A Sample Configuration for Securing Avaya IP Softphone Clients over a Wireless LAN using Avaya VPNremote Software and IP Address Pooling - Issue 1.

Transcription

1 Avaya Solution & Interoperability Test Lab A Sample Configuration for Securing Avaya IP Softphone Clients over a Wireless LAN using Avaya VPNremote Software and IP Address Pooling - Issue 1.0 Abstract These Application Notes demonstrate a sample configuration for securing Avaya IP Softphone telephony traffic using Avaya VPNremote Client with IPSec encryption over a wireless LAN. These Application Notes were developed based on a field request for information on implementing a similar topology for demonstration purposes. 1 of 30

2 Introduction These Application Notes demonstrate the combination of several features and devices together as a solution in order to protect Avaya IP Softphone telephony using VPNremote clients over a wireless LAN. The configuration depicted in Figure 1 gives IP Softphones the ability to call other stations over a secure 3DES tunnel. All encrypted voice and data communications between the VPNremote client and the internally protected networks are made using source IP addresses from an available pool that are pushed down to the VPNremote clients by the Avaya Security Gateway. Network Region 1 Avaya S8300 Media Server with a G700 Media Gateway vlan1 0 x44003 Name: IPT1 Avaya 4620 IP Telephone Avaya 4620 IP Telephone x44004 Name: IPT2 vlan101 Avaya SG 200 Security Gateway Avaya P580 Gigabit Ethernet Switch Private Side Public Side 3DES Encrypted Tunnel Traffic Avaya AP-3 Wireless Base Station x44005 Name: IPS2 x44002 Name: IPS1 Wireless Enabled PC's with Avaya VPNremote(R) and IP Softphone Clients Network Region 2 Figure 1: Sample Secure Wireless Configuration 2 of 30

3 1. Equipment and Software Validated The following equipment and software were used for the sample configuration provided: Equipment Software Avaya S8300 Media Server with an Avaya G700 Media 1.3 Gateway Avaya P580 Gigabit Ethernet Switch v6.0 Avaya IP Softphone Release with SP3 Avaya 4620 IP Telephones Release 1.8 Avaya SG 200 Security Gateway VPNos Avaya VPNremote Client Avaya Wireless AP-3 Access Points v2.0.0(269) D-Link AirExpert A/B/G Tri-Mode Dualband Wireless Cardbus Adapters (DWL-AG650) Utility 1.5 Driver Connectivity Matrix Device Interface IP Address/Mask VLAN Additional Notes S8300/G700 Proc /24 10 Default Route Voip /24 10 MGP /24 10 G /24 10 P580 Switch vlan /24 10 Static Route: vlan / vlan / SG200 Public /24 Gateway Gateway Private /24 Remote User IP Address Pool AP-3 DHCP /24 IP Pool IPT / IPT / Considerations and Recommendations Before deploying a solution involving Wireless LANs, which include the use of IP Softphone and VPNremote, remember that voice quality is dependent on: Headset quality Soundcard quality Wireless and wired network performance IPSec encryption overhead and delay Selected codec These Application Notes address scenarios where security is the primary design goal. 3 of 30

4 1.3. How VPNremote IP Address Pooling Works When VPNremote clients authenticate with the Security Gateway, they are assigned a Virtual Adapter IP Address from an available IP Address Pool (Figure 2). All inbound client packets destined for a host on the private side of the Security Gateway will have a Virtual Adapter IP Address as the source address for the client and not the address of the Wireless LAN adapter. The IP address assigned via a DHCP Server from the AP-3 or via static administration is not visible to the private network. All internal routers must be able to route to the VPNremote Virtual Adapter IP Address Pool network via the private interface of the Security Gateway. If there is no route to this network, the VPNremote clients will not have connectivity to any private networks. In this example, the P580 has a static route to the IP Address Pool network with the private interface of the Security Gateway as the next-hop. Source IP Address x Client Data Avaya S8300 Media Server with G700 Media Gateway Avaya P580 Gigabit Ethernet Switch P580 Static Route ip route SG 200 Private Interface IP Address /24 Avaya SG200 Security Gateway IP Address Pool /24 Avaya AP-3 Wireless Base Station DHCP Server IP Address Pool IPSec Tunnel Avaya VPNremote(R) Client with Avaya IP Softphone DHCP IP Address = VPNremote Virtual Adapter IP Address = Avaya VPNremote(R) Client with Avaya IP Softphone DHCP IP Address = VPNremote Virtual Adapter IP Address = Figure 2: IP Address Pool Feature Example 4 of 30

5 1.4. How IP Network Mapping Works When IP Softphone registers with the server through a VPNremote tunnel, it can be mapped to a specific Network Region using the Network Map feature. In Figure 3, the VPNremote PC is mapped to Region 2 based on the (Virtual Adapter) source IP address received with the registration message. This gives the administrator flexibility in how intra-region and inter-region calls behave. The Server maps the IP Softphone user to Region 2 based on the incoming source IP address Source IP Address Registration Message Avaya S8300 Server with G700 Gateway IP-Network-Map Region 2 Avaya P580 Gigabit Ethernet Switch Avaya SG200 Security Gateway IP Address Pool /24 IP Softphone Registers Through the VPN Tunnel Avaya AP-3 Wireless Base Station DHCP Server IP Address Pool IPSec Tunnel Avaya VPNremote(R) Client with Avaya IP Softphone DHCP IP Address = VPNremote Virtual Adapter IP Address = Figure 3: IP Network Map Feature Example 5 of 30

6 1.5. Using IP Network Regions to Control Codec Selection IP Network Regions can be used to control how calls are treated between stations within the same region and for calls between stations located in different regions. These Application Notes make use of two separate Network Regions for the purposes of controlling codec selection within and between the two regions as depicted in Figure 4. When calls are made between stations within region 1, the G.711MU codec is used because these calls take place over a high speed wired LAN with no encryption. When calls are made between stations within region 2, the G.729 codec is used because these calls take place over a lower speed wireless connection with 3DES encryption. Since there are considerable bandwidth and processing constraints for calls made within region 2, the G.729 codec is a better fit for this environment. Additionally, if calls take place between stations located in regions 1 and 2, the G.729 codec is again used because this call traverses the wireless connection with 3DES encryption. Region 1 Avaya 4620 IP Telephone x44004 Intra-Region IP-IP Direct Calls use Codec Set 1 G.711MU Avaya 4620 IP Telephone x44003 Inter-Region IP-IP Direct Calls between Regions 1 and 2 use Codec Set 2 G.729 Avaya S8300 Server with a G700 Gateway Avaya P580 Gigabit Ethernet Switch Avaya SG200 Security Gateway AP-3 Wireless Base Station Intra-Region IP-IP Direct Calls use Codec Set 2 G.729 Avaya VPNremote(R) Client with Avaya IP Softphone x44002 Region 2 Avaya VPNremote(R) Client with Avaya IP Softphone x44005 Figure 4: Region-to-Region Codec Selection 6 of 30

7 2. Configuration 2.1. Configure the SG 200 Security Gateway 1. Add all VPNremote users to gateway for local VPN authentication. Perform the following: Browse to the private interface of the SG 200 via SSL ( and log in Navigate to Configure Users Remote Users Click Add The Add Remote User window opens (Figure 5) User Name = laptop1 Disable Default User Password = password Confirm Password = password Click Save Note: Repeat for the number of clients in the configuration. Figure 5: Add Remote User window 7 of 30

8 2. Create a Remote User IP Address Pool Perform the following: Navigate to Configure Security Dynamic Policy Click Address Pool The Client IP Address Pool Configuration window opens (Figure 6) IP Address = Mask = Click Add Click OK An SG Confirm window opens. Click OK Click Save Figure 6: Client IP Address Pool Configuration window 3. Add a VPN for Remote wireless VPN users. Perform the following: Navigate to Configure Security VPN Setup Click Add The Add New VPN (Page 1 of 4) window opens (Figure 7) VPN Name = WirelessVPN 8 of 30

9 Secret Text = mysecret IP Address = Mask = Click Add IP Address = Mask = Click Add IP Address Mask = Click Add Click Next > Note: The VPNremote Client IP Address Pool must be added to the Local IP Groups in order to allow IP-IP Direct Audio connections to be hairpinned by the VPN Tunnel. Figure 7: Add New VPN (Page 1 of 4) window 9 of 30

10 The Add New VPN (Page 2 of 4) window opens (Figure 8) Click Next> Figure 8: Add New VPN (Page 2 of 4) window The Add New VPN (Page 3 of 4) window opens (Figure 9) Select Available Users Click >> to add the users to the VPN Click Next > Figure 9: Add New VPN (Page 3 of 4) window 10 of 30

11 The Add New VPN (Page 4 of 4) window opens (Figure 10) Click Add Click Finish Figure 10: Add New VPN (Page 4 of 4) window 11 of 30

12 2.2. VPNremote Client Configuration 1. Configure the VPNremote user profile Note: The User Name and destination Security Gateway (SG) IP address for the tunnel must be configured in the VPNremote User Profile. Perform the following: Launch the VPNremote Client from the PC Start Menu. The VPNremote v window opens (Figure 11). Click <<Options. Click Advanced. Figure 11: VPNremote v window 12 of 30

13 The Advanced window opens (Figure 12). From the Profiles tab select DefaultProfile1 Click Modify Figure 12: Advanced window 13 of 30

14 The Download Configuration window opens (Figure 13). User Name = laptop1 VSU Address = Click OK Click OK on the Advanced window Figure 13: Download Configuration window 14 of 30

15 2.3. Avaya Communication Manager Configuration The following sections describe a subset of the configuration required on the Avaya S8300 Media Server. Only configuration steps that are critical to the configuration have been provided with descriptions. Please reference user documentation for procedures not included, such as adding stations. 1. Configure the IP Network Map. Note: The IP-Network-Map feature in Avaya Communication Manager allows the server to map IP stations to a particular IP-Network-Region based on source IP address at registration. For the purposes of these Application Notes, the IP-Network-Map feature will be used to map Avaya IP Softphones to an IP-Network-Region based on the VPNremote (Virtual) source IP address. This becomes important when IP Softphones connected over VPNs attempt to call each other directly within the same region. Any station that registers from network will be associated with Region 2 and so forth. Perform the following: Start SAT and log into the switch change ip-network-map The IP Address Mapping page opens (Figure 14). From IP Address = To IP Address = Region = 2 From IP Address = To IP Address = Region = 1 Apply the changes change ip-network-map Page 1 of 32 IP ADDRESS MAPPING Subnet From IP Address (To IP Address or Mask) Region VLAN n n n Figure 14: IP Network Map Page 15 of 30

16 2. Configure IP Codec Sets. Perform the following. Enter change ip-codec-set 1 The IP Codec Set page appears (Figure 15) Audio Codec = G.711MU Apply the change change ip-codec-set 1 Page 1 of 1 Codec Set: 1 IP Codec Set Audio Silence Frames Packet Codec Suppression Per Pkt Size(ms) 1: G.711MU n : Enter change ip-codec-set 2 The IP Codec Set page appears (Figure 16) Audio Codec = G.729A Apply the change Figure 15: IP Codec Set 1 Page change ip-codec-set 2 Page 1 of 1 Codec Set: 2 IP Codec Set Audio Silence Frames Packet Codec Suppression Per Pkt Size(ms) 1: G.729A n : Figure 16: IP Codec Set 2 Page 16 of 30

17 3. Configure IP Network Regions. Note: The IP-Network-Region feature in Avaya Communication Manager allows the server to treat IP trunk and station-to-station calls differently depending on the associated IP Network Region settings. For the purposes of these Application Notes, the IP-Network-Region feature will be used to control codec selection. Perform the following: change ip-network-region 1 The IP Network Region page opens (Figure 17) Codec Set: 1 Apply the changes change ip-network-region 1 Page 1 of 3 IP NETWORK REGION Region: 1 Location: AUDIO PARAMETERS Codec Set: 1 UDP Port Range Min: 2048 Max: 3028 Name: Headend Region Intra-region IP-IP Direct Audio: yes Inter-region IP-IP Direct Audio: yes IP Audio Hairpinning? y RTCP Reporting Enabled? y RTCP MONITOR SERVER PARAMETERS Use Default Server Parameters? y Figure 17: IP Network Region Page (modified for brevity) change ip-network-region 2 The IP Network Region page opens (Figure 18) Codec Set: 2 Apply the changes change ip-network-region 2 Page 1 of 3 IP NETWORK REGION Region: 2 Location: AUDIO PARAMETERS Codec Set: 2 UDP Port Range Min: 2048 Max: 3028 Name: VPNremote Region Intra-region IP-IP Direct Audio: yes Inter-region IP-IP Direct Audio: yes IP Audio Hairpinning? y RTCP Reporting Enabled? y RTCP MONITOR SERVER PARAMETERS Use Default Server Parameters? y Figure 18: IP Network Region Page (modified for brevity) 17 of 30

18 4. Configure Inter-Region Connection Management. Note: Inter-Region Connection Management determines the codec-set used between regions. Enter change ip-network-region 1 Select Next Page The Inter Network Region Connection Management page for Region 1 opens (Figure 19). Verify that calls within region 1 use ip-codec-set 1 Verify or change region 1 so that calls to region 2 use ip-codec-set 2 Apply any changes change ip-network-region 1 Page 2 of 3 Inter Network Region Connection Management Region (Group Of 32) Figure 19: Inter Network Region Connection Management Page (Region 1) Enter change ip-network-region 2 Select Next Page The Inter Network Region Connection Management page for Region 2 appears (Figure 20) Verify that calls within region 2 use ip-codec-set 2 Verify that calls between region 2 and region 1 use ip-codec-set 2 Apply any changes change ip-network-region 2 Page 2 of 3 Inter Network Region Connection Management Region (Group Of 32) Figure 20: Inter Network Region Connection Management Page (Region 2) 18 of 30

19 2.4. IP Softphone Configuration Note: Before the IP Softphone can be used to place a call, it must be registered to a gatekeeper. 1. Configure and Register IP Softphone Perform the following: Either from the desktop or the start menu, launch the Avaya IP Softphone application The Login window opens (Figure 21). Extension = Password = 1234 Server Address = Optional Select Remember password for next login session Click Log in Figure 21: Login window 19 of 30

20 The Connecting to server window opens (Figure 22). Figure 22: Connecting to server window Once registered, the Login Status window opens (Figure 23). Note that Login Status indicates that IP Softphone is Logged in as Extension Click Close Figure 23: Login Status window 20 of 30

21 3. Verification Steps 3.1. Launch a new VPN connection The user is returned to the VPNremote v window after configuring the user profile. At this time, the client has been configured to establish a new VPN connection with the Avaya Security Gateway upon request. Perform the following: With the VPNremote v window open (Figure 24). User Name = laptop1 Password = password Click Connect Note: After clicking Connect, the VPN tunnel initialization will begin. When the Client has completed registering the tunnel, the VPNremote v screen will automatically be hidden to the System Tray by default. This behavior may be modified in the VPNremote Client preferences screen. Figure 24: VPNremote v Window 21 of 30

22 3.2. Check IP Address Assignments on Wireless VPNremote PC s Verify that the laptop has been assigned the correct IP address from the AP-3 and that the VPNremote client software has been assigned the correct virtual tunnel IP address from the SG200 address pool. From the command prompt on the laptop, execute and observe the following: C:\>ipconfig/all Ethernet adapter VPNremote Virtual Adapter: Connection-specific DNS Suffix. : Description : Avaya VPNet Virtual Adapter Physical Address : 00-FF-FF DHCP Enabled : Yes Autoconfiguration Enabled.... : Yes IP Address : Assigned by the SG200 automatically from the available address pool configured Subnet Mask : Default Gateway : DHCP Server : DNS Servers : Lease Obtained : Friday, September 26, :24:53 AM Lease Expires : Monday, September 29, :24:53 AM Ethernet adapter Local Area Connection 4: Connection-specific DNS Suffix. : Description : D-Link AirXpert DWL-AG650 Wireless C ardbus Adapter Physical Address : C8-1F DHCP Enabled : Yes Autoconfiguration Enabled.... : Yes IP Address : Automatically assigned by the AP-3 from the available DHCP server address pool Subnet Mask : Default Gateway : DHCP Server : DNS Servers : Lease Obtained : Thursday, September 25, :14:57 PM 22 of 30

23 3.3. Check VPN Status on the Avaya VPNremote Client From VPNremote v4.1.14window opens (Figure 25). Click <<Options Click Advanced Figure 25: VPNremote v window 23 of 30

24 Click Secure Connection tab The Secure Connection window opens (Figure 26) Verify the presence of IKE Phase 1 connections Select the first connection Click Details Figure 26: Secure Connections window 24 of 30

25 The Secure Connection window opens (Figure 27) Verify that the tunnel condition is Alive Click OK Figure 27: Details window 25 of 30

26 3.4. Place a call The Avaya IP Softphone window remains open (Figure 28) after login. Place a call to a private side Avaya IP Telephone Number = Click the Phone icon Figure 28: Avaya IP Softphone window The first time a call is placed using Softphone, the Call window opens (Figure 29). Optional Select Do not show this message again Click Call Figure 29: Call window 26 of 30

27 3.5. Make Audio Adjustments if Necessary If the IP Softphone volume is too low or high for either the IP Softphone user or the far-end user, audio adjustments may be made during the call. Perform the following: While on a call from the IP Softphone window. Click Audio Click Options The Audio Options window opens (Figure 30). Adjust Receive Gain if the IP Softphone user is having problems hearing. Adjust the Transmit Gain if the far-end user is having problems hearing. Click Close once the proper adjustments have been made. Figure 30: Audio Options window 27 of 30

28 3.6. Verify Intra/Inter Region Codec Selection Using Station Trace 1. Station Trace Call Scenario Intra-region 1 Place a call between Avaya IP Telephones within Region 1. Trace extension and place a call from x44003 to x44004 (Figure 31). Verify that calls region (rn) 1 to region (rn) 1 use the G.711MU codec. list trace station Page 1 LIST TRACE time data 03:31:43 dial :31:43 ring station cid 0x2c 03:31:43 G711MU ss:off ps:20 rn:1/ : : :31:45 active station cid 0x2c 03:31:45 G711MU ss:off ps:20 rn:1/ : : :31:45 G711MU ss:off ps:20 rn:1/ : : :31:54 idle station cid 0x2c Figure 31: Intra-region 1 Call Trace 2. Station Trace Call Scenario Intra-region 2 Place a call between Avaya IP Softphones within Region 2. Trace extension and place a call from x44002 to x44005 (Figure 32). Verify that calls rn2 to rn2 use the G.729A codec. Notice that the IP addresses used to establish the IP-IP direct are the VPNremote client Virtual IP addresses assigned to each client from the available pool ( x). The x IP addresses assigned to the each laptop computers wireless adapter card are not seen by the private network. Only the virtual pool addresses are seen in the private network. list trace station Page 1 LIST TRACE time data 03:27:52 active station cid 0x2b 03:27:52 G729A ss:off ps:20 rn:2/ : : :27:52 dial :27:52 ring station cid 0x2b 03:27:52 G729A ss:off ps:20 rn:2/ : : :28:04 active station cid 0x2b 03:28:04 G729A ss:off ps:20 rn:2/ : : :28:04 G729A ss:off ps:20 rn:2/ : : :28:32 idle station cid 0x2b Figure 32: Intra-region 2 Call Trace 28 of 30

29 3. Station Trace Call Scenario Inter-region 1 to 2 Place a call between Avaya IP Telephones within Region 1 to Avaya IP Softphones within Region 2. Trace extension and place a call from x44004 to x44005 (Figure 33). Verify that calls rn2 to rn1 and rn1 to rn2 use the G.729A codec. Notice that the IP addresses used to establish media connection for the VPNremote/IP Softphone client are Virtual IP addresses assigned from the available pool ( x). The x IP address assigned to the laptop computers wireless adapter card is not seen by the private network. Only devices assigned a virtual pool address can access the private network. list trace station Page 1 LIST TRACE time data 03:34:12 active station cid 0x2d 03:34:12 G711MU ss:off ps:20 rn:1/ : : :34:14 dial :34:14 ring station cid 0x2d 03:34:14 G729A ss:off ps:20 rn:2/ : : :34:21 active station cid 0x2d 03:34:21 G729A ss:off ps:20 rn:1/ : : :34:21 G729A ss:off ps:20 rn:2/ : : :34:37 idle station cid 0x2d Figure 33: Inter-region 1 to 2 Call Trace 4. Conclusion Connectivity between all Avaya products depicted using a 3DES IPSec tunnel with VPNremote equipped PCs running Avaya IP Softphone can be achieved by following the guidelines in these Application Notes. Support for Intra-region and Inter-region codec selection was validated between the secured Avaya IP Softphone clients and Avaya 4620 IP Telephones. The steps described in these Application Notes can be generalized for most configurations. 29 of 30

30 Avaya and the Avaya Logo are trademarks of Avaya Inc. All trademarks identified by and are registered trademarks or trademarks, respectively, of Avaya Inc. All other trademarks are the property of their respective owners. The information provided in these Application Notes is subject to change without notice. The configurations, technical data, and recommendations provided in these Application Notes are believed to be accurate and dependable, but are presented without express or implied warranty. Users are responsible for their application of any products specified in these Application Notes. Please any questions or comments pertaining to these Application Notes along with the full title name and filename, located in the lower right corner, directly to the Avaya Solution & Interoperability Test Lab at 30 of 30