UCi2i Video Conference Endpoint Firewall Requirements

Transcription

1 UCi2i Video Conference Endpoint Firewall Requirements Page 1

2 Confidentiality Statement and Copyright Notice This document is published as Public and may be freely distributed. Copyright subsists in all UCi2i (UK) Limited publications. No extract may be reproduced, stored in a retrieval system or transmitted in any form or by any means electronic, photocopying, recording or otherwise to any third parties, without prior permission in writing from UCi2i (UK) Limited. Version Control Date Version Changes Authorised 28 th November Draft for review TK 3 rd March Released version TK 6 th August Brand updates TK 29 th January Addition of WebRTC/Brower-based calling TK 9 th February Additional IP s added TK 16 th December Changed V-Desk support number (UK) TK Page 2

3 Contents UCi2i VC Endpoint Firewall Requirements... 4 What this means to you... 4 What addresses and ports does video conferencing use?... 5 UCi2i address ranges... 5 Complete Firewall Port List... 5 Defined Services Firewall List... 6 SIP Proxies... 6 H323: Using Assent Firewall Traversal... 6 H323: Using H /19 Firewall Traversal (used by all Polycom/Lifesize devices)... 7 Browser-based Video Calling (a.k.a. WebRTC)... 7 Endpoint Management (optional)... 8 Page 3

4 UCi2i VC Endpoint Firewall Requirements Due to the implementation of our secure video network, there are a few firewall rules that may be required depending on your network configuration to allow communication with the UCi2i infrastructure. This is to provide our clients with the best technology on the market. What this means to you In order for you and your client to take full advantage of our service, we MAY require you to make some changes to your firewall to allow communication from your current hardware/software to our Firewall Traversal Servers. Please note that many firewalls work without any modification at all. If you wish to test your firewall before deploying our managed video service, then you can test SIP Video functionality by downloading the free video client from and once installed and logged in, call test@uci2i.com from the Jabber video client. You should see the following, and hear Hello, welcome to the conferencing system followed by a live self-view video of yourself. Please note the free Cisco Jabber video client has no customer support from Cisco or from UCi2i, however, feel free to let your friends/relatives know about it, and to use it to call them. Page 4

5 What addresses and ports does video conferencing use? Please see below firewall port requirements. In order to provide resiliency, we will require you to open ports to multiple addresses. UCi2i address ranges (for endpoint management only) (for endpoint management only) Complete Firewall Port List To enable the UCi2i service a complete list of the ports required is below. Should, you require information on the individual protocol requirements then please see the next section for a breakdown of services. HTTP 80 TCP Host ----> UCi2i HTTPS 443 TCP Host ----> UCi2i Gatekeeper RAS 1719 UDP Host ----> UCi2i H.225 Protocol 1720 TCP Host ----> UCi2i Signalling/Media (RTP) 2776 TCP+UDP Host ----> UCi2i RTCP + H TCP+UDP Host ----> UCi2i STUN/TURN Media 3478 UDP Host ----> UCi2i SIP Signalling(TCP) 5060 TCP+UDP Host ----> UCi2i SIP Signalling(TLS) 5061 TCP Host ----> UCi2i Q931/H TCP Host ----> UCi2i Page 5

6 Signalling Media + Lync TCP+UDP Host ----> UCi2i Media + Lync UDP Host ----> UCi2i Defined Services Firewall List SIP Proxies Please ensure that the correct ports are open depending on the video conferencing system you are using. There are different port requirements for SIP depending on what signalling method your system is using. The media requirements are the same regardless of the signalling method. Note these outbound exceptions are required to establish a UDP/TCP session. There are absolutely no inbound pinholes required. SIP Signalling(TLS) 5061 TCP Host ----> UCi2i SIP Signalling(TCP) 5060 TCP Host ----> UCi2i SIP Signalling(UDP) 5060 UDP Host ----> UCi2i Media (RTP) 2776 UDP Host ----> UCi2i Media (RTCP) 2777 UDP Host ----> UCi2i Media UDP Host ----> UCi2i H323: Using Assent Firewall Traversal If your video conference system supports Assent traversal, you MAY need to open the ports below in order to register to our firewall traversal server. Gatekeeper RAS 1719 UDP Host ----> UCi2i Call Signalling 2776 TCP Host ----> UCi2i Media (RTP) 2776 UDP Host ----> UCi2i Page 6

7 Media (RTCP) 2777 UDP Host ----> UCi2i Q931/H245 Signalling TCP Host ----> UCi2i Media UDP Host ----> UCi2i H323: Using H /19 Firewall Traversal (used by all Polycom/Lifesize devices) If your video conference system is not a Cisco Telepresence device and supports H /19 firewall traversal, you will need to open the ports below in order to register to our firewall traversal server. Gatekeeper RAS 1719 UDP Host ----> UCi2i H.225 Protocol 1720 TCP Host ----> UCi2i H.245 Protocol 2777 TCP Host ----> UCi2i Q931/H245 Signalling TCP Host ----> UCi2i Media (RTP) 2776 UDP Host ----> UCi2i Media (RTCP) 2777 UDP Host ----> UCi2i Media UDP Host ----> UCi2i Browser-based Video Calling (a.k.a. WebRTC) We offer browser-based video calling - all major browsers are supported. This is typically known as WebRTC but we offer more than that as WebRTC is limited to Google Chrome, Firefox and Opera. We also provide service to any browser that also supports Adobe Flash. To allow this feature to work, the following ports will need to be opened: STUN/TURN Media 3478 UDP Host ----> UCi2i Media TCP Host ----> UCi2i Page 7

8 Media UDP Host ----> UCi2i HTTP 80 TCP Host ----> UCi2i HTTPS 443 TCP Host ----> UCi2i Endpoint Management (optional) If you require your video endpoint to be managed by us, we will require an IP address which is accessible over the Internet. This should be a static NAT IP as we do not recommend placing an endpoint directly on the internet. Please lock down access to the IP s listed above. Please ensure you have the below ports opened on your firewall to allow for monitoring and management of your video endpoint from our network. You will need to ensure your video endpoint is using an NTP server in order for it to authenticate with our Gatekeeper and for encryption to be active. HTTP or 80 TCP Host <----> UCi2i HTTPS (preferred) 443 TCP Host <----> UCi2i SNMP 161 UDP Host <---- UCi2i SNMP Traps 162 UDP Host ----> UCi2i Telnet or 23 TCP UCi2i ----> Host SSH (preferred) 22 TCP UCi2i ----> Host NTP NTP NTP NTP Key Please see below explanations of the direction column (where applicable): Direction Host <----> UCi2i Host <---- UCi2i Host ----> UCi2i Explanation Ports needs to be opened inbound and outbound to/from your VC endpoint and UCi2i Ports need to be opened inbound to your VC endpoint from the UCi2i address ranges Ports need to be opened outbound from your VC endpoint to the UCi2i address ranges Page 8

9 UCi2i ----> Host Host ---> NTP Server Ports need to be opened inbound to your VC endpoint from the UCi2i address ranges Ports need to be opened outbound from your VC endpoint to the NTP Server Finally, If you have any problem, please feel free to call our UCi2i Helpdesk Number: (HK) or (UK). Page 9

10 APAC t: V-Desk: v/e: 21/F, Wyler Centre Phase II Tai Lin Pai Road Kwai Chung, N.T, Hong Kong EMEA t: v/e: 6 Mitre Passage Greenwich Peninsula London SE10 0ER Page 10