Abstract. KT/FS; Reviewed: WCH 6/3/2003. Solution & Interoperability Test Lab Application Notes 2003 Avaya Inc. All Rights Reserved.

Transcription

1 Configuring Avaya Media Servers and Media Gateways running MultiVantage Software and Avaya IP Office Using Foundry Networks Infrastructure in an Avaya WAN Environment- Issue 1.0 Abstract These Application Notes describe the configuration steps necessary to allow Avaya and Foundry Networks to interoperate over a WAN environment. Avaya Media Servers and Media Gateways running MultiVantage telephony software and Avaya IP Office were configured to work with Foundry Networks BigIron and FastIron Edge switches. A WAN environment using Avaya P333R Switches with Avaya X330WAN Access Router Modules and Avaya VSU- VPN Gateways was used to validate the configuration. These Application Notes were jointly authored and validated by Avaya and Foundry Networks. 1 of 56

2 1. Introduction These Application Notes describe the configuration steps necessary to support Avaya MultiVantage software-enabled platforms and Avaya IP Office platforms over a Foundry Networks infrastructure in a WAN environment. In the configuration described in Figure 1 and Table 1, the Headquarters office is home to an Avaya S8700 Media Server an Avaya S8700 Media Server in a MultiConnect configuration with an Avaya MCC-1 or SCC-1 Media Gateway. Branch offices employing an Avaya S8300 Media Server with an Avaya G700 Media Gateway, as well as an Avaya IP Office Server were provisioned. Each location used Foundry Networks FastIron Edge switches to connect to the core switch, a Foundry Networks BigIron Connectivity between the Headquarters location and each branch location was established via a WAN connection comprised of Avaya X330WAN MultiService WAN Access Router Module installed in Avaya P333R Multilayer Stackable Switches. Figure 1: Avaya and Foundry Networks in an Avaya WAN Infrastructure ( Avaya P330 Switch; VSU-100R Gateway, VSU-5000 Gateway ) 2 of 56

3 Equipment Avaya S8700 Media Server with Avaya SCC-1 Media Gateway Avaya S8300 Media Server with Avaya G700 Media Gateway Avaya IP Office 412 Server with Avaya IP400 Digital Station and Avaya IP400 Phone Expansion Modules IP Address(es) C-LAN MEDPRO Stack S VoIP V Foundry Networks BigIron Foundry Networks FastIronEdge Avaya VSU-5000 Gateway Public: Private: Avaya VSU-100R Gateway Public: Private: Headquarters Avaya X330WAN Access Router Ethernet: Module (X330W-2DS1) T1 Interface: Branch Avaya X330WAN Access Router Module Ethernet: (X330W-2DS1) T1 Interface: Microsoft DHCP Server Table 1: IP Addresses for Avaya and Foundry Networks in an Avaya WAN Infrastructure Each branch office was configured and tested with the Headquarters equipment independently; that is, Branch B and Branch C were not interoperating with the Headquarters location at the same time. This is why the IP addresses used for Branch B and Branch C overlap. 2. Equipment and Software Validated The following equipment and software were used for the sample configuration provided: Equipment Software Avaya MultiVantage Software - Avaya S (Load 110.4) Media Server with Avaya SCC-1 Media Gateway Avaya MultiVantage Software - Avaya S (Load 110.4) Media Server with Avaya G700 Media Gateway Avaya IP Office 412 Server with Avaya IP (2) Digital Station and Avaya IP400 Phone Expansion Modules Avaya 4602 IP Telephone, 4624 IP Telephone 1.72 Avaya 8410 DCP Telephone N/A 3 of 56

4 Avaya IP Softphone Avaya P333R Switch Avaya X330WAN Access Router Module (X330W DS1) Avaya VSU-5000 Gateway Avaya VSU-100R Gateway Foundry Networks BigIron bT53 Foundry Networks FastIron Edge bTc1 Foundry Networks FastIron Edge bTc1 3. Configure the Avaya S8700 Media Server with SCC-1 Media Gateway This section presents configuration steps for the Avaya S8700 Media Server located in the Headquarters Office. The procedure for configuring the TN2312 IP Server Interface (IPSI) circuit pack and the private control network linking the Avaya S8700 Media Servers to the IPSI is not presented here, since this is unrelated to the Foundry Networks configuration. It is assumed that appropriate license files and authentication files have been installed on the S8700 Media Servers Configure the Ethernet Interfaces The Avaya S8700 Media Server is configured using a web interface. To access the web interface, connect a computer to the services port of one of the Avaya S8700 Media Servers. (Each S8700 Media Server is configured separately.) The services port uses the pre-configured IP address with mask Configure the computer s IP address as with mask Connect the computer s Ethernet interface to the services port with a crossover Ethernet cable. Launch a web browser, turn proxies off, and connect to the URL Supply appropriate login and password credentials when prompted to do so. After login, a main menu is presented along the left hand side. Click Configure Server from the lower left of this main menu. The Avaya S8700 Media Server has multiple IP interfaces, and the default values for the IP interfaces are used in this sample configuration, as shown in Figure 2. While not the focus of these Application Notes, the other interface definitions are also shown. The private control network(s) connecting the IPSI circuit packs with the Avaya S8700 Media Servers use control network A and B on Ethernet interfaces 0 and 3 respectively. Ethernet 1 is dedicated to the services port. Ethernet 2 is a private duplication link (using a crossover Ethernet cable) between the two S8700 Media Servers. Communication over this link includes arbitration of the active / standby status based on the health of the two servers. Ethernet 4 can be used for connection to a corporate management LAN. 4 of 56

5 Figure 2: Avaya S8700 Media Server/SCC-1 Media Gateway Configuration Figure 2(continued): Avaya S8700 Media Server/SCC-1 Media Gateway Configuration 3.2. Avaya MultiVantage Software Configuration This section presents the relevant configuration of the Avaya MultiVantage software. The Avaya MultiVantage System Access Terminal (SAT) screens can be accessed using telnet 5 of 56

6 from a computer connected to the services port. In the figures that follow, the text in the upper left corner of the figure indicates the command that was used to produce the screen shown. The administrative commands should be executed in the order shown Define IP Address Information Figure 3 illustrates the mapping of node names to IP addresses. These node names will appear in other screens, such as the screen defining an H.323 signaling group. change node-names ip Page 1 of 1 IP NODE NAMES Name IP Address Name IP Address A-CLAN A-MEDPRO CHawk-sig Chawk-voip IP-Office default procr Figure 3: Mapping Node Names to IP addresses The screen shown in Figure 4 is used to assign mask, gateway, and IP network region information to the IP interfaces of the gateway boards. Note that the C-LAN and MEDPRO in the Headquarters branch are assigned to Network Region 1 via this form. change ip-interfaces Page 1 of 19 Enable IP INTERFACES Eth Pt Type Slot Code Sfx Node Name Subnet Mask Gateway Address Rgn y C-LAN 01A04 TN799 D A-CLAN y MEDPRO 01A05 TN2302 A-MEDPRO Figure 4: Defining IP Interface Information Net 3.4. Define IP Network Region The IP Network Region 1 form shown in Figure 5 illustrates the QoS configuration. Page 2 of this form enables the specification of the codec set to be used between region pairs. For example, intra-region calls on the LAN, and calls using other high bandwidth paths may use G.711 to optimize for audio quality and minimize MEDPRO resource consumption. This is most applicable for calls within the same branch. Inter-region calls may be configured to use G.729 to minimize bandwidth consumption over lower bandwidth WAN connections (e.g., T1 to Branch B or C). In this case, separate regions would be defined for each branch. 6 of 56

7 change ip-network-region 1 Page 1 of 2 IP Network Region Region: 1 Name: Audio Parameters Codec Set: 1 Location: UDP Port Range Min: Max: Direct IP-IP Audio Connections? y IP Audio Hairpinning? y RTCP Enabled? y RTCP Monitor Server Parameters Use Default Server Parameters? y DiffServ/TOS Parameters Call Control PHB Value: 34 VoIP Media PHB Value: 46 BBE PHB Value: p/Q Enabled? y Call Control 802.1p Priority: 6 VoIP Media 802.1p Priority: Q VLAN: 10 Figure 5: Defining QoS Parameters in the IP Network Region Form change ip-network-region 1 Page 2 of 2 Inter Network Region Connection Management Region (Group Of 32) Figure 5(continued): Defining QoS Parameters in the IP Network Region Form 3.5. Administer and Enable C-LAN Figure 6 illustrates the data module administration necessary to enable the C-LAN board. add data-module Page 1 of 1 DATA MODULE Data Extension: Type: ethernet Port: 01A0417 Link: 1 Name: Network uses 1's for Broadcast Addresses? y Figure 6: C-LAN Data-Module Administration 7 of 56

8 3.6. Define IP Trunk H.323 signaling and trunk groups are defined between the Headquarters and Branch B, and between the Headquarters and Branch C. Signaling Group 1 (Figure 7) creates a link between a C-LAN in an SCC-1 in Headquarters and the IP Office Server in Branch B. Signaling Group 1 is associated with Trunk Group 1. Note that the far-end network region is set to 1. The MultiVantage Software will know that calls using this signaling group should have the characteristics of Region 1 (e.g., enable shuffling to IP-direct, use the codec defined for Region 1, etc). add signaling-group 1 Page 1 of 5 SIGNALING GROUP Group Number: 1 Group Type: h.323 Remote Office? n Max number of NCA TSC: 0 Max number of CA TSC: 0 Trunk Group for NCA TSC: Trunk Group for Channel Selection: 1 Supplementary Service Protocol: a Near-end Node Name: A-CLAN Far-end Node Name: IP-Office Near-end Listen Port: 1720 Far-end Listen Port: 1720 Far-end Network Region: 1 LRQ Required? n Calls Share IP Signaling Connection? n RRQ Required? n Bypass If IP Threshold Exceeded? n Direct IP-IP Audio Connections? y IP Audio Hairpinning? y Interworking Message: PROGress Figure 7: Signaling Group Definition for IP Trunk (Site A->Site B) 8 of 56

9 Signaling Group 2 (Figure 8) creates a link between a C-LAN in a SCC-1 in Headquarters and the S8300 Server in Branch C. Signaling Group 2 is associated with Trunk Group 2. Note that the far-end network region is set to 1, as in the Headquarters/Branch B trunk. add signaling-group 2 Page 1 of 5 SIGNALING GROUP Group Number: 2 Group Type: h.323 Remote Office? n Max number of NCA TSC: 0 Max number of CA TSC: 0 Trunk Group for NCA TSC: Trunk Group for Channel Selection: 2 Supplementary Service Protocol: a Near-end Node Name: A-CLAN Far-end Node Name: CHawk-sig Near-end Listen Port: 1719 Far-end Listen Port: 1720 Far-end Network Region: 1 LRQ Required? n Calls Share IP Signaling Connection? n RRQ Required? n Bypass If IP Threshold Exceeded? n Direct IP-IP Audio Connections? y IP Audio Hairpinning? y Interworking Message: PROGress Figure 8: Signaling Group Definition for IP Trunk (Site A->Site C) Trunk Groups 1 and 2 are configured as shown in Figure 9 and 10. A screen for Trunk Group 2 is omitted, since the parameters for the two trunk groups are nearly identical. When adding the trunk group as shown in Figure 9, critical parameters include Group Type=ISDN, Carrier Medium=IP, and a Trunk Access Code (TAC); default values can be used for most fields. Trunk groups contain members that are used to carry calls, and the number of simultaneous calls that can be established using a trunk group is equal to the number of members. In this configuration, an administrator can control the number of VoIP calls on inter-region WAN links using trunk group membership. To add an IP trunk group member, the keyword ip is typed in the port field of Page 6 on the form. The port numbers are automatically assigned when the form is submitted, and will appear when the form is re-entered, as shown in Figure of 56

10 add trunk-group 1 Page 1 of 22 TRUNK GROUP Group Number: 1 Group Type: isdn CDR Reports: y Group Name: CAMPUS B COR: 1 TN: 1 TAC: 601 Direction: two-way Outgoing Display? y Carrier Medium: IP Dial Access? y Busy Threshold: 255 Night Service: Queue Length: 0 Service Type: tie Auth Code? n TestCall ITC: rest Far End Test Line No: TestCall BCC: 4 TRUNK PARAMETERS Codeset to Send Display: 6 Codeset to Send National IEs: 6 Max Message Size to Send: 260 Charge Advice: none Supplementary Service Protocol: a Digit Handling (in/out): enbloc/enbloc Trunk Hunt: cyclical Digital Loss Group: 13 Calling Number - Delete: Insert: Numbering Format: Bit Rate: 1200 Synchronization: async Duplex: full Disconnect Supervision - In? y Out? n Answer Supervision Timeout: 0 Figure 9: Trunk Group Definition for IP Trunk (Headquarters/Branch B) display trunk-group 1 Page 6 of 22 TRUNK GROUP Administered Members (min/max): 1/30 GROUP MEMBER ASSIGNMENTS Total Administered Members: 30 Port Code Sfx Name Night Sig Grp 1: T : T : T : T : T : T : T : T : T : T : T : T : T : T : T Figure 10: Display of Trunk Form after add trunk Form is Submitted The command save translation must be entered to save the administration performed. 10 of 56

11 4. Configure the Avaya S8300/G700 System 4.1. Configure the Avaya G700 Media Gateway This section illustrates the steps necessary to configure the network identities of the following components within the G700 Media Gateway: Avaya P330 stack processor (resident on the G700 Media Gateway) G700 Media Gateway Processor (MGP) VoIP v0 Module resident on the G700 Media Gateway motherboard It is assumed the reader has login and password credentials to access the G700 Media Gateway Configure the P330 Stack on the Avaya G700 Media Gateway Steps Description 1. Connect a COM port on a computer to the console port on the lower right corner of the G700 Media Gateway using a console port cable. Launch a terminal emulation program using appropriate connect parameters (i.e., COM 1, 9600 bps, no parity, 8 data bits, 1 stop bit). Press return, and the login prompt will appear. Upon login, a welcome banner for the P330 similar to the following will be seen. Cajun_P330-1(super)# Enter configure mode Welcome to P330 SW version Cajun_P330-1(super)# configure Cajun_P330-1(configure)# 11 of 56

12 Steps Description 2. Assign IP parameters to the P330 stack processor. Cajun_P330-1(configure)# set interface inband Management VLAN number set to 1 Interface inband IP address set. You must reset the device in order for the change to take effect. Cajun_P330-1(configure)# As the command response indicates, a reset must be performed for the change to take effect. Cajun_P330-1(configure)# reset This command will force a switch-over to the master module and disconnect your telnet session *** Reset *** - do you want to continue (Y/N)? y Connection closed by foreign host. Re-login using the login credentials previously supplied and verify the IP parameters. Cajun_P330-1(configure)# show interface inband Interface Name VLAN IP address Netmask inband Cajun_P330-1(configure)# Enable pass-thru of all VLANs through the network interface port (1/1) Cajun_P330-1(configure)# set port vlan-binding-mode 1/1 bind-to-all Set Port vlan binding method:1/1 Cajun_P330-1(configure)# Turn on 802.1p/Q tagging Cajun_P330-1(configure)# set trunk 1/1 dot1q Dot1Q VLAN tagging set on port 1/1. Cajun_P330-1(configure)# 12 of 56

13 Steps Description 3. Set the IP route for the P330 stack. In the example network, the gateway address is the address on the private side of the VPN device. The output shown includes IP addresses that begin with 127. These addresses are used internally within the G700 Media Gateway. Cajun_P330-1(configure)# set ip route destination = gateway = ROUTE NET TABLE destination gateway flags Refcnt Use Interface se se se ROUTE HOST TABLE destination gateway flags Refcnt Use Interface lo0 Cajun_P330-1(configure)# Configure the Avaya G700 Media Gateway Processor (MGP) The next step is to use the CLI of the G700 Media Gateway Processor (MGP) to assign IP parameters. The MGP CLI can be accessed via the session mgp command from the P330 stack; no new authentication is necessary. The MGP can also be accessed directly from the IP network once IP settings have been assigned to the MGP. Steps Description 1. Session into the MGP and enter configuration mode Cajun_P330-1(configure)# session mgp Welcome to Media Gateway Processor FW version 08 MG-???-1(super)# configure MG-???-1(configure)# The format of the prompt is Hostname-Media Gateway number-stack Number (mode)#. In the examples shown, the hostname is MG. The hostname can be changed, if desired, using set hostname. The Media Gateway number will be shown as question marks until the gateway has registered with its controller (i.e., the Avaya S8300 Media Server in this configuration). Once registered, the prompt will show the media gateway number administered within the Avaya S8300 Media Server. The stack number is shown as 1 because this is a single (i.e., not stacked) Avaya G700 Media Gateway. 13 of 56

14 Steps Description 2. Set the IP parameters for the G700 Media Gateway Processor, including the VLAN (20) MG-???-1(configure)# set interface mgp The change will take effect after reboot. MG-???-1(configure)# As indicated, a reset must be performed for the address assignment to take effect MG-???-1(configure)# reset mgp This command will perform a hard reset. Do you want to continue (Y/N)? y Connection closed by foreign host. The MGP reset will end the session mgp started from the P330 stack CLI. Wait a short time (e.g., one minute) to allow the MGP reset to complete, and then use the session mgp command to reconnect to the MGP CLI. Use the configure command to return to configure mode. Verify the MGP configuration MG-???-1(configure)# show interface mgp OPERATIONAL STATE: -- Currently in use -- INTERFACE SRC VLAN IP ADDRESS NETMASK MAC ADDRESS mgp S D-02-0D-43 MG-???-1(configure)# 3. Assign and verify a the default IP route within the MGP MG-???-1(configure)# set ip route MG-???-1(configure)# show ip route mgp DESTINATION MASK GATEWAY INTERFACE (F/C/U) motfec0 (3/0/0) motfec0 (101/0/0) Configure the VoIP Module on the Avaya G700 Media Gateway The next step assigns an IP address to the integral voice-over-ip (VoIP) component resident on the Avaya G700 Media Gateway motherboard. This VoIP component is identified as voip v0 to differentiate it from any (functionally equivalent) MM760 VoIP Media Modules installed in the media module bays (v1-v4). The VoIP v0 has a function analogous to the TN2302AP IP Media Processor (MEDPRO) circuit pack. The following command assigns an IP address to voip v0. 14 of 56

15 Steps Description 1. Assign and verify an IP address for voip v0 Cajun_P330-1(configure)# set interface voip v Cajun_P330-1(configure)# show interface voip v0 OPERATIONAL STATE: -- Currently in use -- INTERFACE SRC VLAN IP ADDRESS NETMASK MAC ADDRESS voip-v0 S D MG-???-1(configure)# 2. Before exiting the MGP, use the show system command, and write down the reported serial number (shown in bold). This serial number will be required when the media gateway is added at the Avaya S8300 Media Server SAT administration interface. Cajun_P330-1(configure)# show system Uptime(d,h:m:s): 0, 02:01:46 System Name : -- Empty -- System Location: -- Empty -- System Contact : -- Empty -- MAC Address : D-02-0D-43 Serial No : 03DR Model No : G700 HW Vintage : 00 HW Suffix : A FW Vintage : 08 Media Gateway Power Supplies VOLTAGE(V) ACTUAL(V) STATUS DSP Complex OK MGP OK Media Modules OK VoIP DSP OK VoIP OK 4.2. Configure the Avaya S8300 Media Server This section presents configuration steps for the Avaya S8300 Media Server located in Branch C. It is assumed that an appropriate license file and Avaya authentication file have been installed on the server. The IP identity of the Avaya S8300 Media Server is configured using a web interface that is similar to the S8700 Media Server web interface. To access the web interface, use a crossover 15 of 56

16 Ethernet cable to connect a computer to the services port of the Avaya S8300 Media Server, located in slot 1 on the left side of the Avaya G700 Media Gateway. Follow the procedures in Section 3.1 to access the interface Configure Ethernet Interfaces After login, a main menu is presented along the left hand side. Click Configure Server from the lower left of this main menu. The instructions on the web screens are self-explanatory, and the relevant screen for IP address assignment is shown in Figure 11. Figure 11: Configuring the Ethernet Interfaces for the Avaya S8300 Media Server The next series of steps are performed through the MultiVantage SAT interface. When prompted, supply an appropriate login and password to login to the SAT. There are a variety of ways to access the SAT login prompt. These include, but are not limited to: Using telnet from the computer connected to the services port of the Avaya S8300 Media Server. Using 5023 as an argument to telnet brings the user directly to the SAT without presenting the Linux command line interface. If 5023 is omitted from the telnet command, type sat from the Linux prompt. 16 of 56

17 Using telnet to the IP address just assigned to the Avaya S8300 Media Server from the customer s network (e.g., telnet ). This approach would not use the direct connection to the services port, but rather could be performed from a computer connected to the data network with access to The Avaya S8300 Media Server s processor Ethernet interface must be enabled. Using change ip-interfaces, ensure that the processor Ethernet is enabled and contains the IP information previously configured through the web interface. The IP address and Gateway address are stored in a configuration file, and are displayed, but not entered, using this command (see Figure 12). change ip-interfaces Page 1 of 19 Enable IP INTERFACES Eth Pt Type Slot Code Sfx Node Name Subnet Mask Gateway Address Rgn y PROCR n Figure 12: Enable the Ethernet Interface for the Avaya S8300 Media Server Processor Net Add the Media Gateway Next, add the media gateway, using the command add media-gateway x where x will be the media gateway number. This is the media gateway number that will appear in the G700 MGP command prompt, once the gateway has registered. See Figure 13. add media-gateway 1 Page 1 of 1 MEDIA GATEWAY Number: 1 Name: internal Identifier: 03DR IP Address: MAC Address: Network Region: 1 Location: 1 Site Data: Registered? n Slot V1: V2: V3: V4: Module Type V8: V9: Figure 13: Add the G700 Media Gateway The Identifier must be populated with the Serial Number of the G700 Media Gateway. This is the serial number that was displayed using the show system command from the G700 MGP CLI. The IP Address is a display-only field that is not assigned via the SAT. The IP address field will 17 of 56

18 contain data after the media gateway has registered with the Avaya S8300 Media Server as its controller. Figure 14 shows the result of the change media-gateway 1 command after the G700 Media Gateway had registered. Note that the media gateway is in network region 1. change media-gateway 1 Page 1 of 1 MEDIA GATEWAY Number: 1 Name: internal Identifier: 03DR IP Address: MAC Address: 00:04:0d:02:0d:43 Network Region: 1 Location: 1 Site Data: Registered? y Slot Module Type V1: icc V2: analog V3: dcp V4: ds1 V8: V9: Figure 14: Display of G700 Media Gateway Parameters after Registration Figure 15 shows the result of a change station command, and illustrates port addressing for Avaya G700 Media Gateway ports. Port: 001v301 has the following meaning. 001 is the media gateway number. When entering data in a port field, it is only necessary to type 1v301. v3 is the slot location (i.e., media module bay number) within the gateway, and 01 is the port on this media module. Note that the prior command shows a DCP media module (MM712) in slot 3. change station Page 1 of 4 STATION Extension: Lock Messages? n BCC: 0 Type: 6408D+ Security Code: TN: 1 Port: 001V301 Coverage Path 1: COR: 1 Name: Ext Coverage Path 2: COS: 1 Hunt-to Station: STATION OPTIONS Loss Group: 2 Personalized Ringing Pattern: 1 Data Module? n Message Lamp Ext: Speakerphone: 2-way Mute Button Enabled? y Display Language: english Media Complex Ext: IP SoftPhone? n Figure 15: Display of Station Parameters on G700 Media Gateway 18 of 56

19 Define IP Address Information Figure 16 illustrates the mapping of node names to IP addresses. These node names will appear in other screens, such as the screen defining an H.323 signaling group. The IP address of the S8300 processor Ethernet interface is automatically assigned the node name procr. This node name is used as the near-end node name for the H.323 signaling group. The far-end node name for the H.323 signaling group is the node name assigned to the C-LAN in the SCC-1 gateway in Headquarters. change node-names ip Page 1 of 1 IP NODE NAMES Name IP Address Name IP Address A-CLAN A-MEDPRO default procr Figure 16: Mapping Node Names to IP Addresses The screen shown in Figure 17 is used to assign mask, gateway, and IP network region information to the IP interfaces of the gateway boards. Note that the S8300 processor interface is assigned to Network Region 1 via this form. change ip-interfaces Page 1 of 19 Enable IP INTERFACES Eth Pt Type Slot Code Sfx Node Name Subnet Mask Gateway Address Rgn y PROCR n Figure 17: Defining IP Interface Information Net 19 of 56

20 Define IP Network Region Figure 18 shows the IP Network Region form for Region 1 and illustrates the QoS configuration summarized in Table 2. The priority settings used to give VoIP signaling and media traffic priority over data traffic is summarized in Table 3. These values are used in the configuration steps that follow. Avaya Equipment IP Phones (no PC connected) PC running IP Softphone 802.1p/Q Configuration IP phone tags with VLAN ID received from DHCP server No 802.1p/Q header information was sent Foundry Configuration Notes Tagged for DSCP for signaling and media voice VLAN via MulitVantage IP network on port region Untagged voice VLAN on port DSCP for media from MulitVantage IP network region PC connected to IP Phone C-LAN in SCC-1 MEDPRO IPSI in SCC-1 S8700 Multi Connect G700 Media Gateway No 802.1p/Q header information was sent Enabled on IP network region form Enabled on IP network region form N/A (Cajun control network) N/A (Cajun control network) Enabled (set as trunk port in G700 CLI) Phone s port set to Dual Mode Untagged Voice VLAN Associate port with priority 6 Tagged voice VLAN N/A (Cajun control network) N/A (Cajun control network) Tagged voice VLAN Foundry port accepts tagged voice VLAN traffic from phone, and assigns untagged PC traffic with the assigned Data VLAN value Access list on Foundry switch to set DIFFSERV on untagged ICMP traffic DSCP for media set via MulitVantage IP network region form. N/A (Cajun control network) N/A (Cajun control network) DSCP for media from MulitVantage IP network region Table 2: QoS and Configuration Overview for Avaya Foundry Port Connections 20 of 56

21 The priority settings used to give VoIP signaling and media traffic priority over data traffic is summarized in Table 3. These values are used in the configuration steps that follow. Traffic Type 802.1p DiffServ Signaling 6 34 (Assured Forwarding) Media 7 46 (Expedited Forwarding) Table 3: Layer 2 and 3 QoS values change ip-network-region 1 Page 1 of 2 IP Network Region Region: 1 Name: Audio Parameters Codec Set: 1 Location: UDP Port Range Min: Max: Direct IP-IP Audio Connections? y IP Audio Hairpinning? y RTCP Enabled? y RTCP Monitor Server Parameters Use Default Server Parameters? y DiffServ/TOS Parameters Call Control PHB Value: 34 VoIP Media PHB Value: 46 BBE PHB Value: p/Q Enabled? y Call Control 802.1p Priority: 6 VoIP Media 802.1p Priority: Q VLAN: 20 Figure 18: Defining QoS Parameters in the IP Network Region Form Define IP Trunk Avaya SCC-1 and G600 Media Gateways contain TN2302AP circuit packs for IP media processing. In contrast, the G700 Media Gateway has IP media processing integrated on the motherboard (with the option to expand capacity via MM760 media modules). Whereas the SCC-1 and G600 contain TN799 C-LAN circuit packs for terminating H.323 signaling connections, H.323 signaling connections are terminated directly on the processor Ethernet interface of the Avaya S8300 Media Server. It is not necessary to add a data module as part of the administrative steps (as would be the case for a C-LAN). H.323 signaling and trunk groups are defined between Branch B and Headquarters. Signaling Group 1 (see Figure 19) creates a link between the processor in the S8300 Media Server in Branch C and the C-LAN in the SCC-1 Media Gateway in Headquarters. Signaling Group 1 is associated with Trunk Group 1. Note that the far-end network region is set to 1. MultiVantage 21 of 56

22 software will know that calls using this signaling group should have the characteristics of Region 1 (e.g., enable shuffling to IP-direct, use the codec defined for Region 1, etc). change signaling-group 1 Page 1 of 5 SIGNALING GROUP Group Number: 1 Group Type: h.323 Remote Office? n Max number of NCA TSC: 0 Max number of CA TSC: 0 Trunk Group for NCA TSC: Trunk Group for Channel Selection: 1 Supplementary Service Protocol: a Near-end Node Name: procr Far-end Node Name: A-CLAN Near-end Listen Port: 1720 Far-end Listen Port: 1720 Far-end Network Region: 1 LRQ Required? n Calls Share IP Signaling Connection? y RRQ Required? n Bypass If IP Threshold Exceeded? n Direct IP-IP Audio Connections? y IP Audio Hairpinning? y Interworking Message: PROGress Figure 19: Signaling Group Definition for IP Trunk (Site C->Site A) The considerations for the definition of Trunk Group1 are the same as those presented previously in Section 3. The command save translation must be entered to save the administration performed Configuration of the Avaya G700 Media Gateway Controller List The G700 Media Gateway will be configured to register with the Avaya S8300 Media Server as its controller. The G700 Media Gateway maintains a list of controller IP addresses. In this sample configuration, a single IP address, the IP address of the Avaya S8300 Media Server, will be added to this list. The command set mgc list is used as follows: Steps Description 1. Add S8300 to media gateway controller list. If the list is not empty to start with, use clear mgc list to remove all entries. MG-???-1(configure)# set mgc list MG-???-1(configure)# Shortly after this point, the G700 Media Gateway should register with its controller. The prompt shown below now includes the media gateway number assigned by the controller upon registration of the gateway. 22 of 56

23 Steps Description 2. Display the status of the H.248 link to the controller, as well as the contents of the controller list. MG-001-1(configure)# show mgc CALL CONTROLLER STATUS Registered : YES Active Controller : H248 Link Status : UP H248 Link Error Code: 0x0 MGC List Management : Static CONFIGURED MGC HOST DHCP SPECIFIED MGC HOST Not Available Not Available Not Available Not Available Not Available Not Available Not Available - MG-001-1(configure)# 23 of 56

24 5. Configure the Avaya IP Office System This section describes the steps necessary to configure IP Office. IP Office is configured using the IP Office Manager application. The LAN 1 connection is used for network connectivity, and is connected to Port 9 on the Foundry Networks FastIron Edge Configure the IP Office System Parameters Step Description 1. Using the IP Office Manager, browse the configuration tree and select System Configuration and click the LAN1 tab. a. Set IP Address to and IP Mask to b. Leave the Primary Trans. IP Address field blank c. Leave the Enable NAT box unchecked d. For the DHCP Mode, select Disabled. In the described configuration, static IP addresses are assigned to devices at the branch office. 24 of 56

25 Step Description 2. Click the Gatekeeper tab. a. Select the Gatekeeper Enable checkbox. b. It is not necessary to select the Auto-create Extn Enable checkbox, but it may be convenient to have extensions automatically assigned to IP endpoints. c. Enter the values as seen below for the fields DSCP, DSCP Mask (Hex) and S G DSCP (Hex). These values are the hexadecimal values and masks for DiffServ, or Differentiated Services, a method of ensuring quality of service. 25 of 56

26 5.2. Configure the Routing Settings for IP Office This section describes the steps necessary to configure the routing of calls via the VSU-100R firewall. Step Description 1. Using the IP Office Manager, browse the configuration tree and select IP Route. In the right pane, right-click and select New. a. Leave the IP Address field blank. b. Leave the IP Mask field blank. c. For the Gateway IP Address, enter This is the private network interface of the VSU-100R. d. For the Destination, select LAN1. e. Leave the Metric field blank. f. Leave the ProxyARP box unchecked. 26 of 56

27 5.3. Configure the VPN Line for IP Office This section describes the steps necessary to configure the IP trunk to the Headquarters MultiVantage. Note that IP Office terminology refers to this as a VPN Line. Hence, this terminology will be used in the IP Office configuration section of these Application Notes. Step Description 1. Using the IP Office Manager, browse the configuration tree and select VPN Line. In the right pane, right-click and select New. a. In the Line Number field, enter 06. b. Leave the Telephone Number field blank. c. In the Outgoing Channels field, enter 10. d. In the Voice Channels field, enter 10, since all the channels will be used for voice. e. In the Incoming Group ID field, enter 6. f. In the Outgoing Group ID field, enter 6. g. In the Nation Prefix field, enter 0. h. In the Number of Channels field, enter 10. i. In the Data Channels field, enter 10. j. In the TEI field, enter 0. k. In the International Prefix field, enter 10. l. Leave the Prefix field blank. 27 of 56

28 Step Description 2. Click the VoIP tab and perform the following steps: a. In the Gateway IP Address field, enter This is the IP address of the C-LAN at the Headquarters location. b. In the Compression Mode field, select G.729(a) 8K CS-ACELP. c. In the H.450 Mode field, select H.450. d. The Silence Suppression box may remain unchecked. e. Select the Enable Faststart checkbox. f. Leave the Fax Transport Support box unchecked. g. Leave the Local Hold Music box unchecked. h. Leave the Local Tones box unchecked. i. Select the Out of Band DTMF checkbox. j. Select the Allow Direct Media Path checkbox. k. Leave the Voice Networking box unchecked. Note that these settings will also be administered for each IP Telephone. 28 of 56

29 5.4. Configure the IP Telephone for IP Office This section describes the steps necessary to configure the IP Telephone at the IP Office branch location. Note that the IP Telephone was administered to use a static IP address and settings. Step Description 1. Using the IP Office Manager, browse the configuration tree and select Extension. In the right pane, right-click and select New. Select the Extn Tab. a. In the Extension ID field, enter This number may be automatically generated by the IP Office Manager application. Note that this number is not the extension that will be dialed. b. In the Extension ID field, enter This is the dialable extension for the IP telephone. c. In the Caller Display Type field, select Off. d. In the Equipment Classification section, select Standard Telephone. e. In the Flash Hook Pulse Width section, select Use System Defaults checkbox. 29 of 56

30 Step Description 2. Click the VoIP tab and perform the steps below. Note that these settings will reflect the settings in the system VoIP configuration tab. a. The IP Address field can be left blank as it is automatically associated with the phone. b. In the Voice Pkt. Size field, enter 80. c. In the Compression Mode field, select Automatic Selection. d. The MAC Address field can be left as all zeros, as it is automatically associated with the phone. e. The Silence Suppression box may remain unchecked, but it is not necessary. f. Select the Enable Faststart checkbox. g. Leave the Fax Transport Support box unchecked. h. Leave the Local Hold Music box unchecked. i. Leave the Local Tones box unchecked. j. Select the Out of Band DTMF checkbox. k. Select the Allow Direct Media Path checkbox. 30 of 56

31 5.5. Saving Changes to the IP Office Server a) Under the Manager File Menu item, select Save. At the Send Config to dialog box, click the immediately reboot mode radio button and press OK. b) If the IP Office Server IP address has been changed, update the PC address and reset the Manager preferences setting under the File menu before reconnecting. 6. Configure the Foundry Networks BigIron 4000 The BigIron 4000 serves as the core Layer 3 switch for Headquarters, and as such it must be configured to route traffic among the various voice and data VLANs between devices at Headquarters and the WAN. As shown in Figure 1 and Figure 2, it is connected to the FastIron Edge switch using a 1Gbps fiber link. The following configuration steps implement this connectivity. Steps Description 1. Attach a serial port connector to the front console of the Foundry BigIron 4000 switch, and log in. Enter super-user and then configuration mode: CoreSwitch>enable Password: CoreSwitch#config t CoreSwitch(config)# 2. Configure the port for the VPN device private side port: CoreSwitch(config)#interface ethernet 2/1 CoreSwitch(config-e1000-2/1)#port-name VPN Private Side CoreSwitch(config-e1000-2/1)#priority 7 CoreSwitch(config-e1000-2/1)#exit CoreSwitch(config)# 3. Configure the port and VLAN for the DHCP server: CoreSwitch(config)#interface ethernet 2/8 CoreSwitch(config-e1000-2/8)#port-name DHCP_SVR CoreSwitch(config-e1000-2/8)#priority 7 CoreSwitch(config-e1000-2/8)#exit CoreSwitch(config)#vlan 40 CoreSwitch(config-vlan-40)#untagged ethe 2/8 CoreSwitch(config-vlan-40)#exit CoreSwitch(config)# 31 of 56

32 Steps Description 4. Configure Headquarters voice and data VLANs and their gateway virtual interfaces CoreSwitch(config)#vlan 10 Voice VLAN CoreSwitch(config-vlan-10)#tagged ethe 1/1 Uplink from Branch A CoreSwitch(config-vlan-10)#untagged ethe 2/1 VPN private side CoreSwitch(config-vlan-10)#router-interface ve 10 Gateway for VLAN 10 CoreSwitch(config-vlan-10)#exit CoreSwitch(config)# CoreSwitch(config)#vlan 11 Data VLAN CoreSwitch(config-vlan-11)#tagged ethe 1/1 Uplink from Branch A CoreSwitch(config-vlan-11)#router-interface ve 11 Gateway for VLAN 11 CoreSwitch(config-vlan-11)#exit CoreSwitch(config)#int ve 10 Virtual router I/F CoreSwitch(config-vif-10)# ip address CoreSwitch(config-vif-10)# ip helper-address DHCP relay CoreSwitch(config-vif-10)# exit CoreSwitch(config)#int ve 11 Virtual router I/F CoreSwitch(config-vif-11)# ip address CoreSwitch(config-vif-11)# ip helper-address DHCP relay CoreSwitch(config-vif-11)# exit 5. Save the running configuration CoreSwitch(config)#write memory.write startup-config in progress..write startup-config done. CoreSwitch(config)# 7. Configure the Foundry Networks FastIron Edge 9604 Configuration of the Headquarters switch includes the ports and VLANs for the Avaya SCC-1 Media Gateway boards, IP telephones, and the uplink to the BigIron 4000 switch/router. The following configuration steps implement this connectivity. Steps Description 1. Attach a serial port connector to the front console of the Foundry FastIron Edge 9604 switch, and log in. Enter super-user and then configuration mode: BranchA>enable Password: BranchA#config t BranchA(config)# 32 of 56

33 Steps Description 2. Configure the Ethernet ports for the MEDPRO and C-LAN boards. Note that since ICMP messages from the C-LAN are not DIFFSERV marked, they must be marked by the switch. Access list to mark ICMP messages with DIFFSERV=34 BranchA(config)#access-list 101 permit icmp any any any-icmp-type tos-marking 34 BranchA(config)#access-list 101 permit any any BranchA(config)#interface ethernet 1 BranchA(config-if-e100-1)#port-name MEDPRO-A BranchA(config-if-e100-1)#speed-duplex 100-full BranchA(config-if-e100-1)#exit BranchA(config)#interface ethernet 3 BranchA(config-if-e100-3)#port-name CLAN-A BranchA(config-if-e100-3)#priority 7 BranchA(config-if-e100-3)#speed-duplex 10-half BranchA(config-if-e100-3)#ip access-group 101 in DiffServ=34 for ICMP messages BranchA(config-if-e100-3)#exit 3. Configure the Ethernet ports for the IP telephones. One port is shown here. The default VLAN for the untagged PC traffic is the data VLAN (11). BranchA(config)#interface ethernet 11 BranchA(config-if-e100-1)#port-name IP-Telephone-A1 BranchA(config-if-e100-1)#dual-mode 11 BranchA(config-if-e100-1)#exit 4. Configure the voice VLAN p/Q tagged voice traffic from the MEDPRO (1), IP telephone (11 and 12), and Gigabit uplink (100) ports is assigned to this VLAN. The C-LAN port (3) must be administered as untagged. BranchA(config)#vlan 10 BranchA(config-vlan-10)#tagged ethe 1 BranchA(config-vlan-10)#untagged ethe 3 BranchA(config-vlan-10)#tagged ethe 11 to 12 BranchA(config-vlan-10)#tagged ethe 100 BranchA(config-vlan-10)#exit BranchA(config)# MEDPRO C-LAN IP-Telephones Uplink to BigIron 5. Configure the data VLAN. Although not tested in the sample configuration, inclusion of the IP telephone ports allows PC s that support 802.1p/Q tagging to be connected to the telephones. BranchA(config)#vlan 11 BranchA(config-vlan-11)#tagged ethe 11 to 12 BranchA(config-vlan-11)#tagged ethe 100 BranchA(config-vlan-11)#exit BranchA(config)# IP-Telephones Uplink to Bigiron 33 of 56

34 Steps 6. Save the running configuration Description BranchA(config)#write memory.write startup-config in progress..write startup-config done. BranchA(config)# 8. Configure the Foundry Networks FastIron Edge 4802 (IP Office) Configuration of the Branch B switch includes the ports and VLANs for the Avaya IP Office Server, IP Office Manager PC, IP telephones, and the WAN link to the VPN device. The following configuration steps implement this connectivity. Steps Description 1. Attach a serial port connector to the front console of the Foundry FastIron Edge 4802 switch, and log in. Enter super-user and then configuration mode: BranchB>enable Password: BranchB#config t BranchB(config)# 2. Configure the Ethernet ports for the Avaya IP Office Server and IP Office Manager PC. Note that since ICMP messages from the server are not DIFFSERV marked, they must be marked by the switch. Access list to mark ICMP messages with DIFFSERV=34 BranchB(config)#access-list 101 permit icmp any any any-icmp-type tos-marking 34 BranchB(config)#access-list 101 permit any any BranchB(config)#interface ethernet 7 BranchB(config-if-e100-7)#port-name IP Office Manager PC BranchB(config-if-e100-7)#priority 7 BranchB(config-if-e100-7)#exit BranchB(config)#interface ethernet 9 BranchB(config-if-e100-9)#port-name IP Office Server BranchB(config-if-e100-9)#priority 7 BranchB(config-if-e100-9)#ip access-group 101 in DiffServ=34 for ICMP BranchB(config-if-e100-9)#exit messages 34 of 56

35 Steps Description 3. Configure the Ethernet port for the VPN private side: BranchB(config)#interface ethernet 1 BranchB(config-if-e100-1)#port-name VPN Private Side BranchB(config-if-e100-1)#priority 7 BranchB(config-if-e100-1)#exit BranchB(config)# 4. Configure the Ethernet ports for the IP telephones. One port is shown here. The default VLAN for the untagged PC traffic is the data VLAN (21). BranchB(config)#interface ethernet 11 BranchB(config-if-e100-11)#port-name IP-Telephone B1 BranchB(config-if-e100-11)#dual-mode 21 BranchB(config-if-e100-11)#exit 5. Configure the voice VLAN p/Q tagged voice traffic from the IP telephone ports (11 and 12) is assigned to this VLAN. The IP Office Server port (9) must be administered as untagged. BranchB(config)#vlan 20 BranchB(config-vlan-20)#tagged ethe 1 BranchB(config-vlan-20)#untagged ethe 7 BranchB(config-vlan-20)#untagged ethe 9 BranchB(config-vlan-20)#tagged ethe 11 to 12 BranchB(config-vlan-20)#exit BranchB(config)# VPN Private Side IP Office Manager IP Office Server IP Telephones 6. Configure the data VLAN. Although not tested in the sample configuration, inclusion of the IP telephone ports allows PC s that support 802.1p/Q tagging to be connected to the telephones. BranchB(config)#vlan 21 BranchB(config-vlan-21)#tagged ethe 11 to 12 BranchB(config-vlan-21)#exit BranchB(config)# IP Telephones 7. Save the running configuration BranchB(config)#write memory.write startup-config in progress..write startup-config done. BranchB(config)# 9. Configure the Foundry Networks FastIron Edge 4802 (S8300/G700) Since each branch office was configured and tested with the Headquarters equipment independently, the FastIron Edge 4802 switch and configuration for Branch B described in the 35 of 56

36 previous section was re-used for Branch C. The Avaya S8300/G700 was substituted for the IP Office Server. The following configuration steps relative to Section 8 are changed to support the S8300/G700: 2. Configure the Ethernet ports for the S8300/G700. Since all traffic from the server is marked at Layer 2 (802.1p/Q) and layer 3 (DIFFSERV), neither port priority nor the access list is needed. The port for the IP Office Manager is also not required. BranchC(config)#interface ethernet 9 BranchC(config-if-e100-9)#port-name S8300/G700 BranchC(config-if-e100-9)#exit 5. Configure the voice VLAN p/Q tagged voice traffic from the IP telephone ports (11 and 12) and the S8300/G700 is assigned to this VLAN. The S8300/G700 port (9) must be administered as tagged. BranchC(config)#vlan 20 BranchC(config-vlan-20)#tagged ethe 1 BranchC(config-vlan-20)#tagged ethe 9 BranchC(config-vlan-20)#tagged ethe 11 to 12 BranchC(config-vlan-20)#exit BranchC(config)# VPN Private Side S8300/G700 IP Telephones 10. WAN Configuration The following sections describe the steps necessary to configure an Avaya WAN solution. Avaya P333R switches with X330 WAN modules were used to interconnect a PPP T1 connection, and the Avaya VSU-5000 Gateway and Avaya VSU-100R Gateway were used as firewalls and VPN tunnel endpoints. Although the configurations for the VSU-5000 and VSU- 100R are very similar, each device s settings are described in detail for completeness. A laptop computer with the Avaya VPNmanager software was used to administer the VSU and VSU-100R. The IP address of the laptop was changed to match the private side of the appropriate VSU unit; for the VSU-5000 the address was , for the VSU-100R the address was Note that hands-on testing had verified that acceptable voice quality was achieved using this configuration. For those customers who require that data packets have ensured delivery, a configuration using two VPN tunnels (one for voice, one for data) can be utilized. See the Reference section for more details. 36 of 56

37 11. Configure the Headquarters X330 WAN Module System This section provides the instructions for configuring the Headquarters X330W-2DS1 module. Connect from the PC to the X330W-2DS1 console interface via a console cable and run a terminal emulator, such as HyperTerminal, to access the command line interface. Step 1: Create an IP access list and set the QOS policy source Configuration Description ip access-list-name 100 "phone" ip access-list-dscp operation "fwd6" ip access-list-dscp operation "fwd7" ip access-list-dscp trust 100 trust-dscp set qos policy-source local The access list includes the trust-dscp line to ensure that the module looks to the DSCP field for priority rather than the layer 2 priority field. The decimal values of the 6-bit DSCP field are consistent with the VSU markings for Expedited Forwarding (Decimal 46) and Assured Forwarding (Decimal 38). Though not shown here, it is good form to ensure that all of the DSCP values are set to the desired forwarding priority. The module will read policy rules for prioritization from this configuration (local) rather than from an external server. Figure 20: IP Access List Step 2: Configure the T1 Interface Configuration ds-mode t1! controller T1 2 linecode b8zs framing esf clock source internal cablelength short 133ft channel-group 0 timeslots 1-12 speed 64 Description In this configuration, the second T1 interface was used. The first 12 timeslots are joined in a channel group and set to use the full 64 Kbps for data. Figure 21: T1 Interface 37 of 56

38 Step 3: Configure the Serial Interface Configuration Description! The interface Serial 2:0 is a logical interface Serial 2:0 interface associated with the second T1 encapsulation ppp interface. The bandwidth is set to 768 Kbps to description "T1 to Branch" bandwidth 768 correspond to the T Kbps channelgroup 0. PPP protocol is enabled. Access ip access-group 100 in ip access-group 100 out group 100, defined earlier in the configuration ip address file, is applied bi-directionally to the interface.! Figure 22: Serial Interface Step 4: Configure the FastEthernet port Configuration Description! For the X330W-2DS1 module on the interface FastEthernet 1 Headquarters side, the fast Ethernet interface description "HQ Lan via VSUis set to , which will be used as the 5000 Public" ip address default route in the VSU-5000 gateway. (For the X330WAN module on the Branch side, ip routing-mode rt_primary_mgmt the fast Ethernet is set to , which! will be the default route in the VSU 100 gateway.) Figure 23: FastEthernet port Step 5: Configure the IP route Configuration ip route low Figure 24: IP Route Description For the X330W-2DS1 module on the Headquarters side, a static route is set to forward all traffic to (the VSU- 100 gateway public-side subnet) over the PPP link. (For the X330W-2DS1 module on the Branch side, the static link is set to forward all traffic to (the VSU-5000 gateway public side subnet) over the PPP link). Note: To forward nonencrypted traffic, additional routing entries must be added. 38 of 56

39 12. Configure the Branch X330 WAN Module System This section provides the instructions for configuring the branch X330W-2DS1 module. Connect from the PC to the X330W-2DS1 console interface via a console cable and run a terminal emulator, such as HyperTerminal, to access the command line interface. 1. Create an IP access list and set the QOS policy source Configuration Description ip access-list-name 100 "phone" ip access-list-dscp operation "fwd6" ip access-list-dscp operation "fwd7" ip access-list-dscp trust 100 trust-dscp! set qos policy-source local The access list includes the trust-dscp line to ensure that the module looks to the DSCP field for priority rather than the layer 2 priority field. The decimal values of the 6-bit DSCP field are consistent with the VSU markings for Expedited Forwarding (Decimal 46) and Assured Forwarding (Decimal 38). Though not shown here, it is good form to ensure that all of the DSCP values are set to the desired forwarding priority. The module will read policy rules for prioritization from this configuration (local) rather than an external server. Figure 25: IP Access List 2. Configure the T1 Interface Configuration ds-mode t1! controller T1 2 linecode b8zs framing esf cablelength short 133ft channel-group 0 timeslots 1-12 speed 64 Description In this configuration, the second T1 interface was used. The first 12 timeslots are joined in a channel group and set to use the full 64 Kbps for data. Figure 26: T1 Interface 39 of 56

40 3. Configure the Serial Interface Configuration Description! The interface Serial 2:0 is a logical interface Serial 2:0 interface associated with the second T1 encapsulation ppp interface. The bandwidth is set to 768 Kbps to description "T1 2 to HQ WAN" bandwidth 768 correspond to the T Kbps channelgroup 0. PPP protocol is enabled. Access ip access-group 100 in ip access-group 100 out group 100, defined earlier in the configuration ip address file, is applied bi-directionally to the interface.! Figure 27: Serial Interface 4. Configure the FastEthernet port Configuration Description! For the X330W-2DS1 module on the interface FastEthernet 1 headquarters side, the fast Ethernet interface description "Branch LAN to VSU is set to , which will be used as the 100 Public" ip address default route in the VSU-5000 gateway. (For the X330WAN module on the branch side, ip routing-mode rt_primary_mgmt the fast Ethernet is set to , which! will be the default route in the VSU 100 gateway.) Figure 28: FastEthernet port 5. Configure the IP route Configuration ip route low Figure 29: IP Route Description For the X330W-2DS1 module on the Headquarters side, a static route is set to forward all traffic to (the VSU 100 gateway public-side subnet) over the PPP link. (For the X330W-2DS1 module on the Branch side, the static link is set to forward all traffic to (the VSU-5000 gateway public side subnet) over the PPP link. Note: To forward non-encrypted traffic, additional routing entries must be added. 40 of 56

41 13. Configure the Headquarters VSU-5000 Gateway For these steps, set the IP address of the laptop with the Avaya VPNmanager software to Steps Description Connect to VSU Using a null modem cable, connect the VSU-5000 to the PC. 2 Start a HyperTerminal session to the VSU-5000 Bits per second 9600 Data bits 8 Parity None Stop bits 1 Flow control None 3 Enter the VSU console password defined during initial use of the VSU. Reset VSU 4 On the main console menu Select 1 - Configuration Select 6 - Flush Configuration Enter the password At the prompt: Do you really want to flush all configurations? [yn], enter y At the prompt: Reboot required to complete the flush. Do you really want to reboot? [yn] enter y Run Quick Setup 5 On the main console menu Enter the password Select 5 Quick Setup and enter the following responses when prompted: o IP Address o IP Mask o At the prompt Do you want a secondary IP address on this unit? [yn], enter y o IP Address o IP Mask o Default Route o At the prompt Reboot Now? [yn], enter y Launch VPNmanager 6 On the Start menu Select Start! Programs! VPNmanager! VPNmanager Console 7 In the VPNmanager Login window Enter the User Name and Password (these were defined during VPNmanager installation) Choose VPNmanager Server Click the Connect button 41 of 56

42 Create a VSU Domain 8 In the VPNmanager: No Domain opened window Select VPN Domain! New on the pull-down menu Enter the Name for the new domain, e.g. VPNManager Click Apply 9 In the VPNmanager: VPNmanager window Click on the Config button 10 In the VSU Setup Wizard Enter the new VSU name, e.g. VSU-5000 Click Next Choose the New VSU Setup radio button Click Next Choose IP Address radio button Enter (Primary IP Address of the VSU) Enter (Secondary IP address of the VSU) Enter (Secondary IP Mask) Click Next Use default for Allow VSU to use VPNmanager Server to authenticate administrators checkbox Click Next Leave SNMP community String set to public Click Next Click Deny all non VPN traffic Click the VSU Setup Wizard Next button Select Setup Now Click Finished When prompted, enter superuser user name and password Click Save (highlighted in yellow) in the Configuration Console Click Update VSUs in the Configuration Console 42 of 56

43 Create IP Group (Trusted Side) 11 In the Configuration Console window Select Edit! New Object! IP Group on the pull-down menu 12 In the New IP Group popup window Enter the name of the IP Group, e.g. Branch-Group Click Apply Click Close 43 of 56

44 13 In the Configuration Console window Click IP Group Add In the Add IP Group Members popup window, enter o New IP Network o New IP Mask Click Apply Click Close Click on the Associate this group with VSU list Select VSU-100R in place of Extranet device Click Save (yellow button) Click Update VSUs Create IP Group (Untrusted Side) 14 In the Configuration Console window Select Edit! New Object! IP Group on the pull-down menu 44 of 56

45 15 In the New IP Group popup window Enter the name of the IP Group, e.g. HQ-Group Click Apply Click Close 16 In the Configuration Console window Click IP Group Add In the Add IP Group Members popup window, enter o New IP Network o New IP Mask Click Apply Click Close Click on the Associate this group with VSU list Select VSU-5000 Click Save (yellow button) Click Update VSUs 45 of 56

46 Create a VPN 17 In the Configuration Console window Select Edit! New Object! VPN on the pull-down menu In the New VPN, enter: o New VPN Name VPNTunnel o VPN Type IKE Click Apply Click Close 18 Select the General tab o Click Preshared Secret o Check the Enable VPN checkbox 46 of 56

47 19 Select the Members IP Groups tab Move HQ-Group and Branch-Group from the Available column to the Members column. 47 of 56

48 20 Select the Security (IKE) tab Provide the following information: o Encryption Algorithm 3DES o Authentication Algorithm MD5 o Lifetime (Time Based) 1 Day o Lifetime (Throughput) 0GB o Diffie-Hellman Group 2 48 of 56

49 21 Click Modify Secret to provide the Pre-Shared Secret key. 49 of 56

50 22 Select the Security (IPSec) tab Provide the following information: o LZS NO o Perfect Forward Secrecy NO o AH/ESP ESP Trailer 50 of 56

51 23 Click Add.. and enter the following: o Encryption 3DES o Authentication HMAC-SHA o Lifetime (Time Based) 1 Day o Lifetime (Throughput) 0GB o Click OK 24 Click Save (yellow button) Click Update VSUs 51 of 56

52 14. Configure the Branch VSU-100R Gateway For these steps, set the IP address of the laptop with the Avaya VPNmanager software to By using the same laptop computer and the same VSU domain name, some information will be preserved from the previous section. Steps Description Connect to VSU-100R 1 Using a null modem cable, connect the VSU-100R to the PC. 2 Start a HyperTerminal session to the VSU-100R Bits per second 9600 Data bits 8 Parity None Stop bits 1 Flow control None 3 Enter the VSU console password defined during initial use of the VSU. Reset VSU 4 On the main console menu Select 1 - Configuration Select 6 - Flush Configuration Enter the password At the prompt: Do you really want to flush all configurations? [yn], enter y At the prompt: Reboot required to complete the flush. Do you really want to reboot? [yn] enter y Run Quick Setup 5 On the main console menu Enter the password Select 5 Quick Setup and enter the following responses when prompted: o IP Address o IP Mask o At the prompt Do you want a secondary IP address on this unit? [yn], enter y o IP Address o IP Mask o Default Route o At the prompt Reboot Now? [yn], enter y Launch VPNmanager 6 On the Start menu Select Start! Programs! VPNmanager! VPNmanager Console 7 In the VPNmanager Login window Enter the User Name and Password (these were defined during VPNmanager installation) Choose VPNmanager Server Click the Connect button 52 of 56

53 Create a VSU Domain 8 In the VPNmanager: No Domain opened window Select VPN Domain! VPNManager Click Apply 9 In the VPNmanager: VPNmanager window Click on the Config button 10 In the VSU Setup Wizard Enter the new VSU name, e.g. VSU-100R Click Next Choose the New VSU Setup radio button Click Next Choose IP Address radio button Enter (Primary IP Address of the VSU) Enter (Secondary IP address of the VSU) Enter (Secondary IP Mask) Click Next Use default for Allow VSU to use VPNmanager Server to authenticate administrators checkbox Click Next Leave SNMP community String set to public Click Next Click Deny all non VPN traffic Click the VSU Setup Wizard Next button Select Setup Now Click Finished When prompted, enter superuser user name and password Click Save (highlighted in yellow) in the Configuration Console Click Update VSUs in the Configuration Console 53 of 56

54 Verify IP Group Settings 11 In the Objects menu on the left side, select IP Group. Verify that Branch-Group have been preserved from configuring the VSU If not, follow the steps in Section 13, starting from Step In the Objects menu on the left side, select IP Group. Verify that HQ-Group have been preserved from configuring the VSU If not, follow the steps in Section 13, starting from Step 14. Verify VPN Settings 13 In the Objects menu on the left side, select VPN. Verify that VPN has been preserved from configuring the VSU If not, follow the steps in Section 13, starting from Step Click Save (yellow button) Click Update VSUs 54 of 56