Alcatel-Lucent OmniTouch Unified Communications Application Suite. VLAN Tagging

Transcription

1 Alcatel-Lucent OmniTouch Unified Communications Application Suite VLAN Tagging

2 Legal notice: Alcatel, Lucent, Alcatel-Lucent and the Alcatel-Lucent logo are trademarks of Alcatel-Lucent. All other trademarks are the property of their respective owners. The information presented is subject to change without notice. Alcatel-Lucent assumes no responsibility for inaccuracies contained herein. Copyright 2007 Alcatel-Lucent. All rights reserved.

3 Chapter 1 Overview The VLAN client Coexistence of the VLAN and VPN clients Chapter 2 Installation procedure Prerequisites Case of the SoftPhone Supplies Compatibility Installation Supported network interfaces Update Uninstall Chapter 3 Operation 0-1

4 User management Declaration Cancellation VLAN isolation settings Default installation configuration Configuration specific to the user session VLAN client operating modes Virtual network settings Configuration reset Network behaviors Incident management Overview Notified incidents Error codes VLAN client audit Case of the SoftPhone

5 1 1.1 The VLAN client The purpose of the VLAN client is to isolate voice flows from data flows. Figure 1.1: IP Touch system including the VLAN client The VLAN client can be activated with or without the VPN client. The VLAN client is a software component providing VLAN features over Ethernet flows. This layer is to be included in a user software program. This program configures the layer as needed. The following functions are provided: - Tagging of any outgoing Ethernet frame if required. - Untagging of any incoming Ethernet frame if required. - Capture of the DHCP frames to make exchanges with the DHCP server transparent intended to retrieve the network context related with the DATA network interface as well as an identifier dedicated for the VLAN (vlan id). - Management of network configuration dedicated to VOICE. The VLAN client is directly installed on the equipment the flows of which it isolates. It comprises: - A control module: It is associated with the software application to be isolated. It provides a set of interfacing functions used to activate and configure the VLAN client. - A configuration module: It is used to configure and control the tagging/untagging module. It captures and modifies the DHCP frames to add the VLAN Id retrieval option. - A tagging/untagging module: It performs tagging/untagging according to the configuration sent by the configuration module. It is associated with a virtual interface. 1-1

6 Chapter 1 - A network capture module: It captures the network flow from the interfaces connected to the machine. It sends the DHCP frames to the configuration module. The other frames are returned to the IP stack. Note: A network capture module: It captures the network flow from the interfaces connected to the machine. It sends the DHCP frames to the configuration module. The other frames are returned to the IP stack.this interface is used to provide a network context dedicated to VOICE and assigns a MAC address derived from the physical one (see module More documentation - VLAN Tagging Voice MAC address ). The DATA interface uses the original MAC address. Figure 1.2: Description of VLAN client modules 1.2 Coexistence of the VLAN and VPN clients The VLAN and VPN clients can coexist, some modules being shared by both software programs. The diagram below illustrates such coexistence. For more information about the functions of the VPN client modules, refer to its user manual. 1-2

7 Figure 1.3: Coexistence of the VLAN and VPN clients The network capture module is shared. It captures the network flow from the interfaces connected to the machine. It sends the DHCP frames to the configuration module of the VLAN client and sends the other frames to the security module of the VPN client. 1-3

8 Chapter 1 1-4

9 2 2.1 Prerequisites The equipment operating the VLAN client must comprise: - a TCP/IP (IPv4) stack associated with its operating system, - at least one network communication interface. 2.2 Case of the SoftPhone The IP Touch VLAN Client for SoftPhone product is designed to restrict the accesses to the SoftPhone application on a PC to only voice flows from equipment of the IP Touch system of the associated VLAN. It manages either fat clients (4980) or thin ALCATEL clients (WebSoftPhone). Supported environments are Windows XP (SP1 and SP2) and Windows In this case: - The control module is a Windows dynamic library: "IPT_VlanClientCmd.dll". - The configuration module is a service "IPT_VlanClientServ" run by the operating system at run time. It configures and controls the tagging/untagging module. - The tagging/untagging module is a virtual interface dedicated to voice, which driver is: "IPTVCDrv.sys". - The network capture module comprises the service "IPT_SecClientDisp" and the NDIS mini-port network driver called "IPTSCDrv.sys". These items are shared with the VPN client for SoftPhone. Exchanges between modules are as follows: Communication concerned Type of communication IPTSCDrv.sys <-> IPT_SecClientDisp Direct function call (capture) (capture) IPT_SecClientDisp <-> IPT_VlanClientServ Named pipes (capture) (configuration) IPT_VlanClientServ <-> IPTVCDrv.sys Direct system function (configuration) (tagging/untagging) call to modify the network context related to the virtual interface IPT_VlanClientServ <-> IPT_VlanClientCmd.dll Named pipes (configuration) (control) Supplies - Interface files "CmdThalesVLAN.h" and "CmdThalesVLANSupport.h" 2-1

10 Chapter 2 - Install/uninstall procedure: "IPT_VlanClientSetup.msi" (local or remote installation in silent mode), "IPT_VlanClientSetup.exe" (local installation). The install and uninstall (in silent mode) software program is generated by InstallShield Professional version The procedure applies both to the fat client (4980) and the thin client (WebSoftPhone) Compatibility The VLAN client is compatible with any firewall, antivirus, anti-spyware and anti-spam already installed on the workstation. The installation of the NDIS intermediate driver is not conflicting with other NDIS intermediate drivers already installed on the machine (firewall, capture tool ). The NDIS intermediate driver generates no incompatibility with L2TP tunneling between the SoftPhone and an access router to the corporate LAN. If no user is declared on the VLAN client, the CPU resources and network bitrate of the client workstation are not affected. If a user is declared, the maximum bitrate depends on the CPU capability of the machine used. CPU consumption may thus be high during high speed transfers without significantly affecting the other applications. Note: For the moment, VLAN client is compatible with Alcatel VPN encryption client, but is not compatible with another VPN client such as "netscreen". Caution: If the VPN client is also installed on the client workstation, it is important to check version compatibility with the VLAN client Installation The installation of the different VLAN client modules can be performed in a silent and transparent way. The installation folder of the VLAN client may be configured during the install procedure or its default value be used ("C:\Program Files\THALES\IP Touch Client"). In this folder, the following subfolders are created: - bin\: including the executable files required for the VLAN client and the control module. - auditstylesheet\: including the XSL stylesheet for audit management. - auditfiles\: including the audit log files. Caution: When the VLAN and VPN clients are installed, the same installation folder must be used. Keys are added to the registry: 14 keys in "HKEY_LOCAL_MACHINE\SOFTWARE\Thales\IP Touch Client": - "bauditcommand": enables/disables the audit feature (see module More documentation - VLAN Tagging Case of the SoftPhone ) 2-2

11 - "sdllcmdthalesvpnhome": indicates the path to the control module - "svsiid": specifies the number of the DHCP option to be used to find the VLAN Id - "sinterfaceclassid": specifies the class ID defining the network card - "sinterfacemodevoip": indicates the static/dynamic mode of the interface related to voice - "svoipstaticaddress": specifies the IP address related to voice (in static configuration) - "svoipstaticnetmask": specifies the subnet mask related to voice - "svoipstaticgateway": specifies the gateway related to voice - "svoipstaticprimarydns": specifies the address of the primary DNS server related to voice - "svoipstaticsecondarydns": specifies the address of the secondary DNS server related to voice o "svlanidmode": specifies the static or dynamic retrieval mode of the VLAN ID o "svlanid": specifies the VLAN ID if it is defined static - "svlanidmode": specifies the static or dynamic retrieval mode of the VLAN ID - "svlanid": specifies the VLAN ID if it is defined static Most of cases will use the dynamic retrieval mode at DATA interface level and thus at VLAN ID level as well as at the VOICE-related interface level. There are two install procedures: - Remote installation: by means of a remote deployment service ("System Management Server", "Active Directory" ) using the "IPT_VlanClientSetup.msi" file. The installation file "IPT_VlanClientSetup.msi" is compatible with the remote deployment mechanisms used by ALCATEL for Windows client workstations. - Local installation: by an administrator directly on the machine using the "IPT_VlanClientSetup.exe" (or "IPT_VlanClientSetup.msi") file. Installation in silent mode is based on the "IPT_VlanClientSetup.msi" installation procedure and is run via command lines as follows: msiexec /i IPT_VlanClientSetup.msi /qn INSTALLDIR= C:\Program Files\THALES\IP Touch Client VSIID=43 The INSTALLDIR variable is used to modift the installation path. The VSIID variable configures the number of the DHCP option used to retrieve the VLAN ID (in decimals). The VLAN client must be installed with the administrator rights. After installing the VLAN client, the network and configuration modules, run by the operating system, remain active Supported network interfaces Following the installation, all networks interfaces present on the machine are supported by the VLAN client. This means that all frames transiting via these interfaces are captured by the network capture module. However, tagging/untagging will only be active on the interface configured with the VOICE IP address. Any network interface dynamically added will be automatically supported by the VLAN client. 2-3

12 Chapter Update Updates are performed using the same procedures as for installation. It requires the VLAN client installed to be temporarily shut down. If a former version is already installed on the client workstation, the operator may decide to update the former version or not. If a later version is installed, the operator must first uninstall it to be able to install the former version. As for installation, administrator rights are required. The machine must be restarted only if one of the drivers "IPTSCDrv.sys" or "IPTVCDrv.sys" is updated (different version). Caution: Updating the VPN client may require the VLAN client to be uninstalled if a later version of the capture blocks is required Uninstall The machine must be restarted if an update affects the capture and/or tagging/untagging module. The VLAN client must be uninstalled with the administrator rights. The machine will have to be restarted for complete uninstall of all VLAN client components. If the VPN client is also installed on the client workstation, uninstalling the VLAN client only removes the items that are not shared and does not require the machine to be restarted. As for installation, uninstall can be performed locally or remotely. Uninstallation in silent mode is based on the "IPT_VlanClientSetup.msi" installation procedure and is run via command lines as follows: msiexec /x IPT_VlanClientSetup.msi /qn Uninstalling the VLAN client: - Removes the control module DLL, - Halts and removes the configuration module services, - Removes the virtual driver used by the tagging/untagging module, - Uninstalls the network capture module only if the VPN client is not installed. The registry keys added to operate the VLAN client are also removed. Audit files are kept in the "auditfiles" folder of the installation folder. 2-4

13 3 3.1 User management Declaration Declaration of a user via the TVLAN_RegisterUser primitive of the control library is required before: - Configuring the VLAN client, - Benefitting from the tagging/untagging features, - Retrieving the information and incidents notified by the VLAN client. The VLAN client is a single-user workstation. Only one user can declare to the VLAN client; other intents will be rejected Cancellation User cancellation is either explicit via the TVLAN_UnregisterUser primitive of the control library, or implicit in the event that connectivity is lost between the modules. In both cases, the VLAN client configuration is reset to zero (vlanid = 0 and VOICE IP address = ); then no network flow is tagged/untagged. In case of implicit cancellation due to lost connectivity between modules, the control module informs the user previously declared via the incident notification callback. 3.2 VLAN isolation settings Previous declaration of a user is required to configure VLAN isolation. By default, the VLAN client uses its installation configuration Default installation configuration During installation, a default configuration is recorded. During local installation (non silent), the administrator selects the interface on which the VLAN will be active as well as the VLAN ID (dynamic or static) and VOICE IP address (dynamic or static) retrieval mode. 3-1

14 Chapter 3 Caution: Figure 3.1: VLAN client configuration interface - If the interface IP address selected is static, then the VLAN ID retrieval mode is forced at "static". - If the VLAN ID retrieval mode is dynamic, then the corresponding physical interface is not required. The interface is that on which a VLAN Id is detected. During remote installation (silent), all interfaces may be used for the VLAN. As soon as a DHCP exchange with VOICE VLAN ID retrieval is performed, the interface supporting this exchange will be selected as the only interface on which the VLAN is active. The VLAN ID and VOICE IP address retrieval mode are forced at "dynamic" Configuration specific to the user session When a user is declared, he may impose a configuration different from the default configuration defined during installation. This new configuration is valid while the user remains registered. Upon cancellation followed by a new declaration of user, the default configuration, i.e. the installation configuration, is restored VLAN client operating modes The control module enables or disables the VLAN client: - When a user is declared, the VLAN client is enabled: it has a passing behavior then a filtering behavior as soon as the configuration is applied. - When no user is declared, the VLAN client is disabled: it has a passing behavior. Default VLAN isolation values of the configuration module are as follows: 3-2

15 VLAN ID = 0 VLAN ID retrieval mode VOICE IPv4 address = Subnet mask = Default gateway = Primary DNS = Secondary DNS = VOICE interface mode VSIID = DYNAMIC (Via the DHCP of the DATA interface) = DYNAMIC (DHCP) = 0x2B These values can be read using the TVLAN_DumpConfig primitive. These values can be used only if a user is registered and once the configuration phase is complete (case of dynamic information retirvela). Reset of these values can be implicitly requested via the TVLAN_Resetconf primitive. Filtering and passing behaviors are described in Network behaviors Virtual network settings The VLAN client has a VOICE configuration as soon as the following values are initialised: - Mode of the network context related to VOICE (dynamic or static), - Settings of the network context related to VOICE (IP address,...), - Settings of the ID related to the VLAN. All combinations of addressing types (static or dynamic) for the DATA and VOICE IP addresses can be used. The only restriction is the configuration mode of the ID related to the VLAN. In the case that the settings of the DATA network context are dynamic, this ID can only be configured static. Matrix of possible solutions for a network configuration related to VOICE: 3-3

16 Chapter 3 STATIC DATA DYNAMIC DATA VLAN Id STATIC VOICE NETWORK CONTEXT DYNAMIC VOICE IP ADDRESS VLAN ID IP ADDRESS VLAN ID Network context configured static during installation Remains modifiable using the "TVLAN_SetVoip StaticIPAddress" and "TVLAN_Request VoipDynamic IPAddress" primitives of the control library ID configured static during installation. Remains modifiable using the "TVLAN_SetVoip StaticIPAddress" of the control library Network context configured dynamic during installation Remains modifiable using the "TVLAN_SetVoip StaticIPAddress" of the control library Not possible!! Note: This ID is not retrieved via DHCP; thus it must be set to static ID retrieved by means of DHCP requests on the network context related to DATA Remains modifiable using the "TVLAN_SetVoipVlanId" of the control library The VLAN ID retrieval method and value are defined during installation and can be modified using the TVLAN_SetVoipVlanId primitive of the control library. The possible values range from 1 to 4095 included. (VLAN ID 1 is often reserved to switches. Check switch documentation for details). In dynamic mode, the VLAN Id is automatically retrieved. The DHCP frames of the Windows client are captured and modified to add option n 43 vlanid=ffff. Then the DHCP server returns the VLAN Id value in the "OFFER" frames. In static mode, the VLAN ID is the ID defined during installation, the control module also allows this value to be overwritten by a new static VLAN ID. During modification of the "Discover" DHCP frames, the following options are used: - VLAN Id discover DHCP option: Vendor Specific Information or VsiID (set to 0xFFFF by the VLAN service. (option number configurable during installation; the default value is 43) - DHCP option 60: Vendor Class Information (set to MSFT 5.0 by the Windows DHCP client). (currently not managed). The control module is used to read the current value of the ID related to the VLAN via the use of the TVLAN_GetVoipVlanId primitive. The default VLAN ID value is 0xFFFF (before dynamic retrieval by the DHCP of the network context related to DATA or via static positioning via the TVLAN_SetVoipVlanId primitive of the control library) Voice IP address The Voice IP address retrieval method and value are defined during installation and can be modified using the TVLAN_SetVoipStaticIPAddress primitive of the control library. There is no requirement for configuring the Voice IP address. It can be dynamic or static whatever the DATA IP address and VLAN ID retrieval mode. The control module is used to read the current value of the Voice IP address via the 3-4

17 TVLAN_GetVoipIpAddress primitive. The default value of the IP address dedicated to VOICE is (before dynamic retrieval by the VOICE DHCP or via static positioning by the TVLAN_SetVoipStaticIPAddress primitive of the control library) Voice MAC address The VLAN Client must dynamically define its own MAC address associated with the voice virtual interface. To "ensure" that this address is unique, the value of the voice MAC address corresponds to the value of the data MAC address associated with the real interface, except for the first byte. Reminder - MAC address format: On the 1st byte of the voice MAC address: Figure 3.2: MAC address format - bit b1 is set to 1, to indicate that the address is managed locally. - bit b0 is set to 0, to indicate a unicast address. - bits b7 to b2 are set freely. Thus the 1st byte of the voice MAC address has been set to 0xAA (arbitrary, it could be 0x02). The rest of the MAC address copies the MAC address of the physical board where the driver is associated. It cannot be fully ensured that this MAC address is unique over the network; the only risk is that another software uses the same method to define a locally managed MAC address but such a risk is very low when choosing a value for the entire first byte Configuration reset The configuration can be explicitly reset via the TVLAN_Resetconf primitive of the control library. Then the VLAN client restores its default configuration (the installation configuration). In case of user cancellation or connectivity lost between the control and configuration modules, the configuration is implicitly reset. 3.3 Network behaviors 3-5

18 Chapter 3 The control module enables or disables the VLAN client. According to these operating modes, the VLAN client behaves in two different ways at network level: - Passing: No tagging/untagging is performed, frames remain unchanged (vlan id = 0) - Filtering Outgoing frames with a Source IP address corresponding to the Voice IP address configured are tagged with the specified VLAN Id. Incoming frames with a Destination IP address and a VLAN Id corresponding to the Voice IP address and the VLAN Id configured are untagged. 3.4 Incident management Overview Incident messages can be notified by the VLAN client to the operating application via the control module. Note: In order to prevent possible saturation of the system by incidents, the following behavior has been defined: a minimum interval of 2 minutes is imposed between transmission of two identical incidents. Any incident identical to the previous one and generated within this interval is not transmitted to the operating application Notified incidents TVLAN_ALARM_VLAN_MODULE_LOST (FAh) TVLAN_ALARM_NET_MODULE_LOST (FBh) ID Designation Description / Action Unexpected disconnection with the configuration module Unexpected disconnection with the capture module The control module lost connection with the configuration module: Check possible conflicts with other applications. The user must run TVLAN_RegisterUser and configure the security module again. The configuration module lost connection with the capture module: check installation. 3-6

19 TVLAN_ALARM_SEVERAL_VOIP_INTERFACE (FCh) ID Designation Description / Action TVLAN_ALARM_RENEW_VOIP_ADDRESS (FDh) TVLAN_ALARM_RENEW_VLANID (FEh) Several virtual interfaces detected with a VLAN active VOICE IP address changed VOICE IP address changed VLAN ID changed The configuration module detected two virtual interfaces with a VLAN active: Check if another application or user is trying to enable the virtual interface independently from the configuration module. The configuration module detected that the dynamic Voice IP address has changed: The operating application must modify its configuration. The configuration module detected that the dynamic VLAN ID has changed: The DHCP server configuration has changed, the VLAN is no longer the same, the current IP address is no longer valid. 3.5 Error codes 3-7

20 Chapter 3 ID Designation Description / Action TVLAN_RES_NETWORK_CARD_UNAVAILABLE (-5) Network card unavailable TVLAN_RES_NETWORK_CONFIGURATION_ERROR Network (-6) configuration error TVLAN_RES_FUNCTION_NOTAVAILABLE (-7) Function unavailable The network card ID entered during installation configuration no longer exists: The network card has been replaced. Run the configuration interface using file IPT_VlanClientCfg.exe in the installation folder and select the new interface. Then restart the PC. The network configuration entered in registry is wrong: Run the configuration interface using file IPT_VlanClientCfg.exe in the installation folder and select the new interface. Then restart the PC. The installation configuration is different from that requested. The VLAN ID and Voice IP address retrieval modes (static/dynamic) cannot be modified: Run the configuration interface using file IPT_VlanClientCfg.exe in the installation folder and select the new interface. Then restart the PC. 3.6 VLAN client audit An audit mechanism is implemented on the VLAN client. It is used to retrieve information in order to perform a diagnostic Below are described the generic types of audit: - User management: Timestamped traces are saved in order to retrieve information on user 3-8

21 registration, cancellation or disconnection. - Configuration management: The control module provides information on the current VLAN client configuration. Under environments supporting a file system (Microsoft Windows, GNU Linux ), configuration notification can be saved in a file Case of the SoftPhone With a SoftPhone, the audit mechanisms are implemented as follows: - User management: The traces associated with user management are added to the Windows Event Log. - Configuration management: Configuration notification can be saved in a file which path will be configured in the control module. 3-9

22 Chapter