Configuring the Avaya SG203 Security Gateway to Support H.323 IP Trunking over Port Network Address Translation (PNAT) - Issue 1.0

Transcription

1 Configuring the Avaya SG203 Security Gateway to Support H.323 IP Trunking over Port Network Address Translation (PNAT) - Issue 1.0 Abstract These Application Notes describe how to configure the Avaya SG203 Security Gateway to support H.323 IP Trunk signaling and media traffic through PNAT. The sample VoIP configuration depicted in this document consists of an Avaya S8700 Media Server with an Avaya G600 Media Gateway (S8700/G600) located in a headquarters office, and an Avaya S8300 Media Server with an Avaya G700 Media Gateway (S8300/G700) located in a remote office. The PNAT configuration takes place at the remote site, where private nonroutable addresses are translated to a routable public address with different port numbers. 1 of 22

2 1. Introduction These Application Notes describe how to configure the Avaya SG203 Security Gateway to support H.323 IP trunk signaling and media traffic through PNAT. The sample VoIP reference configuration depicted in this document consists of Avaya telephony equipment running Avaya Communication Manager software. The Avaya SG203 Security Gateway is a Virtual Private Network (VPN) gateway/stateful firewall targeted for large enterprises and service provider networks. The SG203 Security Gateway firewall functionality features an integrated H.323 application proxy that addresses VoIP deployment issues in a NAT environment. The SG203 Security Gateway acts as an intermediary between two gatekeepers performing H.323 manipulations on IP Trunk signaling and media streams. Figure 1 illustrates the components of the VoIP network configuration used to verify these Application Notes. An H.323 IP Trunk is configured between the Avaya S8700 Media Server located in the headquarters office and the Avaya S8300 Media Server located in the remote office. The Avaya SG203 Security Gateway located at the remote site is connected between the Cisco 2621 WAN access router and the Avaya P333R switch. Placing the Avaya SG203 Security Gateway in this location ensures all H.323 IP Trunk traffic originating from the remote site passes through the SG203 Security Gateway. The Avaya IP Telephones/Softphones in the headquarters office are registered to the Avaya S8700 Media Server. In the remote office, the Avaya IP Telephones/Softphones are registered with the Avaya S8300 Media Server. Figure 1: Avaya H.323 IP Trunk over PNAT Configuration 2 of 22

3 Note: These Application Notes assume the Layer 2 and Layer 3 network configuration depicted in Figure 1 is already in place. Only the configuration related to the PNAT and the H.323 proxy implementation is addressed. Please consult the appropriate User Guides for more information on how to setup the remaining components. 2. Hardware and Software Validated Hardware and Software Version Avaya TM S8700 Media Server 1.3 Avaya G600 Media Gateway 1.3 Avaya TM S8300 Media Server 1.3 Avaya TM G700 Media Gateway Avaya 4600 Series IP Telephones 1.78 Avaya IP Softphones Avaya P333R Modular Stackable Switches Avaya SG203 Security Gateway 4.3 Cisco 2621 Router 12.2(8)T4 DHCP/TFTP Servers: Microsoft Windows 2000 Server (SP2) Table 1: Hardware and Software Versions 3 of 22

4 3. Avaya SG203 VoIP (H.323 Proxy) Configuration The following configuration was done through the Avaya SG203 Security Gateway Web Graphical User Interface (GUI). Note: This procedure has also been verified for the Avaya SG208 Security Gateway. Step Description 1. Bring up a web browser using https with the public or private IP address of the Avaya SG 203 Security Gateway and log in using an administrative username and password. 2. The main management window appears upon logging into the Avaya SG203 Security Gateway. Add the voice and data private subnets to the PRIVATE-NET network object. The PRIVATE-NET network object will be used later in the H.323 proxy VoIP rule configuration. Navigate to Configure Security Tab Network Object. Highlight the PRIVATE- NET object and click the Modify button to specify the subnets for the private networks. 3. The following Modify Network Object window is displayed. Enter the IP address(s)/network Mask(s) of the private networks. The IP address and network mask entered below includes both the private data (IP: ) and voice (IP: ) networks. Click the Add button to add the IP address(s)/network Mask(s) to the network object window. Repeat this procedure if needed. Click the OK button to modify the SG203 PRIVATE-NET network object. 4 of 22

5 4. The SG203 Security Tab window is displayed. Click the Add button to add a network object with the IP addresses of the C-LAN and MEDPRO cards located in the Avaya S8700 Media Server/G600 Media Gateway. 5. The following Add Network Object window is displayed. Enter the IP address(s)/ Mask(s) of the voice subnet in the headquarters office. Click the Add button to add the IP address(s)/mask(s) to the network object. Click the OK button to add the SG203 s8700 network object. 5 of 22

6 6. The Avaya SG203 Security Gateway Security Tab window is displayed. Click the Save button to save the SG203 Network Object changes. 6 of 22

7 7. Navigate to Configure Network Tab NAT. Check the Enable NAT parameter and the Share Public Address To Reach Internet parameter to globally enable NAT and PNAT, respectively, on the Avaya SG203 Security Gateway. Click the Save button to save the NAT changes. 7 of 22

8 8. Add an H.323 proxy VoIP rule to handle the H.323 IP Trunk traffic from the Avaya S8700 Media Server/G600 Media Gateway located in the headquarters office (public side). This rule instructs the Avaya SG203 Security Gateway to direct H.323 IP Trunk traffic originating from the public IP address of the G600 Media Gateway C-LAN card, to the private IP address of the Avaya S8300 Media Server. Navigate to Configure Security Tab VoIP. Check the Enable VoIP check box to enable the VoIP feature globally on the SG203 Security Gateway. Click the Add button. The following fields are displayed in the SG203 VoIP Configuration window: Enable Rule Check to enable the VoIP rule. Name Enter a unique name for the VoIP rule. Call Model Select IP Trunking to enable the rule for H.323 IP Trunks. Service Port Enter destination port number for H.323 IP Trunk signaling (Default port: 1720). Timeout Enter session timeout in seconds Click the Next button to continue. 8 of 22

9 9. Configure the source endpoints to which the H.323 proxy VoIP rule will be applied: Select the public source endpoint Zone to indicate this rule manipulates traffic from the public routable side of the SG203 Security Gateway. Move the s8700 network object from the Available box to the Members box, to specify the rule applies to the public IP addresses assigned to the C-LAN and MEDPRO cards in the headquarters office Avaya G600 Media Gateway. Click the Next button to continue. 9 of 22

10 10. Select the zone where the Avaya S8300 Media Server and Avaya G700 Media Gateway are located with respect to the Avaya SG203 Security Gateway: Select the private destination endpoint Zone to indicate the S8300 Media Server/G700 Media Gateway are located on the private non-routable side of the SG203 Security Gateway. Click the Add button to add the IP address of the Avaya S8300 Media Server and the Proxy IP address and port number. 10 of 22

11 11. The following fields are displayed in the Add Destination Trunk window shown below: Trunk IP - Enter the IP address of the S8300 Media Server. Proxy IP - Enter the IP address of the Avaya SG203 public interface. Proxy Port - Enter This is the default trunk port on the Avaya SG203 Security Gateway as well as on the Avaya PBXs. This rule instructs the Avaya SG203 Security Gateway to forward H.323 IP trunk traffic sent to the public IP address/port number of the Avaya SG203 Security Gateway (IP: , port 1720) to the private IP address of the S8300 Media Server (IP: ). Click the OK button to add the IP Addresses. 11 of 22

12 12. The following SG203 VoIP Configuration window is displayed. Click the Finish button to finish adding the VoIP rule. 12 of 22

13 13. The Configure Security Tab VoIP window is displayed. Click the Add button to add a second rule to manipulate the H.323 IP trunk traffic origination from the Avaya S8300 Media Server/G700 Media Gateway located on the private side. The following fields are displayed in the SG203 VoIP Configuration window: Enable Rule Check to enable the VoIP rule. Name Enter a unique name for the VoIP rule. Call Model Select IP Trunking to enable the rule for H.323 IP Trunks. Service Port Enter destination port number for H.323 IP Trunk signaling (Default port: 1720). Timeout Enter session timeout in seconds Click the Next button to continue. 13 of 22

14 14. Configure the source endpoints to which the H.323 proxy VoIP rule will be applied: Select the private source endpoint Zone to indicate this rule manipulates traffic from the private non-routable side of the Avaya SG203 Security Gateway. Move the PRIVATE-NET network object from the Available box to the Members box, to specify the rule applies to the private IP addresses of the Avaya S8300 Media Server/G700 Media Gateway. Click the Next button to continue. 14 of 22

15 15. Select the zone where the Avaya S8700 Media Server and Avaya G600 Media Gateway are located with respect to the Avaya SG203 Security Gateway: Select the public destination endpoint Zone to indicate the S8700 Media Server/G600 Media Gateway are located on the public routable side of the SG203 Security Gateway. Click the Add button to add the IP address of the of the Avaya G600 Media Gateway C-LAN card. 15 of 22

16 16. The following fields are displayed in the Add Destination Trunk window shown below: Trunk IP - Enter the IP address of the C-LAN card located in the headquarters office Avaya G600 Media Gateway. Proxy IP Leave this field blank. Proxy Port Leave this field the default value. This rule instructs the Avaya SG203 Security Gateway to manipulate H.323 IP trunk traffic destined to the IP address of the C-LAN card (IP: ) in the headquarters office. Click the OK button to add the IP Address. 16 of 22

17 17. The following SG203 VoIP Configuration window is displayed. Click the Finish button to finish adding the VoIP rule. 17 of 22

18 18. The Configure Security Tab VoIP window is displayed. Click the Save button to save the H.323 proxy VoIP rule. Click the Logout button to log out of the SG203 Security Gateway. 18 of 22

19 19. The SG203 Confirmation window is displayed: Click the OK button to log out of the Avaya SG203 Security Gateway. 4. H.323 IP Trunk Configuration The H.323 IP trunk/signaling group configurations between the two Avaya S8x00 Media Servers should follow the standard procedure outlined in the Administration for Network Connectivity for Avaya Communication Manager, Issue 6, Doc ID: user guide. However, since the Avaya S8300 Media Server in the remote office is assigned private non-routable IP addresses, the Avaya SG203 Security Gateway node needs to be assigned as the Far-End Node Name in the Avaya S8700 Media Server signaling group form. Before the SG203 Security Gateway can be assigned as a node in the signaling group form, a SG203 node must be defined in the Avaya S8700 Media Server. To create a node name with the IP address of the Avaya SG203 Security Gateway public interface, issue the change node-names ip command from the Avaya S8700 Media Server System Access Terminal (SAT). 19 of 22

20 change node-names ip Page 1 of 1 IP NODE NAMES Name IP Address Name IP Address clan medpro sg default ( 3 of 19 administered node-names were displayed ) Use 'list node-names' command to see all the administered node-names Use 'change node-names ip xxx' to change a node-name 'xxx' or add a node-name Figure 2: Avaya S8700 Media Server Node-Names IP Form When creating the Avaya S8700 Media Server signaling group for the H.323 IP trunk connectivity to the remote office Avaya S8300 Media Server, assign the sg200 node as the Far-End Node Name. add signaling-group 21 Page 1 of 5 SIGNALING GROUP Group Number: 21 Group Type: h.323 Remote Office? n Max number of NCA TSC: 0 Max number of CA TSC: 0 Trunk Group for NCA TSC: Trunk Group for Channel Selection: 21 Supplementary Service Protocol: a Network Call Transfer? n Near-end Node Name: clan Far-end Node Name: sg200 Near-end Listen Port: 1720 Far-end Listen Port: 1720 Far-end Network Region: 1 LRQ Required? n Calls Share IP Signaling Connection? n RRQ Required? n Bypass If IP Threshold Exceeded? n Direct IP-IP Audio Connections? n IP Audio Hairpinning? y Interworking Message: PROGress ESC-x=Cancel Esc-e=Submit Esc-p=Prev Pg Esc-n=Next Pg Esc-h=Help Esc-r=Refresh Figure 3: Avaya S8700 Media Server Signaling Group Form Note 1: The Avaya SG203 Security Gateway does not support calls sharing the same signaling connection; the feature should be disabled on both the Avaya S8700 and S8300 Media Server signaling group forms. To disable this feature, make sure both signaling group forms have the Calls Share IP Signaling Connection field set to n. Note 2: Since IP shuffling 1 is not supported in the current version of the Avaya SG203 Security Gateway, the feature should be disabled on both the Avaya S8700 and S8300 Media Server 1 Please note that shuffling is known as Direct IP-IP Audio Connections by the Avaya S8700 Media Server. 20 of 22

21 signaling group forms. To disable IP shuffling, make sure both signaling group forms have the Direct IP-IP Audio Connections field set to n. Note 3: The version of the Avaya SG203 Security Gateway shown in section 2 does not support Location Request (LRQ) messages; therefore the LRQ Required? field on the signaling group form should be set to n. LRQ is used when ICMP Echo Request messages cannot be used for IP trunk signaling. 5. Verification Steps In the field, the following tests can be performed to verify the Avaya SG203 H.323 IP Trunk proxy feature over PNAT: 1. Use the status signaling-group <group#> command from both the Avaya S8700 and S8300 Media Servers SAT screens to verify the signaling groups are in the in service state. 2. Use the status trunk <trunk #> command from the Avaya S8700 and S8300 Media Servers SAT to verify the trunk groups are in the in service/idle state. 3. Place a call from a headquarters office phone to a remote office phone and verify two-way talk path exists. 4. Place a call from a remote office phone to a headquarters office phone and verify two-way talk path exists. 5. Use the list trace <TAC #> command from the Avaya S8x00 Media Server SAT screen to trace incoming and outgoing calls on the H.323 IP Trunk. 6. Conclusion The Avaya SG203 Security Gateway can be successfully configured to handle H.323 IP Trunk traffic over PNAT between two Avaya Communication Manager platforms. The Avaya SG203 Security Gateway transparently manipulates H.323 traffic signaling and media streams, thus providing seamless end-to-end VoIP transmission. 21 of 22

22 2003 Avaya Inc. All Rights Reserved. Avaya and the Avaya Logo are trademarks of Avaya Inc. All trademarks identified by and are registered trademarks or trademarks, respectively, of Avaya Inc. All other trademarks are the property of their respective owners. The information provided in these Application Notes is subject to change without notice. The configurations, technical data, and recommendations provided in these Application Notes are believed to be accurate and dependable, but are presented without express or implied warranty. Users are responsible for their application of any products specified in these Application Notes. Please any questions or comments pertaining to these Application Notes along with the full title and filename, located in the lower right corner, directly to the Avaya Solution & Interoperability Test Lab at 22 of 22