ESI Voice Router Public-Installation Guide Disclaimer Every effort has been made to eliminate errors and ambiguities in the information contained in this document. Any questions concerning information presented here should be directed to Estech Systems, Inc. (ESI), located at 3701 E. Plano Parkway, Suite 100, Plano, TX 75074, and available via telephone at 972 422-9700. Estech Systems, Inc., disclaims all liabilities for damages arising from the erroneous interpretation or use of information presented in this document. Publication information Estech Systems, Inc., reserves the right without prior notice to revise information in this publication for any reason. Estech Systems, Inc., also reserves the right without prior notice to make changes in design or components of equipment as engineering and manufacturing may warrant. About ESI ESI (Estech Systems, Inc.) designs and manufactures high-performance phone systems for businesses and organizations. ESI uses advanced technology to design IP and digital communications systems that integrate built-in capabilities, advanced features, and highly differentiated applications into flexible products that are easy to use and keep employees productive. ESI has sold over 250,000 business communications systems through hundreds of factory-trained Certified Resellers. Founded in 1987, ESI is a privately held corporation with headquarters in Plano, Texas. Copyright 2014 ESI (Estech Systems, Inc.). All rights reserved. No part of this document may be produced in any form or by any means graphic, electronic, or mechanical, including recording, taping, photocopying, or information retrieval systems without the express written permission of the publisher of this material. Product names mentioned in this manual may be trademarks and/or registered trademarks of their respective companies.
Contents What is the EVR?... 1 Get to know your customer s environment... 1 Common deployment scenarios... 2 Scenario 1: Cable or DSL modem... 2 Scenario 2: Cable or DSL modem with integrated router... 3 Scenario 3: Direct Ethernet connection... 4 Connecting to the EVR... 5 Required equipment and documentation... 5 Using a DHCP connection... 5 Connecting to the EVR via DHCP... 5 Using a static connection... 6 Setting up the EVR using the Setup Wizard... 9 Additional configuration... 17 Remote access for ESI Technical Support... 19 Installation worksheet... 20 Installation worksheet (continued)... 21 Installation worksheet (continued)... 22 Installation worksheet (continued)... 23 License... 24
What is the EVR? The ESI Voice Router (EVR) is a quick and painless solution to the networking needs of your customer. This is a turnkey solution that allows you to quickly configure an advanced firewall to protect your customer's investment from the untamed waters of today s Internet. The firewall settings on the router are configured through a step-by-step wizard that will configure port forwarding and other settings specific to the needs of the customer, depending on the type of services provided. Get to know your customer s environment The first step in installing the EVR is to survey and document the customer s network topology and IP addressing information. You may need to involve the customer s Network Administrator or a site IT technician to assist you in some aspects of this process, but you can gather most of the ESI system s IP programming by accessing Installer programming Function 8. ESI has provided an EVR Installation Worksheet and Checklist later on in this document. Please ensure that this document is filled out in full before you proceed with installation of the EVR. The data you will need to collect includes, but is not limited to: Any data on the on-site IP Server 900 or ESI Communications Server. Any specific DHCP and IP addressing requirements. Any additional network services or configuration options that will be required after the setup process. Important: ESI highly recommends coordinating with the customer premises Network Administrator, or his/her designated representative, on any activities with the potential to disrupt or adversely affect network operations. These activities include, but are not limited to, hardware installation, software installation, and customer premises equipment access and programming. 1
Common deployment scenarios It is important for you to gain, through your investigation of the customer s network environment, a good understanding of the Internet services they re using and the types of service they have. In most cases, a site with a high-speed connection utilizing fiber optics, metro Ethernet, or a data T1 will be simple to deploy. as these most commonly provide an Ethernet connection direct to any router. For other connections, such as cable and DSL, a modem and a router are required. On the following pages, we show few common deployment scenarios with a network map of each. Each configuration included could include any of ESI s solutions, such as the IP Server 900, ESI Communications Servers, or ESI Cloud PBX. (An ESI-100 is used purely for reference in these network diagrams.) Scenario 1: Cable or DSL modem The common practice for a cable or DSL modem is that a direct Ethernet connection to the modem itself will be provided. This will allow for a quick and easy replacement of the router currently provided by the ISP with the EVR in its place. 2
Scenario 2: Cable or DSL modem with integrated router In this scenario, the ISP has provided an integrated modem-and-router solution that is required to provide connectivity to the customer. This requires that the EVR be cascaded or placed behind the ISP s equipment and connected to a LAN port from the existing equipment. It is recommended that you coordinate with the customer s ISP to configure the EVR in a DMZ (demilitarized zone) that will forward all ports of a specific IP address to the EVR. This will allow you to utilize the firewall rules provided by the EVR and bypass any filters in the ISP s equipment. 3
Scenario 3: Direct Ethernet connection For dedicated higher-bandwidth connections such as metro-ethernet, fiber, or T1 the EVR can displace the router provided by the ISP, if that s desired. Always ensure that, when you replace equipment at a customer site, the features and functionality of the EVR can support the customer s requirements. 4
Connecting to the EVR Required equipment and documentation Computer A Windows PC with an Ethernet port. Cabling Ethernet cable, Cat 5 or 6. Documentation A completed installation worksheet. Using a DHCP connection In order to simplify the initial configuration of the EVR, the OPT1 port has been enabled for DHCP with the settings described below. The OPT1 port will allow for assignment of only two or three IP addresses. Parameters for the OPT1 port are as listed: IP address: 172.16.100.1. Netmask: /29. Network: 172.16.100.0. Gateway: 172.16.100.1. DNS: 172.16.100.1. Pool: 172.16.100.2 172.16.100.6. Default lease time: Five minutes. Max lease time: 10 minutes. Connecting to the EVR via DHCP As the Installer, follow these steps to start programming your EVR. 1. Connect to the OPT1 port with your Ethernet cable. (Continued) 2. Make sure your PC is set up for DHCP. 5
3. Plug the cable into your PC Ethernet port. You should obtain an IP address from the EVR (right). 4. Now that you have obtained an IP address, enter the following URL into a browser to access the browser-based programming tool: myevr.esihs.net 5. Log into the browser-based programming tool using the following credentials: User name radmin Password ************ You also can use the gateway IP address 172.16.100.1 to access the tool. Log in using the same credentials as shown above. See the Resellers guide at: http://www.esi-estech.com/resellers/ For the password needed Using a static connection 1. Connect the EVR s LAN port to the PC s Ethernet port, as seen below: (Continued) 2. To set the computer s IP address as static in Windows 7, type network and sharing into the Start menu s Search box. When Network and Sharing Center appears, select it. 6
3. When the Network and Sharing Center opens, click Change adapter settings. (This will be the same in Windows 7 and Windows 8.x.) 4. Right-click your local adapter and select Properties. (Continued) 7
5. In the Local Area Connection Properties window, highlight Internet Protocol Version 4 (TCP/IPv4) and click the Properties button. 6. Select the Use the following IP address radio button and enter in the following information: IP address 192.168.1.2 Subnet mask 255.255.255.0 7. Click OK. 8. Now that you have obtained an IP address, enter the following IP address into a browser to access the browser-based programming tool: 192.168.1.1 9. Log into the browser-based programming tool using the following credentials: User name radmin Password w5kszeno 8
Setting up the EVR using the Setup Wizard The Setup Wizard will step you through the basic programming required to set up the EVR. The first time you log into the programming tool, you ll be taken by default to the Setup Wizard. You can access the Setup Wizard at any time by clicking the Setup Wizard option under the system menu. Many of the settings found in the Setup Wizard are also addressed in other EVR programming windows, but the Setup Wizard combines a number of important setup fields in one convenient location. Here is the initial Setup Wizard screen: Fig. SW-1 Here you can set up your domain name server (DNS) and select the time zone. The settings in this screen are also addressed in System > General Setup: Fig. SW-2 (Continued) 9
Here, select your WAN type. Advanced users may wish to duplicate the current firewall MAC address in the MAC Address field in the next screen. Other users may skip this step. Once all steps in this guide are completed, you may need to reboot the broadband provider s equipment to complete the installation process. Fig. SW-3 If using a static WAN, enter the static WAN IP, select the subnet, and make sure to enter the gateway IP provided by your customer s network team. Fig. SW-4a (Continued) 10
If you re using a DHCP WAN, the value in the DHCP Hostname field is sent as the DHCP client identifier and hostname when requesting a DHCP lease. Some ISPs may require this (for client identification). Fig. SW-4b If you selected PPPoE or PPTP for the WAN type, you must enter the user name and password provided by the carrier: Fig. SW-4c (PPPoE) Fig. SW-4d (PPTP) (Continued) 11
Here, you configure the LAN interface. Enter the LAN you wish to configure. Many of the settings in the following screen can also be found on the Interfaces > LAN programming window, along with other LAN programming options: Fig. SW-5 In the next screen, note that there are multiple profile entries; select the one that best fits your system. If you select IP-900 (for the IP Server 900) or ESI-50, you will continue with the Wizard; if you select another option, you ll skip to the screen shown in Fig. SW-9 (p. 15). If your profile is not listed, use the Advanced profile. Note: When using the Advanced profile, you will need to build the firewall manually and set other options as needed. Fig. SW-6 (Continued) 12
In the following screen (Fig. SW-7), note that selecting the IP-900 profile (for the IP Server 900) has automatically populated these setup fields with the default access ports for ASC, NSP, and SIP/RTP traffic, You ll still need to enter the correct IP addressing as gathered from the Installation Worksheet. Fig. SW-7 (Continued) 13
In the following screen (Fig. SW-8), note that selecting the ESI-50 profile has automatically populated these setup fields with the default access ports for ASC, NSP, and SIPRTP traffic, You ll still need to enter the correct IP addressing as gathered from the Installation Worksheet. Fig. SW-8 (Continued) 14
Use this screen to change your EVR access password (as noted in the screen in Fig. SW-10, you ll have to log in again if you change this field): Fig. SW-9 Fig. SW-10 Click Reload to activate the EVR programming changes you have made. Note: If the LAN addressing was changed from the default and the DHCP server was enabled during use of the Setup Wizard, this will require resetting your PC s LAn connection in order for the redirect to be completed. (Continued) 15
You ll then see these two screens: Fig. SW-11 Fig. SW-12 Click the here link to continue. You have now completed the Setup Wizard. 16
Additional configuration Because of the complexity of configurations that can be implemented with ESI Communications Servers, there currently is not a step-by-step wizard to create the firewall rules and settings required. Instead, you can utilize the built-in firewall rules designed for the IP Server 900 to allow the SIP and NSP traffic to flow freely to the required ports on the ESI system. Additional configuration steps are covered in the EVR s full manual for configuring ports for services such as remotely installed IP phones and ESI Presence Management RFID Readers. 1. After the EVR has finished loading changes from completion of the Setup Wizard, navigate to the Aliases page under the firewall menu: To help make configuration on the EVR as simple as possible, we ve utilized aliases for common configuration parameters from the ESI PBX. The majority of the firewall and port forwarding rules that are needed to support SIP trunking on the ESI system are pre-built into the EVR and simply need to be assigned the proper IP addresses to be put into place. Here is a quick snapshot of the aliases before configuration followed by steps to configure the appropriate aliases. To edit an alias, simply click the edit button to the right of the rule s row in the table. (Continued) 17
2. In our example, we will be setting up the firewall for an ESI Communications Server. Again, to edit an alias, click the edit button ( configured is ippbxipaddress: ) to the right of the rule s row in the table. The first alias to be 3. To configure an alias: a. Add an associated IP address by clicking the plus button ( ) under Host(s). b. Type in the IP address programmed into the phone system (through Installer Function 84) as the Primary Processor IP or Port A IP address: (Continued) c. Click Save. 4. Click to edit the mediaipaddress alias: a. Click the plus sign to add the IP address programmed into the phone system (through Installer Function 84) as the Secondary Processor IP or Port B. b. Click Save. 5. Click to edit the nspipaddress alias: a. Click the plus sign to add the IP address programmed into the phone system (through Installer Function 824) as the NSP private IP address. b. Click Save. 6. Click to edit the rtpmediaendport alias: a. Click the plus sign to edit the Maximum RTP port value to match what is programmed into the phone system (through Installer Function 2142). b. Click Save. 7. Click to edit the rtpmediaports alias: a. Click the plus sign to edit the RTP port range to match what is programmed into the phone system (through Installer Function 2142) as the Minimum and Maximum RTP ports. b. Click Save. 18
8. Click to edit the rtpmediaports alias: a. Click the plus sign to edit the RTP port range to match what is programmed into the phone system (through Installer Function 2142) as the Minimum and Maximum RTP ports. b. Click Save. 9. After editing all of the necessary aliases, the final step is to apply the changes to the firewall rules by clicking Apply changes at the top right of the aliases chart: Remote access for ESI Technical Support With the release of v. 1.0.6 of the browser-based programming tool, we began automatically adding ESI s Technical Support IP range to your firewall. This is added after the Setup Wizard is configured. Important: If you need to make other port-forwarding changes, please use the screen below. 19
Installation worksheet ESI highly recommends you use this worksheet to obtain all the necessary requirements before setting up your EVR. Field Name Value Description Hostname Domain Primary DNS Secondary DNS Override DNS Time Zone Enable Selected WAN Type MAC Address MTU IP Address Gateway Static DHCP PPPoE PPTP General Information Time Zone Network identification name for the device e.g., abcplumbingevr. Customer's URL domain e.g., abcplumbing.com. Primary DNS server to use for both WAN and LAN activity. Secondary DNS server to use for both WAN and LAN activity. Allow DNS servers to be overridden by settings assigned to the WAN port via DHCP or PPP on the WAN connection. Time zone for the customer's site. Enable WAN Check this box to enable the WAN port, which is disabled when shipped to allow for programming the device before deploying. Configure WAN Interface General Configuration Static IP Configuration Select the WAN interface configuration type depending on the customer's configuration with their ISP. Check one of these boxes and collect information required for that configuration option. This field can be used to modify ("spoof") the MAC address of the WAN interface (may be required with some cable connections). Enter a MAC address in the following format: xx:xx:xx:xx:xx:xx or leave blank. If you enter a value in this field, MSS clamping for TCP connections to the value entered above minus-40 (TCP/IP header size) will be in effect. If you leave this field blank, an MTU of 1492 bytes for PPPoE and 1500 bytes for all other connection types will be assumed. Set the public-facing IP address and subnet mask using CDR notation. See the reference sheet in the appendix for assistance with converting your subnet mask into CDR notation. Gateway IP address that is used and provided by the customer's ISP. 20
Installation worksheet (continued) Field Name Value Description PPPoE Username PPPoE Password PPPoE Service name PPPoE Dial on Demand PPPoE Idle timeout PPTP Username PPTP Password PPTP Local IP Address PPTP Remote IP Address PPTP Dial on demand PPPoE Configuration PPTP Configuration Hint: This field can usually be left empty. This option causes the interface to operate in dial-ondemand mode, allowing you to have a virtual full-time connection. The interface is configured, but the actual connection of the link is delayed until qualifying outgoing traffic is detected. If no qualifying outgoing packets are transmitted for the specified number of seconds, the connection is brought down. An idle timeout of zero disables this feature. This option causes the interface to operate in dial-ondemand mode, allowing you to have a virtual full-time connection. The interface is configured, but the actual connection of the link is delayed until qualifying outgoing traffic is detected. PPTP Idle timeout If no qualifying outgoing packets are transmitted for the specified number of seconds, the connection is brought down. An idle timeout of zero disables this feature. LAN IP Address Subnet Mask Configure LAN Interface This sets the IP address of the LAN port for accessing the web configuration interface. Type DHCP if a separate DHCP server is to be used instead of the DHCP server built into the EVR. Set the subnet mask for the LAN interface in CDR notation. 21
Installation worksheet (continued) Field Name Value Description Enable DHCP Starting DHCP Address Ending DHCP Address Gateway Primary DNS DHCP Server (if required) This will turn on or off the DHCP server in the EVR. The start for the DHCP IP address range. The ending address for the DHCP IP address range. This is the gateway to assign to devices when assigning IP addresses. Generally this will be the LAN IP address. The primary DNS server to assign to devices when assigning IP addresses. Secondary DNS The secondary DNS server to assign to devices when assigning IP addresses. Profile Type IP 900 ESI-50 Cloud PBX Other ESI Profile Selector This selection will determine how the firewall rules are configured depending on the services to which the customer is subscribing. The IP 900 (IP Server 900) and ESI-50 options will allow you to configure common configuration parameters for deployment. Cloud PBX will configure UPnP port forwarding for SIP phones. Other requires advanced configuration parameters to be set outside of this wizard. PBX Local IP Address PBX ASC Access Port IP Server 900 System Settings This value is programmed into Function 821 of the phone system. This is set to port 22 by default and will allow ESI Technical Support services to log into the IP Server 900 at the customer's site if need be for support purposes. However, this does NOT allow ALL networks access through port 22; only ESI's networks are set with this rule. Media IP Address This is the DSP IP address found in Function 822. NSP IP Address NSP Access Port Enable General System Firewall This is the NSP address for the PBX found in Function 824. This is set to port 59002 by default and is only initially opened to ESI's networks for tech support purposes. It is highly recommended to ALWAYS enable the system firewall to ensure the best protection of your network devices and services. 22
Installation worksheet (continued) Field Name Value Description SIP Port RTP Start Port RTP End Port Enabled EHS SIP Trunks Firewall EHS SIP Trunks Esi-Link and Remote Phones The default SIP port used for SIP signaling to the IP Server 900. This is port 5060 by default and can be found in Function 2142. This is the base starting port for the RTP port range that is opened up for RTP traffic. This is 10000 by default and can be found in Function 822. This s the ending port for the RTP port range that is opened up for RTP traffic. This is 10351 by default and can be found in Function 822. This setting tells the EVR to allow only SIP and RTP traffic on the programmed ports from ESI's networks and data centers. Base UDP Prefix Default is 59 and this can be found in Function 823. DSP UDP Port Default is 59111 and this can be found in Function 822. G.729 UDP Port Default is 59112 and this can be found in Function 822. Enable ESI-Link and Remote Phone Firewall Remote SIP phone Port Enable Remote SIP Phones Firewall ippbxipaddress mediaipaddress nspipaddress rtpmediaendport rtpmediaports Remote SIP phones This setting tells the EVR to turn on or off the firewall rules pertaining to usage of ESI-Link and remote IP phones. This setting tells the EVR what port to allow signaling from remote SIP stations to come through the firewall on. This setting tells the EVR to turn on or off the firewall rules pertaining to the usage of remote SIP phones. ESI Communications Server Advanced Settings (Aliases) This should be programmed as the IP Address of Port A on the SIP trunking port card. This can be found in Function 84. This should be set as the IP address of Port B on the SIP trunking port card. This can be found in Function 84. This should be set as the IP address of the NSP port on the system. This can be found in Function 824. This should be set to port 11000 because an ESI Communications Server requires more RTP ports to be opened than the IP Server 900. This should be changed to 10000:11000 because an ESI Communications Server requires additional RTP ports to be opened. 23
License pfsense software copyright 2004 2014 Electric Sheep Fencing LLC. pfsense is a federally registered trademark of Electric Sheep Fencing LLC. Any unauthorized use of this trademark is prohibited by state and federal law and international treaties. All rights reserved. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO: PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 24