TECHNICAL WHITE PAPER. Avaya SIP Enablement Services (SIP) 3.0 / Ports and Protocols

Transcription

1 TECHNICAL WHITE PAPER Services (SIP) 3.0 / Version: 0.6 Date: Aug. 12, 2005 Author: Avaya GCS Abstract: This technical white paper covers the network ports and protocols used by the Avaya Converged Communications Server 3.0 (SES), User Agents (includes Avaya IP Softphone R5.x, Softphone, and Phones), and other entities. This includes the following flows: 1. SES and other SES s 2. SES and Avaya Communication Manager (S8xx0) 3. SES and /Other 4. SES and Avaya IP Softphone R5.x w/im and Presence 5. SES and 6. SES and Phones (4602, 4610, 4620SW, 4621) 7. SES in a redundant configuration Figure 1 - SES Example Topology

2 2 Note: The SES ephemeral port range is In general, ephemeral port ranges vary per platform. 1. SES to SES Purpose From Port To Port Notes SIP/TLS SES 1 Ephemeral SES 2 TCP 5061 SES can be either a Home, Edge, or Home/Edge SIP/TLS SES 2 Ephemeral SES 1 TCP 5061 SES can be either a Home, Edge, or Home/Edge Postgres SES (Master / PPM Interface; Edge) Ephemeral SES (Slaves; Homes) TCP 5432 Only needed in Edge with Separate Homes Configuration. PPM stands for Personal Profile Manager. Postgres SES (Slaves/ PPM; Homes) Ephemeral SES (Master Interface; Edge) TCP 5432 Only needed in Edge with Separate Homes Configuration. PPM stands for Personal Profile Manager. 2. SES and Avaya Communication Manager (S8xx0) Purpose From Port or Protocol To Port or Protocol SIP/TLS S8xx0 Ephemeral SES TCP 5061 enterprise/native interface Notes SIP/TLS SES Ephemeral S8xx0 enterprise/native interface TCP 5061

3 3 3. SES and /Other Purpose From Port To Port Notes HTTP Ephemeral SES TCP 80 HTTP will redirect client browser to HTTPS SES Admin and SPIM/ HTTPS Ephemeral SES TCP 443 SPIM stands for SIP Personal Information Manager SNMP Queries SNMP Traps Management Station Ephemeral SES 161 SES Ephemeral 162 Management Station SSH, SFTP Telnet Ephemeral SES TCP 22 Ephemeral SES TCP 23 FTP FTP client Ephemeral SES TCP 21 Anonymous FTP is disabled by default. It can be enabled from the SES Maintenance Web Pages. FTP SES TCP 20 FTP client TCP >1023 DNS SES any DNS server(s) 53 DNS DNS server(s) 53 SES 53 hp-sshd Ephemeral SES TCP 2222 High priority SSH Ping SES ICMP ICMP Ping ICMP SES ICMP NTP SES 123 NTP server 123 NTP NTP server 123 SES 123 LDAP SES Ephemeral LDAP Server TCP 389

4 4 LDAP LDAP Server Ephemeral SES TCP 389 HTTPS SIP Phone Ephemeral SES TCP 411 Port open but not used on SES.

5 5 4. SES and Avaya IP Softphone R5.x w/im and Presence Purpose From Port To SIP/TLS SES Ephemeral IP Softphone R5.x Port TCP >59085 Notes SIP/TLS IP Softphone R5.x TCP >59085 SES TCP 5061 Notes: The IP Softphone user can set a port range for the application to use for all of the ports on which it opens and receives. This port range can be set from the IP Softphone Login Dialog Advanced Tab. When a port range restriction is set, the port numbers selected for SIP signaling are as follows (the port range restriction must be a minimum of 100 ports): Listening socket for connections from SES server: First available port from the 90th-100th percentile of the port range Connection to SES server: First available port from the 90th-100th percentile of the port range set For example, if the user sets the port range to [2000, 3000]: The listening socket will bind and listen at the first available port from [2900, 3000]. The socket used to connect to SES will bind and use the 2nd available port from [2900, 3000] because the listening socket is initialized first. Assuming no other application uses ports 2900 and 2901, the listening socket will use 2900, and the connection to the SES socket will use port 2901.

6 6 5. SES and can be configured to use either TLS,, or TCP for SIP in proxied mode. Note: The port range used by SIP Softphone is administrable on the application (Settings Advanced). Purpose From Port To SIP/ SES Ephemeral Port 5060 Notes SIP/ 5060 SES 5060 SIP/TLS SES Ephemeral TCP 5061 SIP/TLS TCP 5062 SES TCP 5061 SIP/TCP SES Ephemeral TCP 5060 SIP/TCP SES TCP 5060 PPM/HTTPS SES Ephemeral TCP 443 PPM/HTTPS TCP >1023 SES TCP 443 Other ports used on : Port or Purpose From Protocol RTP/RTCP/ 5000/5001 To Port or Protocol Depends on endpoint Notes RTP/RTCP/ Other Endpoint Depends on endpoint 5000/5001

7 7 RTP/RTCP/ 5002/5003 Depends on endpoint Example for a second call. For each additional call, up to 10 calls, the subsequent pair of ports is used. RTP/RTCP/ Other Endpoint Depends on endpoint 5002/5003 See also Port Usage Description.

8 8 6. SES and s The phone can be configured to use either (default) or TCP, but not both. Purpose From Port To Port SIP/ SES Ephemeral 5060 Notes SIP/ 5060* SES 5060 *5060 is the default; configurable via DHCP or settings file. RTP RTP Media Processor (increments by five for each additional stream for up to five streams) Port Range as administered on IP Region Form Media Processor Port Range as administered on IP Region Form. See Note (increments by five for each additional stream for up to five streams) RTP (increments by five for each additional stream for up to five streams) Depends on endpoint RTP Depends on endpoint (increments by five for each additional stream for up to five streams) RTCP Media Processor RTCP Media

9 9 Processor RTCP RTCP RTCP Voice Monitoring Manager See 4600 Series IP Telephone Release LAN Guide ( ) for information on additional ports used by the 46xx s.

10 10 7. SES in a redundant configuration If SES exists in a redundant configuration, the following ports should also be opened. Purpose From Port To Port Notes Ping SES (Primary) ICMP SES (Secondary) ICMP Ping SES (Secondary) ICMP SES (Primary) ha-cluster SES TCP 694 SES (Primary) 694 (Secondary) ICMP TCP ha-cluster SES (Secondary) TCP rsync SES TCP 873 (Primary) 873 rsync SES (Secondary) TCP drbd SES TCP 7788 (Primary) 7788 drbd SES (Secondary) TCP SES (Primary) SES (Secondary) SES (Primary) SES (Secondary) SES (Primary) TCP TCP TCP TCP TCP

11 11 Services Integrated Firewall The SES Maintenance Web Interface provides the administrator with the ability to block network protocols. Protocol blocking is performed by using the integrated firewall configuration screens located under the Maintenance Web Interface: Security, Firewall - as shown in Figure 2. Figure 2 Web Interface Firewall Link Upon clicking the Firewall hyperlink, Figure 3, protocols can be directionally enabled or disabled (Input to Server, Output from Server) by clicking on the appropriate checkbox. Protocols that are unchecked are dropped by the SES firewall. Figure 3 Snapshot of a portion of the Firewall Configuration Screen ***END***