UNDERSTANDING FreeSWITCH CLUSTERING with OpenSIPS (done well) Giovanni Maruzzelli

Transcription

1 UNDRSTANDING FreeSWITCH CLUSTRING with OpenSIPS (done well) Giovanni Maruzzelli OpenSIPS Summit Amsterdam 2018

2 Who is Who Phones are SIP User Agents that can initiate (client) or accept (server) sessions eg: a phone calls a number, or answers an incoming ring OpenSIPS is a SIP Proxy and Registar eg: it routes the signaling from User Agents eg: it knows ehre the phones actually are eg: never touches the media FreeSWITCH is a SIP B2B User Agent, client and server at same time eg: it connects two sessions, one as server, one as client eg: it answers a call incoming from a "client" phone, then initiate a call toward a "server" phone, then joins (eg bridges) the two calls eg: it mixes the media from the two sessions, the two phones talk to each other and interact with FS at the same time eg: it knows if media is flowing or not (missed BY anyone?) eg: it can mix media with itself (phone talk with IVR) OpenSIPS Summit Amsterdam 2018

3 What is to be Done Security / High Availability Registrations Presence / BLF / SLA / IM Calls, Internal, FS Local Profile Calls, Inbound/Outbound, FS xternal Profile Special Cases (conferences, queues, transfer) NAT OpenSIPS Summit Amsterdam 2018

4 Security "SBC" (whatever it means) Single Point of Contact with the Wild Internet asier to Secure / Manage Port Forwarding iptables / firewall pike / antifraud / check well formed OpenSIPS Summit Amsterdam 2018

5 High Availability Double your OpenSIPS (and RTPProxy) Virtual IP Address Active - Passive Keepalived check sip works master / backup / fail ( FreeSWITCH will get its HA from Load Balancing ) OpenSIPS Summit Amsterdam 2018

6 SAM NTWORK PGSQL BDR + GlusterFS OpenSIPS Proxy Media Proxy Signaling ITSP DID Media K P A L I V D OpenSIPS Proxy DB Signaling File DB Media UDP T CP T L Signaling File Media R P L I C A T I O N PGSQL BDR + GlusterFS S W BRT C FreeSWITCH Servers Farm Media Proxy 6/31 OpenSIPS Summit Amsterdam 2018

7 Registrations High Frequency Transactions MUST be known both to FSs and to OSIPS OSIPS gets client's addr, FS gets OSIPS's addr Multiple Registrations / Parallel Forks OpenSIPS Summit Amsterdam 2018

8 Registrations SIP RGISTR a SIP UserID to the address where it can be reached internal phone register its own address to OSIPS OSIPS let FS know phone is reachable at OSIPS own address FS reach phone to OSIPS address, OSIPS then route message from FS to phone OpenSIPS Summit Amsterdam 2018

9 Registrations just dispatched to backend FreeSWITCHes low frequency to FS round robin OSIPS mid-registar OSIPS usrloc OSIPS dispatcher OSIPS nathelper (for PBX in Cloud scenario) OpenSIPS Summit Amsterdam 2018

10 Presence / BLF / SLA / IM Presence may generates high volume transactions, depending on use cases and patterns FreeSWITCH has got very nice Presence management, integrated with its own call processing and phone interaction, tailored for PBX usage Better to leave Presence to FS, if volume allows If volume is too high, then leave it entirely to OSIPS g: don't try a mixed OSIPS and FS Presence Processing OpenSIPS Summit Amsterdam 2018

11 SAM NTWORK PGSQL BDR + GlusterFS OpenSIPS Proxy Media Proxy Signaling ITSP DID Media K P A L I V D OpenSIPS Proxy DB Signaling File DB Media UDP T CP T L Signaling File Media R P L I C A T I O N PGSQL BDR + GlusterFS S W BRT C FreeSWITCH Servers Farm Media Proxy 11/31 OpenSIPS Summit Amsterdam 2018

12 Calls, INVIT SIP INVIT from a SIGNALING address (SIP) from a MDIA address (SDP) to a SIGNALING address (SIP) SIP OK to a SIGNALING address (SIP) from a MDIA address (SDP) from a SIGNALING address (SIP) OpenSIPS Summit Amsterdam 2018

13 Calls, Internal FS "internal" profile got port 5060 and "default" dialplan this deal with "in house" phones, users, extensions, services is a trusted environment, and may allow for paid services like PSTN gateways (toll-allow) default FS demo dialplan is an nterprise PBX choke full of services (you probably want to disable most of them) you don't want port 5060 to be reachable from the Internet (if you need to connect remote phones, use a VPN to let them appear on the local network) FusionPBX is the perfect FS interface, carefully calibrated for real world usage OpenSIPS Summit Amsterdam 2018

14 Calls, Internal internal phones only register and deal with OSIPS (on port 5060), they never send signaling directly to FS (phones and FSs can even be on totally separated networks, rtpproxy would then route the media) FS knows the phone is registered at OSIPS (because OSIPS sent FS a purposedly built registration message) all FSs share the same "gut" database (core dbs), so when one FS receives the registration message from OSIPS, all FSs become aware of the newly registered phone when FS wants to reach a phone, FS knows he must send the call to OSIPS OSIPS will then send the call (or other signaling, eg MWI, etc) to the phone this way we don't need to keep care of who is registered where, they all are registered at OSIPS, and any/all traffic to/from them pass back and forth through OSIPS traffic from/to OSIPS port 5060 is "internal PBX" traffic, from/to phones and FSs OpenSIPS Summit Amsterdam 2018

15 Calls, Internal Internal PhoneA to FreeSWITCH ServiceX (IVR) (phones, FSs and OSIPS on same net) PhoneA sends its own SDP to OSIPS > OSIPS sends PhoneA SDP to FS 5060 ("default" dialplan) -> FS matches the dialed number with ServiceX extension -> FS sends its own SDP to OSIPS > OSIPS sends FS SDP to PhoneA Media flows from PhoneA SDP to FS SDP, and back OpenSIPS Summit Amsterdam 2018

16 Calls, Internal Internal PhoneA to Internal PhoneB (phones, FSs and OSIPS on same net) PhoneA sends its own SDP to OSIPS > OSIPS sends phone SDP to FS 5060 ("default" dialplan) -> FS matches the dialed number with phoneb extension -> FS sends its own 1st SDP to OSIPS > OSIPS sends FS 1st SDP to PhoneB PhoneB answers OSIPS sending its own SDP -> OSIPS sends PhoneB SDP to FS > FS sends its own 2ndSDP to OSIPS > OSIPS sends FS 2nd SDP to PhoneA Media flows from phonea SDP to FS 1st SDP to FS 2nd SDP to PhoneB SDP and back OpenSIPS Summit Amsterdam 2018

17 SAM NTWORK PGSQL BDR + GlusterFS OpenSIPS Proxy Media Proxy Signaling ITSP DID Media K P A L I V D OpenSIPS Proxy DB Signaling File DB Media UDP T CP T L Signaling File Media R P L I C A T I O N PGSQL BDR + GlusterFS S W BRT C FreeSWITCH Servers Farm Media Proxy 17/31 OpenSIPS Summit Amsterdam 2018

18 Calls, xternal FS "external" profile got port 5080, and the "public" dialplan is dealing with the external, bad world out there is receiving inbound calls from DID providers is sending calls to ITSPs to be connected to POTS and Mobile Networks is usually facing the Internet, so incoming calls are untrusted, must not be able to reach internal services or dialplans, and definitely not be able to reach for pay gateways (VoIP fraud anyone?) in most cases inbound calls from each DID are directly mapped to a specific internal extension (phone or IVR) in the very short and secured "public" FS dialplan, while "pure SIP to SIP" incoming calls are rejected you may want to firewall OSIPS port 5080 to only communicate with your ITSP and DID providers OpenSIPS Summit Amsterdam 2018

19 Calls, xternal DID to internal phone DID provider (or PRI gateway) sends its own SDP to OSIPS > OSIPS instructs rtpproxy to create a pair of ports (to route media from Internet to internal net and back) -> OSIPS sends rtpproxy internal SDP to FS 5080 ("public" dialplan) -> FS matches the corresponding extension -> FS transfer to that extension on "default" dialplan -> FS sends its own 1st SDP to OSIPS > OSIPS sends FS 1st SDP to internal phone OpenSIPS Summit Amsterdam 2018

20 Calls, xternal Internal phone answers incoming DID phone sends its own SDP to OSIPS -> OSIPS sends phone SDP to FS -> FS recognize the call and then sends its own 2nd SDP to OSIPS > OSIPS sends rtpproxy external SDP to DID provider (gw) media flows from DID SDP to rtpproxy external SDP to rtpproxy internal SDP to FS 1st SDP to FS 2nd SDP to phone SDP and back OpenSIPS Summit Amsterdam 2018

21 Special Cases Calls going to FreeSWITCH for: conference rooms queues call centers MUST be on the SAM phisycal MACHIN OpenSIPS Summit Amsterdam 2018

22 Special Cases Incoming calls going to the same UserID Outbound calls originated by that same UserID and is much much better if they're ALL on the SAM physical MACHIN so UserID can transfer calls using RFRs OpenSIPS Summit Amsterdam 2018

23 Special Cases OSIPS by default distribute calls to various FSs dispatch or load_balance each time OSIPS sends a call to a FS, it writes down which destination "number" is going to which FS server and from which UserID if another call comes for the same (or related) destination, or is originated from the same UserID then OSIPS sends the call to that same FS server, bypassing default distribution algorithm OpenSIPS Summit Amsterdam 2018

24 PBX in the CLOUD OpenSIPS Proxy Media UDP TCP TLS WB R Signaling ITSP DID Signaling Media Media Proxy TC K P A L I V D g in l na g ia d Si e M PGSQL BDR + GlusterFS DB File File DB R P L I C A T I O N OpenSIPS Proxy PGSQL BDR + GlusterFS Media Proxy FreeSWITCH Servers Farm OpenSIPS Summit Amsterdam /31

25 NAT clients (phones) are behind NAT / Firewalls signaling can't go from US (FreeSWITCH / OpenSIPS) to THM eg: we cannot ring them signaling has the wrong media address eg: they can reach us, we can't reach them eg: they send us the private LAN ip address media can't go from client to client eg: they can be on NATs that cannot directly communicate OpenSIPS Summit Amsterdam 2018

26 NAT we must keep a pinhole open in the client firewall/router for us to be able to reach it we must translate SDP addresses from internal LAN of client to pinhole address in its firewall/router we must be able to let phones behind incompatible NATs to send media each other OpenSIPS Summit Amsterdam 2018

27 NAT PING them with OPTIONS messages fix_nated_(contact register) rtpproxy_engage OpenSIPS Summit Amsterdam 2018

28 28/31 OpenSIPS Summit Amsterdam 2018

29 29/31 OpenSIPS Summit Amsterdam 2018

30 30/31 OpenSIPS Summit Amsterdam 2018

31 Thank You QUSTIONS? Giovanni Maruzzelli training & consulting 31/31 OpenSIPS Summit Amsterdam 2018