TELES VoIPBOX/iGATE - TLS/RTP MUX configuration. Version 1.2

Transcription

1 TELES VIPBOX/iGATE - TLS/RTP MUX cnfiguratin Versin 1.2

2 Cntents 1. Intrductin Purpse f dcument Shrt descriptin Scenari example 3 2. Cnfiguratin TLS 4 SW required 4 Cnfiguratin RTP multiplexing 6 Cnfiguratin Example 7 SIP TLS and RTP MUX between 2 systems having fixed public IP addresses. 7 SIP TLS and RTP MUX between 2 systems, whereby 1 bx is behind NAT. 8

3 1. Intrductin 1.1 Purpse f dcument The purpse f this dcument is t prvide a descriptin f the cnfiguratin fr the VIPBOX/iGATE where TLS and/r RTP MUX are used. 1.2 Shrt descriptin TLS transprt layer security is used t encrypt SIP signalling Usage: fr security reasns RTP MUX RTP cntent fr cncurrent calls between 2 peers are transmitted in a single UDP packet. Usage: fr bandwidth saving fr security reasns in case f netwrk sniffing 1.3 Scenari example

4 2. Cnfiguratin 2.1 TLS Fr TLS use, SW versin r higher are suggested. SW required - SW package Crypt.vnd - Certificates Cert.pem Key.pem Cnfiguratin - Pabx.cfg (system sectin) SipSPrt=8080 Here, a regularly used prt is utilized fr secure transmissin VipLinger=4 This frces the system t clse the TCP sessin, als in case f transmissin errrs. The parameter indicates time in secnds (e.g. 4 sec) VipSuppressRtcp=yes Prevents any RTCP messages between the 2 RTP MUX peers. - Rute.cfg (VIP prfile) VipPeerAddress=<ip address>:8080 The prt behind the peer address (IP address r name) is the peer s used prt and has t be set in case it s nt the default prt used! VipSignalling=3 Switches n SIP TLS VipSingleTcpSessin=Yes All signalling packets between the peers are handled in a single TCP sessin. VipTcpKeepAlive=Yes Will keep the TCP sessin pen by sending packages every 10 sec. In case the SIP TLS peer is behind NAT, the fllwing additinal settings will allw the SIP registrar t be activated fr the cnfigured user in the VIP prfile: VipOwnUser=<usr> User t be registered VipOwnPwd=<pwd> Used passwrd fr registratin (ptinal) VipAuth=www User authenticatin methd (www r prxy) (ptinal) VipExpires=60 Time span befre peer will repeat send the SIP register requests and

5 update the registratin data Nte: The parameter VipPeerAddress= is neither cnfigured nr empty and the parameter VipIpMask=0x is remved r set as in the VIP prfile used.

6 2.2 RTP multiplexing Cnfiguratin - Pabx.cfg (system sectin) VipRtpPrt=29000 VipRtpPrtSpacing=2 Bth parameters have t be identical in each f the systems, but they can, f curse, vary frm the example. - Rute.cfg (VIP prfile) VipAggRemteRtpPrt=29000 VipAggRemteDataPrt=29500 VipAggOwnDataPrt=29500 VipAggRemteRtpPrtSpacing=2 The settings fr the UDP prt (data prt) used in the VIP prfile are defined t transmit the vice data here as well as the RTP settings cnfiguratin fr the remte peer. In case the RTP peer is behind NAT the fllwing additinal settings will enable symmetric RTP fr the cnfigured user in the VIP prfile: VipAutRtpAddr=Yes The RTP data is frced t the peer which then sends the incming RTP/RTP MUX data fr the call. It ignres SDP signaling (which culd be a private IP address). Nte: this nly makes sense if this device has a fixed public IP address. If calls ruted via the MUX cming frm VIP already have a highly-cmpressed cdec such as G729 r G723; it is recmmended t use a lw-cmpressed cdec fr the MUX tunnel such as G72632 (cmpressin rati 1:2). T avid bandwidth bttleneck n DSL lines; the silence suppressin has t be switched n fr the uplink n regular IP cnnectins in bth directins.

7 2.3 Example SIP TLS and RTP MUX between 2 systems having fixed public IP addresses. The SIP TLS prt shall differ n 1 bx frm 8080 (e.g ): Pabx.cfg settings System1: System2: [System] [System] H225Prt=2017 H225Prt=2017 SipPrt=6050 SipPrt=6050 SipSPrt=8080 SipSPrt=65213 VipRtpPrt=29000 VipRtpPrtSpacing=2 VipSuppressRtcp=yes VipLinger=4 Rute.cfg settings [Vip:DF] VipDirectin=IO VipPeerAddress=<ip address>:65213 VipRtpPrt=29000 VipRtpPrtSpacing=2 VipSuppressRtcp=yes VipLinger=4 [Vip:DF] VipPeerAddress=<ip address>:8080 VipIpMask=0xffffffff VipMaxChan=30 VipSignalling=3 VipCmpressin=g729b g729 g723 VipSilenceSuppressin=n VipTxM=2 VipServiceOut=0x101 VipIpLgging=Yes VipDtmfTransprt=3 VipRFC2833PayladType=101 VipT303=5 VipAggRemteDataPrt=65132 VipAggOwnDataPrt=589 VipAggRemteDataPrt=589 VipAggOwnDataPrt=65132 VipAggRemteRtpPrtSpacing=2 VipSingleTcpSessin=Yes VipTcpKeepAlive=Yes

8 SIP TLS and RTP MUX between 2 systems, whereby 1 bx is behind NAT. Rute.cfg settings: VIPBOX with public IP address igate with a lcal IP address [Vip:iGATE] [Vip:VB] VipDirectin=Out VipDirectin=IO VipPeerAddress=<ip address>:8000 VipIpMask=0x VipMaxChan=30 VipSignalling=3 VipOwnUser=<usr> VipOwnPwd=<pwd> ;(ptinal) VipIpMask=0xffffffff VipMaxChan=30 VipSignalling=3 VipUser=<usr> VipPwd=<pwd> ;(ptinal) VipAuth=www VipExpires=60 VipCmpressin=g72632 g729 g723 VipSilenceSuppressin=N VipTxM=2 VipDtmfTransprt=3 VipRFC2833PayladType=101 VipAutRtpAddr=Yes VipSingleTcpSessin=Yes VipTcpKeepAlive=Yes VipAggRemteRtpPrt=29000 VipAggRemteRtpPrtSpacing=2 VipAggRemteDataPrt=1234 VipAggOwnDataPrt=4000 VipCmpressin=g72632 g729 g723 VipSilenceSuppressin=Yes VipTxM=2 VipIpLgging=Yes VipDtmfTransprt=3 VipRFC2833PayladType=101 VipSingleTcpSessin=Yes VipTcpKeepAlive=Yes VipAggRemteRtpPrt=29000 VipAggRemteRtpPrtSpacing=2 VipAggRemteDataPrt=4000 VipAggOwnDataPrt=1234 VipRegistrar=VB [Vip:SW] VipDirectin=In [Registrar:VB] RegId=<ip address>:8000 RegUser=<usr> RegPwd=<pwd> RegSignalling=3 RegExpires=60 RegSameCallID=N