Nortel Secure Router 2330/4134 Configuration SIP Survivability. Release: 10.2 Document Revision: NN

Transcription

1 Configuration SIP Survivability Release: 10.2 Document Revision: NN

2 . Release: 10.2 Publication: NN Document release date: 7 September 2009 While the information in this document is believed to be accurate and reliable, except as otherwise expressly agreed to in writing NORTEL PROVIDES THIS DOCUMENT "AS IS" WITHOUT WARRANTY OR CONDITION OF ANY KIND, EITHER EXPRESS OR IMPLIED. The information and/or products described in this document are subject to change without notice. Nortel, Nortel Networks, the Nortel logo, and the Globemark are trademarks of Nortel Networks. THE SOFTWARE DESCRIBED IN THIS DOCUMENT IS FURNISHED UNDER A LICENSE AGREEMENT AND MAY BE USED ONLY IN ACCORDANCE WITH THE TERMS OF THAT LICENSE. All other trademarks are the property of their respective owners.

3 . Contents 3 New in this release 7 Features 7 Introduction 9 SIP Survivability fundamentals 11 Deployment scenarios 12 Normal mode overview 13 SIP Proxy functionality 14 Call Admission Control functionality 15 SIP Server status monitoring 16 Survivable mode overview 16 NTML 17 SSM feature licensing 17 Supported SIP servers and endpoints 17 SIP servers 17 SIP endpoints 18 SSM detailed feature operation 19 Normal mode 19 SIP REGISTER handling 19 SIP Proxy functionality 20 Call Admission Control functionality 20 Survivable mode operation 21 Server status monitoring 21 SIP REGISTER handling 21 SIP Proxy functionality 22 Persistence across reboots 22 SSM routing logic 23 Outgoing call from endpoints/gateway in normal mode 23 Incoming call in normal mode 24 Registration in normal mode 25 Call Routing in survivable mode 26 Registration in survivable mode 27

4 4 SSM basic configuration 29 SSM basic configuration tasks 29 Binding an IP address for SSM 30 Enabling SSM 31 Configuring the domain 32 Configuring keepalives for SIP survivability 32 Configuring the call admission control on an interface 33 Configuring an exclusion pool for call admission control 34 Configuring the default gateway 35 SSM configuration examples 37 Basic SSM configuration example 37 Procedure steps 38 SSM configuration example with existing LAN infrastructure 40 Procedure steps 40 SSM additional configuration 43 Loading and storing the dial plan 44 Configuring the SIP transport and ports 45 Configuring user provisioning 46 Configuring the SIP registrar for SIP survivability 47 Configuring the DNS timeout 48 Configuring service rejection 48 Configuring the SIP timer values 49 Configuring session timers 50 Configuring the SIP header values 51 Configuring CDR 52 Configuring SSM user licensing 53 Configuring SSM congestion control 54 Displaying the SIP survivability CAC configuration 55 Displaying the SIP survivability feature configuration 56 Displaying the SIP survivability dial plan filenames 56 Displaying the SIP survivability licensed user capacity 56 Displaying the SIP survivability protocol header configuration 57 Displaying the SIP survivability registered users 57 Displaying the SIP survivability registrar parameters 57 Displaying the SIP survivability session timer configuration 58 Displaying the SSM server configuration 58 Displaying the SIP survivability feature status 58 Displaying the survivability SIP server statistics 59 Displaying the SIP survivability subscribers 59 Flushing the SSM database 59 Clearing the SIP survivability feature statistics 60 Debug procedures 60

5 5 Debugging with SIP message dump trace 60 Debugging with module trace 60 Debugging with error trace 62 Number Translation Markup Language 63 Terminology and XML basics 63 Translation language 64 NTML interpreter 64 Nodes in the NTML language 66 Translation node 67 Switch nodes 67 Action nodes 74 Route nodes 78 Exit node 79 SSM configuration example with NTML 81 Basic SSM configuration example with NTML 81 Additional NTML examples 85 NTML with default route 85 Route selection based on number in Req-uri header 85 Exact match routing rule 86 Routing rule based on number of digits 86 Routing rule based on prefix and variable length 86 Routing rule based on prefix and fixed length 87 Routing rule based on range of numbers 87 Routing rule based on more than one criterion 87 Route selection based on number in From header 88 Route selection based on number in To header 89 Route selection based on user-name in Req-uri header 89 Route selection based on domain in Req-uri header 90 Route Selection based on previous hop address 90 Translation of Request URI number 91 Inserting numbers 91 Dropping numbers 91 Replacing numbers 91 Translation based on mixed criterion 92

6 6

7 . New in this release 7 The following section details what s new in Nortel Secure Router 2330/4134 (NN ) for Release Features The SIP survivability feature is new for Secure Router 2330/4134 Release In a centralized SIP server architecture, the remote branches make use of the call processing resources available at a central location, generally located at the corporate headquarters. The SIP survivability feature enhances the feature set of the Secure Router 4134 (SR4134) and Secure Router 2330 (SR2330) by providing business continuity to the branch office in the event of a WAN connection outage to corporate headquarters. With this feature, employees at the branch office can continue to use SIP phones to place and receive intra-site calls and calls over the PSTN, including 911 calls. The SIP survivability module (SSM) is a software-only subsystem on the Secure Router that provides SIP survivability capabilities. The SSM operates as a SIP Back to Back User Agent (B2BUA) that can back up a central SIP server by providing basic call services to connected endpoints at the branch if the WAN connection to the central SIP server fails.

8 8 New in this release

9 . Introduction 9 This document provides information you need to configure SIP Survivability features. Navigation SIP Survivability fundamentals (page 11) SSM detailed feature operation (page 19) SSM routing logic (page 23) Number Translation Markup Language (page 63) Additional NTML examples (page 85) SSM basic configuration (page 29) SSM configuration examples (page 37) SSM additional configuration (page 43)

10 10 Introduction

11 . SIP Survivability fundamentals 11 In a centralized SIP server architecture, the remote branches make use of the call processing resources available at a central location, generally located at the corporate headquarters. The SIP survivability feature enhances the feature set of the Secure Router 4134 (SR4134) and Secure Router 2330 (SR2330) by providing business continuity to the branch office in the event of a SIP server failure or of a WAN connection outage to the corporate headquarters. With this feature, employees at the branch office can continue to use SIP phones to place and receive intra-site calls and calls over the PSTN, including 911 calls. The SIP survivability module (SSM) is a software-only subsystem on the Secure Router that provides SIP survivability capabilities. The SSM operates as a SIP Back to Back User Agent (B2BUA) that can back up a central SIP server by providing basic call services to connected endpoints at the branch if the WAN connection to the central SIP server fails. The SSM operates in two modes - normal mode and survivable mode. In normal mode, the SSM functions as an outbound proxy and proxies all SIP messages initiated from the SIP phones and the SIP Media Gateway to the SIP Server located in the head office. The SSM monitors the availability of the SIP server using keepalives and upon failure of the connection to the central SIP server, switches to survivable mode. In survivable mode, the SSM supports SIP server functionality to provide basic call features to the SIP endpoints at the branch, and also supports local registrar functionality to store registrations. Survivable mode is also called backup mode as the SSM functions as a backup server to the central SIP server in this mode. In Secure Routers with SIP Media Gateway enabled, SSM coexists with the SIP Media Gateway, with each subsystem listening on different SIP ports. SSM uses default port 5060, and the SIP Media Gateway listens on an alternate port (for example, port 5070).

12 12 SIP Survivability fundamentals SSM is a licensable module. It requires the internal PVM (for SR4134) or PVIM (for SR2330) card to be installed on the Secure Router. A 25-user SSM license is included for free when you purchase a PVM/PVIM card. Deployment scenarios You can deploy SIP Survivability in a Remote Branch Office network deployment. Figure 1 Remote Branch Office network A Remote Branch Office (RBO) makes use of the VoIP infrastructure deployed at a central corporate location. During normal operation when the WAN is up and running, all calls (intra-rbo, inter-rbo, PSTN) are routed through the central infrastructure deployed at the headquarters. In Normal mode, the SSM acts as a proxy server, forwarding outgoing calls to the SIP server for call routing, and forwarding incoming calls to the branch SIP endpoints. When the central SIP server or WAN connection goes down, the Secure Router enters survivable mode and the SSM handles intra-rbo and PSTN calls. Inter-RBO VoIP calls cannot be handled because the central infrastructure is not reachable. However, Inter-RBO calls can still be made if they are routable using PSTN trunks.

13 Normal mode overview 13 The following figure shows a variation on the RBO network example in which the Secure Router is installed in an existing branch LAN and therefore does not require routing capabilities. In this case, all SIP Phones are connected on the existing LAN infrastructure and the Secure Router connects to the LAN through a single Ethernet connection. The SIP Media Gateway provides connections to FXS phones and to PSTN trunks, and the SSM provides survivability capabilities for the SIP Phones. Figure 2 SSM with existing LAN infrastructure in Remote Branch Office network Normal mode overview For the proper functioning of SSM-based survivability, you must configure the outbound proxy on the SIP Phones to point to the SSM. In this case, when the SIP Phones send registration messages to the central SIP server, they forward the requests through the SSM. (The Secure Router SIP Media Gateway, configured to point to the SSM, can also register on behalf of the FXS phones.)

14 14 SIP Survivability fundamentals The SSM snoops the registration requests and stores registered contacts and subscriber information locally to an in-memory database. This feature allows for the addition of subscriber data dynamically, without the need to pre-provision subscriber information. When the SSM enters survivability mode, it refers to this database for call routing. When the SSM snoops the registration requests, it also modifies the Contact header information to point to the bound WAN IP address of the SSM before forwarding the registration message to the central SIP Server. As a result, the SIP server forwards all calls destined for branch SIP endpoints back to the SSM. With the SIP Phones configured to point to the SSM as the proxy server, the SSM acts as an immediate hop for SIP endpoints connected to the Secure Router for outgoing calls. And with the SSM modifying the Contact header, all incoming calls also pass through the SSM. As a result, all the calls at the branch (incoming and outgoing) are routed through the SSM in normal mode. SIP Proxy functionality In the normal mode, SSM routes the outgoing calls (originated from SIP end-points and from FXS ports or incoming from PSTN trunks) to the central SIP server, which routes the calls based on its registration database. The central SIP server forwards the intra-branch calls back to the SSM. Inter-branch calls are routed by the central SIP server to the next hop. Pass-through calls originated from SIP end-points are routed through the SIP Media Gateway to the PSTN trunks.

15 Normal mode overview 15 Figure 3 Normal mode SSM receives all incoming calls (for SIP end-points, FXS and PSTN trunks) and routes the calls according to the configured mapping. Calls for SIP end-points are routed to the destination end-points, and calls for PSTN interfaces are routed to the SIP Media Gateway. The Gateway terminates the call either on an FXS port or on a PSTN trunk depending upon the called party number. Call Admission Control functionality To ensure call quality, SSM can monitor the maximum number of simultaneous calls through the WAN link. If it exceeds the limit it can either reject the call or try to route it through PSTN trunks. You must configure call admission control using the CLI for proper functioning of SSM.

16 16 SIP Survivability fundamentals SIP Server status monitoring To monitor the status of the SIP server, the SSM periodically polls the server using SIP OPTIONS request in normal mode. If the link to the SIP server goes down or if SSM does not receive any response to SIP OPTIONS requests for a configurable number of retries, the SSM enters survivability mode. Survivable mode overview If the central SIP server is not reachable, the SSM switches to survivable mode. In survivable mode, the SSM routes the intra-branch calls to the appropriate end-point according to the in-memory registration database. Calls for PSTN interfaces are routed to the SIP Media Gateway. The Gateway can route the intra-branch POTS calls to the FXS end-points. Inter-branch calls are routed through the Gateway to the PSTN trunks, provided that they are dialed as external calls. Inter-branch calls are rejected if dialed using a private numbering plan like ESN. Figure 4 Survivable mode

17 Supported SIP servers and endpoints 17 In survivable mode, SSM monitors the WAN link status and is in "WAN Down" state. If the link is up, SSM transitions to the "WAN Up" state and periodically polls the server using SIP OPTIONS requests. If it gets any response, it switches to Normal mode. NTML The Nortel Number Translation Markup Language (NTML) is an Extensible Markup Language (XML) based, proprietary scripting language used by SSM to define URI transformation rules and specialized routing rules. You can use NTML scripts to modify the URI, for example, to insert a string at any position within the user or host part of a URI, to remove a substring from a URI, or to replace the URI with an entirely new URI. NTML also allows decisions to be made based on the value or pattern of the dialed URI or the caller or original called URI. It also allows a set of next-hop routes to be specified for a given outgoing request to force specific routing rules. SSM supports the configuration of NTML scripts for each of the modes: normal and survivable. SSM feature licensing Software licensing limits the number of SSM users allowable on the Secure Router. If you boot up the SR2330/4134 with the PVM or PVIM module only, in addition to the eight supported DSP channels, the router supports a maximum of 25 SSM users. To operate the SR2330/4134 with additional SSM users, you must obtain a license key from Nortel support. License keys can expand the maximum SSM user capacity to support 100 or 300 users. The 300 user license is supported only on the SR4134. The license upgrade procedure is similar to the DSP channel upgrade procedure. For more information, see Configuration SIP Media Gateway (NN ). Supported SIP servers and endpoints SSM supports the following SIP servers and endpoints. SIP servers Nortel A2E/AS5300 (software version 7.0 SP1) Nortel CS2100 Nortel CS2000 Nortel CS1000 (software version 6.0)

18 18 SIP Survivability fundamentals Nortel SCS (software version 3.0) Broadsoft (software version 14.0 SP1) Sylantro (software version 4.1.1) SIP endpoints Nortel 1120E (firmware version ) LG Nortel 6812 (hardware version 2.2, software version s) LG Nortel 8820 (hardware version 1.0, software version sc2k) Polycom Sound Point IP330 (firmware version ) Xlite (version 3.0 build 53117) Nortel SMC 3455 (version build 49806) Nortel A2E PC Client (version )

19 . SSM detailed feature operation 19 This chapter describes the detailed operation of SSM in normal mode and in survivable mode. Normal mode The following sections describe the detailed SSM operation in normal mode. SIP REGISTER handling In normal mode, the SSM proxies REGISTER messages (including new registrations, re-registrations, and de-registrations) received from SIP endpoints (SIP Phones or Secure Router FXS ports) to the pre-configured central SIP server. SSM modifies the Contact headers in the REGISTER messages to point to SSM bind IP address before forwarding the REGISTER to the central SIP server to ensure that incoming calls are routed through the SSM. On receiving a successful response (200OK) to a proxied registration message, the SSM stores registered contacts locally in an in-memory database along with the expiration time seen in the response to a proxied registration message. It also adds the subscriber information, namely the registered subscriber s AOR, into its information database. This feature allows for addition of subscriber data dynamically, without having a need to pre-provision subscriber information. The SSM updates the registration expiry interval if re-registration is successful and removes the registration entries from its local database if the de-registration is successful. The SSM Registrar keeps track of registration expiry by running registration timers for each active registration stored in the database. On expiry of a registration timer, it removes the entry from its database. The SSM ensures that the number of contacts for a given AOR never exceeds the configured max-contacts value for the AOR. If a new registration request for an AOR exceeds the maximum allowed contacts for that AOR, SSM rejects the request with a 4xx response.

20 20 SSM detailed feature operation SIP Proxy functionality The SSM behaves as an outbound proxy and forwards all calls to the central SIP server. SSM supports proxying of all types of SIP messages REGISTER, INVITE, REFER, SUBSCRIBE/NOTIFY, UPDATE, INFO, PRACK as well as all types of SIP responses 1xx (with 100 Rel), 2xx, 3xx, 4xx, 5xx, 6xx. Both UDP and TCP transport mechanisms are supported for SIP messages. The SSM uses administratively configured rules for proxying outbound calls based on dialed digit patterns using a dial plan written in Nortel NTML (Number Translation Markup Language). The NTML rules are configured in a Normal Mode NTML file located on attached flash media which is uploaded using CLI for SSM processing. The SSM routes incoming calls from the central SIP server to the destination SIP endpoints by retrieving the contact from the registration database. In Normal mode, SSM supports proxying of SIP messages required for support of endpoint hosted supplementary services Call hold/resume, call transfer, call forward, call waiting, 3-way conference, Do Not Disturb. Call Admission Control functionality For the proper functioning of SSM, you must enable call admission control (CAC). CAC is required on the IP WAN interface because, unlike trunks on circuit-switched networks, packet-switched networks have no hard physical limit on the number of calls that can exist on a link. If you do not configure CAC on the WAN link, an unlimited number of calls threatens to consume all the link bandwidth, causing degradation of voice quality for all calls. With CAC enabled, you can limit the number of simultaneous calls on the link to avoid bandwidth overutilization on the WAN link. SSM allows you to configure the max-call counter for each WAN link. On receiving an outbound or inbound call that would use WAN bandwidth for media, the SSM verifies whether the max-call limit allows for the call to be admitted. If the max-call limit is reached on the WAN links, SSM rejects the inbound call with response 503. SSM supports PSTN fallback on CAC failure. To enable the fallback feature, you must configure the default-gateway command. In this case, if the max-call limit is reached on the WAN links, the SSM forwards the outbound call to the configured default gateway for routing. You must also configure the specified default gateway as the bind IP of the SIP Media Gateway on the same Secure Router.

21 Survivable mode operation 21 In normal mode, the SSM also monitors the configured CAC interfaces and, if all configured CAC interfaces are down, it switches to survivable mode. With the CAC feature, only static bandwidth monitoring is supported. With static bandwidth monitoring, SSM tracks the number of simultaneous calls established through the WAN link and does not allow it to exceed the configured maximum value. This method assumes that all calls have the same bandwidth requirement. Take this operation into consideration when configuring the max-call limit, especially if you expect bandwidth requirements to vary for each call. Survivable mode operation The following sections describes the detailed SSM operation in survivable mode. Server status monitoring The SSM monitors the operational status of the SIP Server by polling the server periodically using a SIP OPTIONS request both in normal mode and survivable mode of operation. The polling interval and max poll retries are configurable. It also monitors the link (or links) used to reach the SIP Server for link level failures. SIP REGISTER handling When the central SIP server is unreachable, the SSM functions as a SIP Registrar and terminates REGISTER requests by sending a 200 OK response after successful validation. As it cannot authenticate the SIP user, a configurable option is provided to allow all REGISTER requests or just REGISTER refresh requests. In backup mode, when responding to the REGISTER request with a successful response, SSM reduces the expiration interval to a small configured value (for example 120 s). Similar to normal mode, SSM stores registered contacts locally in an in-memory database and runs registration expiry timers and removes registered contacts when the timers expire. SSM refreshes the registration expiry timer on receiving a registration refresh and removes the registration entry from its database on receiving a de-registration request. When the connectivity to the central SIP server resumes after a failure, it forwards any subsequent registration requests to the central SIP server.

22 22 SSM detailed feature operation SIP Proxy functionality The SSM routes local intra-site calls in survivable mode using the in-memory database lookup. It uses administratively configured rules for proxying incoming calls based on dial digit patterns using a dial plan written in Nortel NTML. The NTML rules are specified through a survivable mode NTML file uploaded using CLI. SSM supports proxying of SIP messages required for support of endpoint hosted supplementary services Call hold/resume, call transfer, call forward, call waiting, 3-way conference, Do Not Disturb. Persistence across reboots In normal mode and in survivable mode, the in-memory database is periodically backed up in flash file ssm.db. If the router reboots, SSM reloads ssm.db to its memory and uses it for call routing.

23 . SSM routing logic 23 This chapter shows the routing logic used in the SSM to route calls in normal and survivable mode. Outgoing call from endpoints/gateway in normal mode The following figure shows the routing logic for an outgoing call from an endpoint or gateway in normal mode.

24 24 SSM routing logic Incoming call in normal mode The following figure shows the routing logic for an incoming call in normal mode.

25 Registration in normal mode 25 Registration in normal mode The following figure shows the logic used for registration in normal mode.

26 26 SSM routing logic Call Routing in survivable mode The following figure shows the routing logic in survivable mode.

27 Registration in survivable mode 27 Registration in survivable mode The following figure shows the logic used for registration in survivable mode.

28 28 SSM routing logic

29 . SSM basic configuration 29 This chapter describes the basic SSM configuration. The required configuration steps are listed below. Prerequisites for SSM basic configuration Secure Router must be running minimum Release 10.2 software Internal PVM (for SR4134) or PVIM (for SR2330) module must be installed If more than 25 users are required, SSM license must be purchased and installed SSM basic configuration tasks Step Action 1 Configure the SIP Media Gateway. See Nortel Secure Router 2330/4134 Configuration SIP Media Gateway (NN ). 2 Because the SSM and SIP Media Gateway bind to the same IP interface for SIP traffic, you must specify separate ports to bind for the SSM and the SIP Media Gateway on this shared IP interface. The default port 5060 is required for SSM. As a result, for the SIP Media Gateway, change the port value of the bound interface from 5060 to a different port (for example port 5070). 3 Configure the SSM: Bind the IP interface for SIP traffic, specifying the same IP interface as the SIP Media Gateway bound interface, but using default port Enable SSM (this step is required to before the remaining steps are allowed). Specify the domain name for the central SIP server. Configure keepalives (using the keepalive-server command) to monitor the central SIP server.

30 30 SSM basic configuration Configure Call Admission Control on the WAN interface connecting to the SIP server to limit the amount of voice traffic allowed on the interface. For a basic setup, use the ssm default-gateway command to point the SSM to the SIP Media Gateway IP interface (specifying the non-default port). This ensures that the SSM routes the call to the gateway under the following conditions: in normal mode, if the SSM is not able to find a registered contact for the caller for the calls coming from the server; and in survivable mode, if the SSM is not able to find contacts for the calling party in its local database. 4 Configure the outbound proxy on the SIP Media Gateway to point to the SSM IP interface at port 5060 using the sip-ua outbound-proxy command. This allows the SSM to serve as the proxy server for the Media Gateway. 5 Configure the outbound proxy on the SIP Phones to point to the SSM IP interface at port 5060 also. --End-- SSM basic configuration tasks navigation Binding an IP address for SSM (page 30) Enabling SSM (page 31) Configuring the domain (page 32) Configuring keepalives for SIP survivability (page 32) Configuring the call admission control on an interface (page 33) Configuring the default gateway (page 35) Binding an IP address for SSM Use this procedure to bind the IP address for SSM. This IP address needs to be validated against an existing IP interface address. Signaling and media uses this address as a source address. The application listens to this address for SIP signaling. The configuration does not take effect until enable is executed. Before changing or removing an IP address or shutting down or deleting the interface, you must first disable SSM (ssm no enable). By default, no IP address is configured.

31 Enabling SSM 31 Procedure steps Step Action 1 To enter configuration mode, enter configure terminal 2 To select VoIP service configuration, enter voice service voip 3 To select SSM configuration, enter ssm 4 To bind an IP address for SSM, enter [no] bind ip ipv4:<a.b.c.d>. --End-- Variable definitions Variable [no] <A.B.C.D> Value Removes the specified IP address binding. Specifies the IP address to bind for SSM. Enabling SSM Use this procedure to enable or disable the SIP survivability functionality. By default, survivability is disabled. Prerequisites You cannot enable SIP survivability until you bind an IP address for SSM using the bind ip command. Procedure steps Step Action 1 To enter configuration mode, enter configure terminal 2 To select VoIP service configuration, enter voice service voip 3 To select SSM configuration, enter ssm 4 To enable or disable SIP survivability, enter

32 32 SSM basic configuration [no] enable --End-- Variable [no] Variable definitions Value Disables the SIP survivability server. Configuring the domain Use this procedure to configure the managed domain under which the Secure Router is operational. By default, no domain is configured. Procedure steps Step Action 1 To enter configuration mode, enter configure terminal 2 To select VoIP service configuration, enter voice service voip 3 To select SSM configuration, enter ssm 4 To select SIP server configuration, enter sip-server 5 To configure the domain, enter [no] domain <domain-name> --End-- Variable definitions Variable [no] <domain-name> Value Removes the specified domain. Specifies the domain name as either ipv4:<ipaddr> or dns:<host-name>. Configuring keepalives for SIP survivability Use this procedure to configure the address of the central SIP server to which keepalive messages are sent. It also specifies the interval at which OPTIONS messages are sent to the central server along with the number of retries before taking a decision on the change from normal mode to survivable mode. By default, keepalives are disabled.

33 Configuring the call admission control on an interface 33 Procedure steps Step Action 1 To enter configuration mode, enter configure terminal 2 To select VoIP service configuration, enter voice service voip 3 To select SSM configuration, enter ssm 4 To select SIP server configuration, enter sip-server 5 To configure keepalives, enter [no] keepalive-server {dns:<server-name>[:port-num] ipv4:<ipaddr>[:port-num]} [interval <10-600>] [retries <1-10>] [transport {tcp udp }] --End-- Variable definitions Variable [no] dns:<server-name>[:port-num] ipv4:<ip-addr>[:port-num] interval <10-600> retries <1-10> transport {tcp udp } Value Removes the specified configuration. Specifies the DNS host name of the central SIP server. Specifies the IP address of the central SIP server. Specifies the interval in seconds at which to send OPTIONS messages to the keepalive server. Default value is 60. Specifies the number of retries before changing from normal to survivable mode, and vice versa. Default value is 1. Specifies the transport protocol. Default value is udp. Configuring the call admission control on an interface Configure call admission control to limit the number of calls that can exist simultaneously on an interface. There are a maximum of five interfaces that can be configured. By default, CAC is disabled.

34 34 SSM basic configuration Procedure steps Step Action 1 To enter configuration mode, enter configure terminal 2 To select VoIP service configuration, enter voice service voip 3 To select SSM configuration, enter ssm 4 To configure the maximum number of calls on an interface, enter [no] cac max-calls <interface-name> <1-500> --End-- Variable [no] Variable definitions <interface-name> Value Deletes the specified value. Specifies the interface to configure. <1-500> Specifies the maximum number of calls allowed on the specified interface. Configuring an exclusion pool for call admission control With CAC, you can configure an exclusion pool that identifies the IP address range of the SIP endpoints that use SSM. This configuration is required only in cases where the Secure Router is connected to the branch LAN by a single interface (for example, see Figure 2 "SSM with existing LAN infrastructure in Remote Branch Office network" (page 13)). CAC excludes the incoming streams from these endpoints from the max-call limit count. The CLI allows a maximum of 8 exclude pool configurations. Procedure steps Step Action 1 To enter configuration mode, enter configure terminal 2 To select VoIP service configuration, enter voice service voip 3 To select SSM configuration, enter ssm

35 Configuring the default gateway 35 4 To configure the exclusion pool for CAC, enter [no] cac exclude-pool <network-address> <mask> --End-- Variable definitions Variable [no] <network-address> <mask> Value Deletes the specified value. Specifies the network assigned to the SIP Phones. Specifies the network mask. Configuring the default gateway Use this procedure to configure the default gateway to be used by SIP survivability. By default, there is no gateway configured; however the default transport is UDP, and the default port is The default gateway IP address must be the same as the bind IP address used by the SIP Media Gateway. Procedure steps Step Action 1 To enter configuration mode, enter configure terminal 2 To select VoIP service configuration, enter voice service voip 3 To select SSM configuration, enter ssm 4 To configure the default gateway, enter [no] default-gateway { ipv4:<ipaddr>[:port-num] } [transport {tcp udp }] --End-- Variable definitions Variable [no] ipv4:<ip addr>[:port-num] [transport {tcp udp} ] Value Removes the specified default gateway. Specifies the IP address and optional port number for the default gateway. Specifies the transport used for the default gateway. Default value is udp.

36 36 SSM basic configuration

37 . SSM configuration examples 37 This chapter contains the following SSM configuration examples. Basic SSM configuration example (page 37) SSM configuration example with existing LAN infrastructure (page 40) Basic SSM configuration example The following figure shows a sample SSM network. Figure 5 Basic SSM configuration example

38 38 SSM configuration examples The following steps show the configuration required for the SIP Media Gateway and the SSM to provide SIP survivability in the network shown in the preceding figure. Prerequisites Secure Router must be running minimum Release 10.2 software Internal PVM (for SR4134) or PVIM (for SR2330) module must be installed If more than 25 users are required, SSM license must be purchased and installed Procedure steps Step Action 1 Configure the Ethernet interface for connection to the SIP server: configure terminal interface ethernet 0/1 ip address exit ethernet 2 Configure the Ethernet interface for SIP phone connectivity: interface ethernet 0/2 ip address exit ethernet 3 Configure a default route to the other end of the WAN: ip route Configure the SIP Media Gateway to listen on port 5070: voice service voip sip bind all ipv4: :5070 exit sip exit voip 5 To configure the SIP Survivability Module, bind the IP interface for SIP traffic using default port 5060: voice service voip ssm bind ip ipv4: Enable SSM: enable 7 Specify the SSM domain name for the central SIP server:

39 Basic SSM configuration example 39 sip-server domain dns:nortel.net 8 Enable SSM keepalives to monitor the central SIP server: keepalive-server ipv4: :5060 transport udp exit sip-server 9 Configure SSM Call Admission Control on the WAN interface connecting to the SIP server: cac max-calls ethernet0/1 50 exit cac 10 Point the SSM to the SIP Media Gateway IP interface as the default gateway (specifying the non-default port): default-gateway ipv4: :5070 exit ssm exit voip 11 Configure the outbound proxy on the SIP Media Gateway to point to the SSM: sip-ua outbound-proxy ipv4: : Configure the SIP Server for the SIP Media Gateway: sip-server dns:nortel.net exit sip-ua 13 Configure the FXS voice port for the analog phone: voice-port 2/1 signal loop-start station number no shutdown exit voice-port 14 Configure the POTS dial peer for the analog phone: dial-peer voice pots 1 destination-pattern port 2/1 forward-digits all no shutdown exit pots 15 Configure the outbound proxy on the SIP Phones to point to the SSM IP interface at port 5060 also. --End--

40 40 SSM configuration examples SSM configuration example with existing LAN infrastructure The following figure shows the basic SSM network configuration as shown in Basic SSM configuration example (page 37), but in this case the Secure Router is operating with SSM and SIP Media Gateway features enabled, but without routing enabled. The initial configuration is similar to the previous example, however here, the bound IP must be the IP address of the Ethernet interface that connects to the branch LAN. Also, you must create an exclusion pool for CAC, so that incoming calls from the SIP phones on the Secure Router Ethernet connection are not counted toward the max-call limit. Procedure steps Step Action 1 Configure the Ethernet interface for connection to the SIP server: configure terminal interface ethernet 0/1 ip address exit ethernet 2 Configure a default route to the branch router:

41 SSM configuration example with existing LAN infrastructure 41 ip route Configure the SIP Media Gateway to listen on port 5070: voice service voip sip bind all ipv4: :5070 exit sip exit voip 4 To configure the SIP Survivability Module, bind the IP interface for SIP traffic using default port 5060: voice service voip ssm bind ip ipv4: Enable SSM: enable 6 Specify the SSM domain name for the central SIP server: sip-server domain dns:nortel.net 7 Enable SSM keepalives to monitor the central SIP server: keepalive-server ipv4: :5060 transport udp exit sip-server 8 Configure SSM Call Admission Control on the WAN interface connecting to the SIP server: cac max-calls ethernet0/1 50 exit cac 9 Configure the CAC exclusion pool: exclude-pool exit cac 10 Point the SSM to the SIP Media Gateway IP interface as the default gateway (specifying the non-default port): default-gateway ipv4: :5070 exit ssm exit voip 11 Configure the outbound proxy on the SIP Media Gateway to point to the SSM: sip-ua outbound-proxy ipv4: : Configure the SIP Server for the SIP Media Gateway: sip-server dns:nortel.net exit sip-ua

42 42 SSM configuration examples 13 Configure the FXS voice port for the analog phone: voice-port 2/1 signal loop-start station number no shutdown exit voice-port 14 Configure the POTS dial peer for the analog phone: dial-peer voice pots 1 destination-pattern port 2/1 forward-digits all no shutdown exit pots 15 Configure the outbound proxy on the SIP Phones to point to the SSM IP interface at port 5060 also. --End--

43 . SSM additional configuration 43 This chapter provides additional optional procedures for SSM configuration. Navigation Loading and storing the dial plan (page 44) Configuring the SIP transport and ports (page 45) Configuring user provisioning (page 46) Configuring the SIP registrar for SIP survivability (page 47) Configuring the DNS timeout (page 48) Configuring service rejection (page 48) Configuring the SIP timer values (page 49) Configuring session timers (page 50) Configuring the SIP header values (page 51) Configuring CDR (page 52) Configuring SSM user licensing (page 53) Configuring SSM congestion control (page 54) Displaying the SIP survivability CAC configuration (page 55) Displaying the SIP survivability feature configuration (page 56) Displaying the SIP survivability dial plan filenames (page 56) Displaying the SIP survivability licensed user capacity (page 56) Displaying the SIP survivability protocol header configuration (page 57) Displaying the SIP survivability registered users (page 57) Displaying the SIP survivability registrar parameters (page 57) Displaying the SIP survivability session timer configuration (page 58)

44 44 SSM additional configuration Displaying the SSM server configuration (page 58) Displaying the SIP survivability feature status (page 58) Displaying the survivability SIP server statistics (page 59) Displaying the SIP survivability subscribers (page 59) Flushing the SSM database (page 59) Clearing the SIP survivability feature statistics (page 60) Debug procedures (page 60) Loading and storing the dial plan Use this procedure to load and store the preconfigured dial plan. By default, no dial plan is loaded or stored. Procedure steps Step Action 1 To enter configuration mode, enter: configure terminal 2 To select VoIP service configuration, enter: voice service voip 3 To select SSM configuration, enter: ssm 4 To load the dial plan, enter: [no] dialplan load {normal survivable} <path-and-filename>. 5 To store the dial plan, enter: dialplan store {normal survivable} <path-and-fi lename>. You must load a dial plan before you can perform a store operation. --End--

45 Configuring the SIP transport and ports 45 Variable Variable definitions load {normal survivable} <path-and-filename> store {normal survivable} <path-and-filename> Value Loads either the normal or survivable mode dial plan from the specified path. If the full path is not specified, then the system searches for the specified filename in cf0 (internal flash memory). The no form of the command deletes the stored dial plan. Stores either the normal or the survivable mode dial plan to the specified path. The no form of the command is not supported. Configuring the SIP transport and ports Use this procedure to configure the transport protocol and port on which the SSM accepts SIP requests. By default, SSM listens on both the transport protocols: UDP and TCP. Use the bind transport command to limit it to either UDP or TCP. Each port is validated against an existing port used in the local SIP IP port. If the two ports are the same and have the same IP, a warning message is displayed requesting you to reconfigure the SIP IP port. The configuration does not take effect until ssm enable is executed. Once SSM is enabled, to modify the transport configuration, you must first enter the no enable command under the ssm tree. The default port value for TCP and UDP is Procedure steps Step Action 1 To enter configuration mode, enter configure terminal 2 To select VoIP service configuration, enter voice service voip 3 To select SSM configuration, enter ssm 4 To configure SIP transport parameters, enter [no] bind transport <transport> <port> --End--

46 46 SSM additional configuration Variable [no] <transport> Variable definitions Value Restores binding parameters to the default values. Specifies the transport protocol: udp, or tcp. <port> Specifies the port to bind. Range is Configuring user provisioning By default SSM learns the subscriber details from SIP REGISTRATIONS. It also provides a static method to provision subscriber information. The subscriber information used by SSM includes user name, domain, alias and identity. Use this procedure to configure subscriber details. It is mainly used to configure alias information. Procedure steps Step Action 1 To enter configuration mode, enter configure terminal 2 To select VoIP service configuration, enter voice service voip 3 To select SSM configuration, enter ssm 4 To configure user provisioning for SIP survivability, enter [no] provisioning subscriber <subscriber> <domain> alias <alias-name> calling-line-id <calling-line-id> --End-- Variable definitions Variable [no] <subscriber> <domain> <alias-name> <calling-line-id> Value Removes the specified configuration. Specifies the user name of the subscriber. Specifies the domain name of the subscriber in format of ipv4:<ip-addrr> or dns:<host-name> Specifies the alias name. Specifies the calling line ID.

47 Configuring the SIP registrar for SIP survivability 47 Configuring the SIP registrar for SIP survivability Use this procedure to configure the SIP registrar for SIP survivability. Procedure steps Step Action 1 To enter configuration mode, enter configure terminal 2 To select VoIP service configuration, enter voice service voip 3 To select SSM configuration, enter ssm 4 To select SIP registrar configuration, enter: registrar 5 To configure the range within which the expires header value is accepted by the SSM registrar, enter [no] expires {max min default} <sec> 6 To configure the maximum contacts that can be registered for a single AOR, enter [no] max-contacts <1-10> 7 To configure options to allow new registrations in backup mode, enter [no] allow-backup-reg {all refresh} --End-- Variable [no] Variable definitions expires {max min default} <sec> max-contacts <1-10> allow-backup-reg {all refresh} Value Removes the specified registrar configuration. Specifies the range within which the expires header value is accepted by the survivable SIP registrar. The no form of the command sets the values for maximum, minimum and default to their default values (180, 180, and 180, respectively). Specifies the maximum contacts that can be registered for a single AOR. The no form of the command sets the value to the default: 5. Configures options to allow new registrations in backup mode. all: Allow all registrations refresh: Allow only registration refresh. Default value is all.

48 48 SSM additional configuration Configuring the DNS timeout Use this procedure to configure the DNS lookup timeout in milliseconds after which DNS lookups attempted by the proxy must timeout. By default, the DNS timeout is milliseconds. Procedure steps Step Action 1 To enter configuration mode, enter configure terminal 2 To select VoIP service configuration, enter voice service voip 3 To select SSM configuration, enter ssm 4 To select SIP server configuration, enter sip-server 5 To configure the DNS timeout, enter [no] dns-timeout < >. --End-- Variable [no] Variable definitions Value Restores the DNS timeout to the default value: milliseconds. Configuring service rejection Use this procedure to configure the SIP server to reject SIP service messages in the survivable mode. By default, the SIP server rejects SIP service messages in survivable mode. Procedure steps Step Action 1 To enter configuration mode, enter configure terminal 2 To select VoIP service configuration, enter voice service voip 3 To select SSM configuration, enter ssm

49 Configuring the SIP timer values 49 4 To select SIP server configuration, enter sip-server 5 To configure service rejection, enter [no] reject-services-in-survivable-mode --End-- Variable [no] Variable definitions Value Activates the forwarding of service related to SIP messages. Configuring the SIP timer values Use this procedure to configure the SIP timer values within the SIP server. Procedure steps Step Action 1 To enter configuration mode, enter configure terminal 2 To select VoIP service configuration, enter voice service voip 3 To select SSM configuration, enter ssm 4 To select SIP server configuration, enter sip-server 5 To configure SIP timer values, enter [no] timer {T1 T2 B C D F H I J K} < > --End-- Variable [no] Variable definitions Value Resets the specified timer to the default values: T1: 500 ms T2: 4000 ms B: ms C: ms D: ms

50 50 SSM additional configuration Variable Value F: ms H: ms I: 5000 ms J: ms K: 5000 ms T1, T2, B, C, F, H, I, J, K Specifies values between C Specifies a value between D Specifies a value between Configuring session timers Use this procedure to configure session timer values in seconds. By default, session timer values are max: 3600, min: 90, and default: Be sure to configure the min value to be less than the default value, and the default value to be less than the max value, otherwise the configuration is rejected. Procedure steps Step Action 1 To enter configuration mode, enter configure terminal 2 To select VoIP service configuration, enter voice service voip 3 To select SSM configuration, enter ssm 4 To configure the session timer, enter: [no] sessiontimer session-timer {max min default} <sec>] 5 To configure the session timer period validation, enter: [no] sessiontimer range-validation --End-- Variable [no] Variable definitions Value Sets the specified parameter to the default value.

51 Configuring the SIP header values 51 Variable range-validation session-timer {max min default} <sec> Value Turns on the session timer period validation requested by endpoints. The no form of the command resets the parameter to the default value, that is, to not validate the session timer range. Specifies the session timer to configure. Specifies a value in seconds for the session timer. Range is Configuring the SIP header values Use this procedure to configure the SIP header values. Procedure steps Step Action 1 To enter configuration mode, enter configure terminal 2 To select VoIP service configuration, enter voice service voip 3 To select SSM configuration, enter ssm 4 To select SIP protocol header configuration, enter: protocol-header 5 To configure the retry-after interval, enter: [no] retry-after-interval < > 6 To configure the organization header, enter: [no] organization-header <string> 7 To configure the server header, enter: [no] server-header <string> --End-- Variable definitions Variable [no] retry-after-interval < > Value Removes the specified configuration. Specifies the retryafterinterval value (in seconds) to be inserted into the retry after SIP header. The no form of this command sets the interval to the default value (300 seconds).

52 52 SSM additional configuration Variable organization-header <string> server-header <string> Value Specifies the organization name to be inserted as organization header into the messages generated by the SIP server. The no form of the command removes the organization header. There is no default value. Specifies the string to be used in the server header in responses generated by the SIP server. The no form of this command removes the server header. There is no default value. Configuring CDR Use this procedure to configure the CDR feature for SIP survivability. By default, CDR is disabled. In order to enable SSM CDR, you must set the message level to notice. Procedure steps Step Action 1 To enter configuration mode, enter configure terminal 2 To select CDR, enter [no] system logging syslog module voip-ssm-cdr {sys9 sys10 sys11 sys12 sys13 sys14 local0 local1 local2 local3 local4 local5 local6 local7} {emerg alert crit err warn notice info debug none} --End-- Variable [no] Variable definitions Value Disables CDR generation.