary_mgmt! the X330WAN module on the IP Office Server side, the fast Ethernet is set to , which will be the default route in the VSU 100 gateway.) Figure 5: FastEthernet port Step 5: Configure the IP route Configuration Description ip route low For the X330W-2DS1 module on the IP600 Server side, a static route is set to forward all traffic to (the VSU 100 gateway public-side subnet) over the PPP link. (For the X330W-2DS1 module on the IP Office Server side, the static link is set to forward all traffic to (the VSU 5000 gateway public side subnet) over the PPP link. Figure 6: IP Route Note: To forward nonencrypted traffic, additional routing entries must be added. 5 of 28

6 4. Avaya VSU 100 and VSU 5000 Gateway Configuration As shown in Figure 7, 2 Virtual Private Networks were created. The ipoffice-ip600-voice VPN will handle all traffic between the IP Office Server subnet and the IP600 Server MEDPRO and C-LAN cards. The IPOFFICEtoIP600 VPN will be configured to handle all other traffic. Packets to IP600 C-LAN and MEDPRO ipoffice-ip600-voice VPN Packets from IP600 C-LAN and MEDPRO VSU 100 Gateway VSU 5000 Gateway Other Packets to IP600 Subnet Other Packets from IP600 Subnet IPOFFICEtoIP600 VPN Figure 7: Voice and Data VPNs As described later in this Application Note, the IP600 Server and IP Office Server were configured such that all VoIP traffic will pass though the IP600 Server C-LAN and MEDPRO cards and thus use this voice VPN. Note that there is a small amount of non-voice traffic (e.g., pings) that will also use this VPN. The VSUs will be configured to mark the DSCP fields of the IP headers of the encrypted traffic so that the Wide Area Network devices can forward according to the marked priority. More detail on the procedures of this section can be found in the VPNmanager Administrator s Guide [VPNADMIN]. Step 1: VSU Quick Start configuration a) Follow the VSU Quick Start sheet instructions to enter the data shown in Table 1. VSU 100 gateway VSU 5000 gateway Public IP Address Public IP Mask Secondary IP address Default route Permit All non-vpn traffic Y Y VSU Console Password Default Default VSU superuser name/password Default Default Table 1 6 of 28

7 The IP address associated with the private interface (the secondary IP address) will serve as the default gateway for endpoints on their respective LANs. The default routes are set such that all forwarded traffic, not part of the private side subnet, will be forwarded through the X330W-2DS1 modules. b) Reboot each VSU so that these settings take effect The following steps assume that VPN manager is installed and running on a PC that is networked on the Public side of the VSUs (e.g., on the or subnets of this configuration) as per the VPNmanager Administration Guide [VPNADMIN]. Step 2: Create a Domain for this VPN a) From the VPN Manager Main window, from the VPN Domain menu, select New. b) In the New Domain Dialog Box Name text box, enter a name and click Apply. Step 3: Configure the VSUs a) Select Config and from the Configuration Console window, select VSU and click New to start the VSU Setup Wizard. b) Enter a name in the text box, and then click Next. c) Select New VSU Setup and click Next. d) Enter the public side IP address in the VSU Data IP Address/DNS name text box that was assigned to the VSU in the Quick Start procedure. e) Select Save and then Update VSUs. When you press OK at the VSU update dialog box after the update has successfully completed, the General tab will be updated as shown in Figure 8 and Figure 9. The IP Groups associated with this VSU box will be filled in a later step. 7 of 28

8 Figure 8: VSU 5000 Gateway Object Figure 9: VSU 100 Gateway Object 8 of 28

9 Step 4: Add Policies to the VSUs to set DSCP a) Click on the Policies tab of one of the VSU objects and select Packet Filtering from the drop down box and click Go. At the packet filtering/qos dialog box, select Add and follow the wizard to make the following rules: Action Permit Permit Permit Permit Permit QOS mark AF43 (Assured Forwarding) AF43 (Assured Forwarding) EF (Expedited Forwarding) EF (Expedited Forwarding) Inherit Protocol (User-defined) TCP (User-defined) TCP (Userdefined) UDP (Userdefined) UDP From Port 1720 to 1720 Any to Any Any Range To Port Range Any 1720 to 1720 Any to Any From IP Any Any Any Any Any address To IP Address Any Any Any Any Any Interface Private Private Private Private Private Direction In In In In Out b) Ensure at the Policies tab that all policies are enabled, and repeat this operation for each VSU, as shown in Figure 10: Any 9 of 28

10 Figure 10: Policy Manager Step 5: Create three IP Groups. a) From the Configuration Console Objects column, select IP Group. b) Click the New box and enter an IP Group Name from Table 2. c) Click Apply and then Close. d) Click Add and enter the IP Address and Mask. e) Repeat step d for each entry in this group. f) Click the Associate this group with VSU drop down box and select the corresponding VSU. g) Repeat from step b for each group. The final screens should appear as in Figure 11, Figure 12, and Figure 13. IP Group Name Membership Membership IP Addresses IP600-MEDPRO-CLAN IP600 Server MEDPRO and C-LAN IP addresses / / IP600 All IP Addresses in the subnet above.32 (to / / of 28

11 exclude the MEDPRO and C-LAN IP addresses.) IP Office The entire subnet Table / / Figure 11: IP600-Medpro-CLAN IP Group 11 of 28

12 Figure 12: IP600 IP Group Figure 13: IP OFFICE IP Group 12 of 28

13 Step 6: Create the voice and data VPNs a) From the Configuration Console Objects column, click VPN. b) From the button bar, click New. c) Enter a Name and a VPN Type as shown in Figure 14. d) Click Apply and Close. e) Repeat for each VPN. Figure 14: New VPN Step 7: Assign the IP Groups to the VPNs a) Click the Members-IP Groups tab for each VPN (See Figure 15 and Figure 16) b) From the Available list, assign the IP groups to the VPN as shown in. All traffic to and from the IP600 Server MEDPRO and C-LAN cards will be carried in the voice VPN, while other traffic will be carried in the data VPN. The IP Office Server and IP600 Server configurations will ensure that all voice related traffic is directed through the IP600 Server MEDPRO and C-LAN cards. 13 of 28

14 Figure 15: ipoffice-ip600-voice VPN Figure 16: IP OFFICE to IP600 VPN VPN 14 of 28

15 Step 8: VPN Security a) To alter VPN Security Parameters, click VPN from the configuration menu, click Security IKE (or IPSec) tab or VPN IPSec tab of the particular VPN Object and adjust accordingly. Default IKE parameters are used in this configuration, as shown in Figure 17 and Figure 18. Figure 17: VPN Internet Key Exchange Security 15 of 28

16 Figure 18: VPN IPSec settings 16 of 28

17 Step 9: Enable the VPNs a) From the Configuration Console, click the VPN Object and click on each VPN and ensure that Enable VPN is checked as shown in Figure 19. Step 10: Save to VSUs Figure 19: VPN Details a) From the Configuration Console click Update VSUs to download the configuration to the VSUs and verify that the Manager indicates success for each VSU. 5. Avaya IP Office Server Configuration This section describes the IP Office Server settings for the IP Trunk to the IP600 Server. For detailed IP Office Server to IP600 Server IP trunk configuration instructions please see reference [IPO-IP600]. The steps below assume that the IP Office Server has a LAN connection to the PC running the IP Office Server Manager Application. Step 1: System Configuration a) From the Manager Configuration Tree, select System Configuration and click the LAN1 tab to change the IP Office Server IP address to one from the IP subnet assigned for this location, as shown in Figure 20. b) Click the Disable DHCP mode radio button. (We are using static addressing for this configuration). c) Enter the IP Address for this Server and the IP Mask. 17 of 28

18 Figure 20: System Configuration LAN1 d) Click the System tab and enter the TFTP Server IP Address and ensure that the Locale is set to US English ( enu ). Figure 21: System Configuration-System 18 of 28

19 e) Click the Gatekeeper tab and ensure that the Gatekeeper Enable box is set. Voice packets are marked with the given DiffServ Code point, in this case 0xB8, which translates to Expedited Forwarding. Step 2: Set up IP Office Routing Figure 22: System Configuration - Gatekeeper f) From the Manger Configuration Tree, select IPRoute and right click to select New to create an IP route so that the IP Office uses the VSU gateway as the next hop router for traffic to the IP600 Server subnet. The VSU gateway private side was assigned an IP address of in the VSU configuration section. (Other endpoints on the IP Office Subnet will use the IP Office IP address ( ) as the next hop gateway). Figure 23: IP Route 19 of 28

20 Step 3: Create a VPN Line (IP Trunk) a) From the Manager Configuration Tree, select Line, right click and select New to create a new entry for the VPN Line. The Line Number must be unique. Number of channels should be no greater than the bandwidth between the systems will allow. Remember that encryption and compression of the VPN devices can affect the packet size, and thus the total number of simultaneous channels. The number of channels provisioned in the corresponding IP600 Server Trunk Group form must be equal to the number of Voice channels entered here. Channels following the same incoming call routing treatment should be assigned the same Incoming Group ID. Figure 24: Line Configuration b) Select the VoIP tab, and set IP600 Server CLAN IP address as the Gateway IP Address. The compression mode setting must correspond to the IP600 Server ip-codec-set setting, such as G.711mulaw for the best sound quality or G.729 for good sound quality with less bandwidth used. Check the Enable FastStart and Out of Band DTMF boxes. To simplify VPN configuration, set Allow Direct Media Path unchecked so that all VoIP packets are routed through the IP Office Server and IP600 Server MEDPRO cards in all cases. If direct media path operation is desired, ensure that the Voice VPN includes all endpoints (e.g., IP phones) that will be using direct media paths. 20 of 28

21 Step 4: Add a Phone extension Figure 25: Line Configuration-VOIP a) From the Manager Configuration Tree, select Extension, right click and select New to create an IP phone entry. Assign a unique Extension ID and Extension as shown in Figure 26. Figure 26: VPN Extension 21 of 28

22 b) Click the VoIP tab, and set Allow Direct Media Path to unchecked. Figure 27: VPN Extension- VoIP Step 5: Saving changes to the IP Office Server a) Under the Manager File Menu item, select Save. At the Send Config to dialog box, click the immediately reboot mode radio button and press OK. b) If you have changed the IP Office Server IP address, you need to update the PC address and to reset the Manager preferences setting under the File menu before reconnecting. 6. Avaya IP600 Internet Protocol Communication Server Configuration As with the IP Office Server configuration, the configuration of the IP600 Server is generally independent of the intervening VPN. This section summarizes the IP600 Server settings for the IP Trunk to the IP Office Server. All license and system parameter settings are assumed. For detailed IP600 Server to IP Office Server IP trunk configuration instructions, please see reference [IPO-IP600]. Step 1: General IP Settings a) At the command line prompt, type change ip-network-region 1 to update the network region as shown in Figure 28. The UDP Port Range for the VoIP media traffic must be consistent with the port range specified in the VSU Policies section, where the range for expedited forwarding was set. Setting the DSCP marking for voice traffic outside the VPN tunnel is done here as well. Note that Direct IP-to-IP Audio Connections and Hairpinning are disabled to force all voice traffic through the IP600 Server MEDPRO and C- LAN cards, consistent with the voice VPN configuration. (If Direct IP-to-IP Audio Connections is enabled, ensure that the IP address of each endpoint is included in the voice VPN.) 22 of 28

23 change ip-network-region 1 Page 1 of 2 IP Network Region Region: 1 Name: General VOIP Region Audio Parameters Codec Set: 1 UDP Port Range Min: Max: DiffServ PHB Value: p/Q Enabled? n Direct IP-IP Audio Connections? n IP Audio Hairpinning? n Figure 28: Network Region b) Type change ip-codec-set 1 to specify the type of coding to use on this trunk. (This entry must be consistent with the IP Office Line VoIP tab setting.). change ip-codec-set 1 Page 1 of 1 Codec Set: 1 IP Codec Set Audio Silence Frames Packet Codec Suppression Per Pkt Size(ms) 1: G.711MU n : 3: 4: 5: Figure 29: IP Codec Set c) Type change node-names ip to enter the IP addresses for the CLAN, MEDPRO and IP Office Server. Note that the addresses of the IP Nodes must be from the VSU voice VPN IP Groups. change node-names ip IP NODE NAMES Name IP Address IP600-Clan IP600-Medpro IPoffice default Figure 30: IP Node Names d) Type change ip-interfaces to ensure that both the CLAN and MEDPRO interfaces are enabled and the Gateway address for each is the private side Address of the VSU 5000 gateway. 23 of 28

24 change ip-interfaces Page 1 of 6 IP INTERFACES Enable Net Eth Pt Type Slot Code Sfx Node Name Subnet Mask Gateway Address Rgn y C-LAN 01A04 TN799 C IP600-Clan y MEDPRO 01A05 TN2302 IP600-Medpro Figure 31: IP Interfaces e) Type add data-module to configure a communication link for the CLAN card. change data-module Page 1 of 1 DATA MODULE Data Extension: Type: ethernet Port: 01A0417 Link: 1 Name: clan ip 1a04 Network uses 1's for Broadcast Addresses? y Figure 32: Data Module Step 2: IP Trunk Configuration a) Type add signaling group 5 to create a signaling group for the IP trunk as shown in Figure 33. For the IP Trunk, the Near-end Listen Port and Far-end Listen Port must be consistent with the VPN VSU Policies setting for the policy that marks the TCP traffic priority. Note also that the Direct IP-IP Audio Connections and IP Audio Hair-pinning options are set to n. (All voice traffic for this example will be through the IP600 Server C-LAN and MEDPRO cards.) Trunk Group for channel selection will be entered after the next step. change signaling-group 5 Page 1 of 5 SIGNALING GROUP Group Number: 5 Group Type: h.323 Remote Office? n Max number of NCA TSC: 0 Max number of CA TSC: 0 Trunk Group for NCA TSC: Trunk Group for Channel Selection: 5 Supplementary Service Protocol: a Network Call Transfer? n Near-end Node Name: IP600-Clan Far-end Node Name: IPoffice Near-end Listen Port: 1720 Far-end Listen Port: 1720 Far-end Network Region: LRQ Required? n Calls Share IP Signaling Connection? y RRQ Required? n Bypass If IP Threshold Exceeded? n Figure 33: Signaling Group Direct IP-IP Audio Connections? n IP Audio Hairpinning? n Interworking Message: PROGress 24 of 28

25 b) Type add trunk-group 5 to create the trunk group as shown in Figure 34 and Figure 35. change trunk-group 5 Page 1 of 1 TRUNK GROUP Group Number: 5 Group Type: isdn CDR Reports: y Group Name: IP Trunk to COR: 21 TN: 1 TAC: 105 Direction: two-way Outgoing Display? y Carrier Medium: IP Dial Access? y Busy Threshold: 99 Night Service: Queue Length: 99 Service Type: tie Auth Code? n TestCall ITC: unre Far End Test Line No: TestCall BCC: 4 TRUNK PARAMETERS Codeset to Send Display: 6 Codeset to Send National IEs: 6 Max Message Size to Send: 260 Charge Advice: none Supplementary Service Protocol: a Digit Handling (in/out): enbloc/enbloc Trunk Hunt: cyclical Digital Loss Group: 13 Calling Number - Delete: Insert: Numbering Format: Bit Rate: 1200 Synchronization: async Duplex: full Disconnect Supervision - In? y Out? y Answer Supervision Timeout: 0 Figure 34: Trunk Group, Page 1 change trunk-group 5 Page 2 of 10 TRUNK FEATURES ACA Assignment? n Measured: none Wideband Support? n Internal Alert? n Maintenance Tests? y Data Restriction? n NCA-TSC Trunk Member: Send Name: y Send Calling Number: y Used for DCS? n Suppress # Outpulsing? n Numbering Format: unk-pvt Outgoing Channel ID Encoding: preferred UUI IE Treatment: service-provider Send UUI IE? y Send UCID? n Send Codeset 6/7 LAI IE? y Replace Restricted Numbers? n Replace Unavailable Numbers? n Send Connected Number: y Network (Japan) Needs Connect Before Disconnect? n Figure 35: Trunk Group, Page 2 c) Add the same number of channels to the IP Trunk Group as you configured on the corresponding IP Office VoIP line (Figure 25). Type IP as the Port entry, and 5 for the Sig Grp entry for each desired channel. 25 of 28

26 change trunk-group 5 Page 4 of 10 TRUNK GROUP Administered Members (min/max): 1/20 GROUP MEMBER ASSIGNMENTS Total Administered Members: 20 Port Code Sfx Name Night Sig Grp 1: T : T : T : T : T : T : T : T : T : T : T : T : T : T : T Figure 36: Trunk Group, page 4 d) Go back to the Signaling Group (Figure 33) and set Trunk Group for Channel Selection to this trunk group (5). (You must busy the signaling group from the command line to make the change, then release when you are done.) e) Set up call routing to this trunk group as described in [IPO-IP600], which describes how to setup Uniform Dial Plan (UDP) and Automatic Alternate Routing (AAR) to route calls to extensions (in this configuration, 70xxx) dialed at the IP600 to the IP Office over the designated trunk group (in this configuration, trunk group 5) 7. Layer 2 Switch Quality Of Service Configuration There are no VPN specific settings in this example for the layer 2 equipment. However, a few notes about Quality of Service here are in order. Please see [P130QOS] for more information. Quality of Service design is important whenever there is potential for resource contention. So, for example, if traffic from a 100 Mbps port could contend for the VSU port with voice traffic, QOS settings should be enabled. The following steps were followed for the layer 2 switches used in this example: For the P133G2, supply the multi-layerpolicy license to enable the switch to include layer 3 considerations (i.e., DSCP marking) in priority forwarding: set license 1 multilayerpolicy xxxxxxxxxxxxxx (where xxxxxxxxxxxxxx is the license number). Set the priority level of voice ports (e.g., IP Phone ports) to 7 26 of 28

27 set port level 1/3 7 Use 802.1Q trunks between layer 2 switches to pass priority markings: set trunk 1/13 dot1q 8. Conclusion The configuration of Avaya VPN and Wide Area Network products to support IP trunks between IP Office Server and IP600 Server has been described. Modifications to the given example can be made to accommodate many specific situations. 9. Additional References [VPNADMIN] VPNmanager Administrator s Guide, Version 3.1 The following documents can be found at: [IPO-IP600] How to configure an H.323 IP trunk between an Avaya IP600 Server and Avaya IP Office Server - Issue 1.1 [P130QOS]- Configuring Layer 3 QoS (DiffServ) on the Cajun P133G2 switch. - Issue of 28

28 2003 Avaya Inc. All Rights Reserved. Avaya and the Avaya Logo are trademarks of Avaya Inc. All trademarks identified by and are registered trademarks or trademarks, respectively, of Avaya Inc. All other trademarks are the property of their respective owners. The information provided in these Application Notes is subject to change without notice. The configurations, technical data, and recommendations provided in these Application Notes are believed to be accurate and dependable, but are presented without express or implied warranty. Users are responsible for their application of any products specified in these Application Notes. Please any questions or comments pertaining to these Application Notes along with the full title and filename, located in the lower right corner, directly to the Avaya Solution & Interoperability Test Lab at 28 of 28