StarLeaf Network Guide

Transcription

1 Network Guide

2 Contents Introduction Registration to the Point-to-point calling within the Calling from a endpoint to the public telephone network (PSTN) Multipoint conferencing Copyright All rights reserved. This guide may not be copied, photocopied, translated, reproduced, or converted into any electronic or machinereadable form in whole or in part without prior written approval of Limited. Limited reserves the right to revise this documentation and to make changes in content from time to time without obligation on the part of Limited to provide notification of such revision or change. Limited provides this documentation without warranty, term, or condition of any kind, either implied or expressed, including, but not limited to, the implied warranties, terms or conditions of merchantability, satisfactory quality, and fitness for a particular purpose. Limited may make improvements or changes to the product(s) and/or the program(s) described in this documentation at any time. All other product and company names herein may be trademarks of their respective owners. Network Guide

3 Introduction This guide explains how endpoints register to the and make and receive video calls when connected on a customer s network. It applies to all endpoints hardware and soft clients. An important part of this guide is the distinction between signaling traffic and media traffic. In video conferencing, signaling traffic consists of low-bit-rate messages and commands that are sent between endpoints and infrastructure for the purposes of registration and setting up, managing and disconnecting calls. Media traffic is the high-bit-rate flow of real-time audio, video and data-sharing traffic that constitutes the actual call. From a network administrator s point of view, the media traffic is significant because of the demands it places on bandwidth. All endpoints use a default call bit rate of 1.5mbps, but reduce this automatically when they detect that less bandwidth is available. More details on call bit rates used by endpoints are given in Video bandwidths and resolutions used by Call. Registration to the A endpoint must be registered to the to work. All signaling to and from the endpoint is controlled by the and routed via a single host on the public. This host has a DNS name like, which resolves to the public IP address of a border controller within the. Every endpoint in the customer organization uses the same border controller. The endpoint sends probe packets to the border controller, which sends packets back in reply. A regular flow of packets, which is able to encapsulate any type of payload required, ensures that the customer firewall s NAT pinhole is kept open. This is s firewall traversal mechanism and is called a tunnel. Because all endpoint signaling is controlled and routed via the, it is not possible to call a endpoint by its own IP address. endpoints cannot call thirdparty endpoints that use private IP addresses, but can call public IP addresses. On point-to-point (two-way) calls within an organization, media (video, audio and content) takes the most direct route possible: If the endpoints can route traffic to each other s private IP addresses, the media will be sent that way If the endpoints are on different LANs but can route traffic via each other s public (NAT) addresses, the media will be sent that way If no direct route can be found, the media will be backhauled to the organization s border controller On multipoint calls, or point-to-point calls where the far end is not a endpoint or is in a different organization, the media is backhauled to the border controller. The following diagram shows the principles of registration. Network Guide May

4 Figure 1. Provisioning and Registration Administrator 1 Provisioning and registration Persistent UDP tunnel HTTPS Portal Endpoint 2 config.starleaf.com Configuration Server 3 HTTPS UDP Router/Firewall Local data center Customer LAN Data Centers 1 Provisioning The reseller creates the customer organization on the portal. The location of the data center is determined by the geographical location of the organization. The reseller or customer administrator creates users and meeting rooms, assigning soft and hard endpoints as required. This is done on the Portal. The portal generates registration credentials which take the form of a 12-digit quick-connect code (for a hardware endpoint) or a single-sign-on login (for a soft client user). The Portal Tutorial for Resellers gives full details about provisioning. 2 Registration The endpoint is connected to the customer s LAN and acquires IP configuration details using DHCP (alternatively, these details can be statically assigned). The installer enters the registration credentials and the endpoint supplies them to config.starleaf.com using an outbound HTTPS (port 443) connection. The configuration server tells the endpoint which border controller to register with. In this document, the border controller is. 3 Tunneling The endpoint sends outbound UDP packets to its border controller, and receives replies from it. The outbound packets will be sent to one of the UDP ports 24704, 3478, 1194, 500 and 123 (123 is the well-known port for NTP servers, so has a high probability of being allowed through most firewalls). This bi-directional flow of packets is called a tunnel. The tunnel can carry multiple data streams (of signaling and media) between the endpoint and border controller, but as far as the network is concerned, these streams are all just UDP payload. Some firewalls will not allow outbound UDP traffic to be sent. In this case, the endpoint creates a TCP tunnel to port 443 of the border controller this is a good fail-over mechanism, but sending real-time media packets over TCP can result in a lower-quality user experience. If this connection type also fails, the Network Guide May

5 endpoint will display an error message indicating that it cannot connect. In this case, there are two troubleshooting steps: 1. Ensure that the conditions in this article: Firewall configuration: IP ports and addresses used by Call are met. 2. Ask an affected Breeze user to run problem_report.exe, available from downloads.starleaf.com. This will upload debugging information to s development server and allow the Technical Support team to identify the cause of the failed connection. The and the endpoint are now able to communicate with each other, exchanging all the types of registration, directory, signaling and media traffic that are required for a successful user experience. Network Guide May

6 Point-to-point calling within the This section illustrates various different point-to-point calling scenarios. Point-to-point calls within a organization In this scenario, a endpoint calls another endpoint in the same organization and on the same network. An IP route exists between the local IP addresses of the endpoints. Figure 2. Point-to-point calls within a organization Private Direct Media Endpoint A Media (audio, video, and content) Signaling Endpoint B Router/Firewall Customer LAN Data Centers 1. Endpoint A sends a setup request to the call control engine within the, supplying the extension number or address of the far end. 2. The call controller identifies the relevant destination endpoint to be called, and signals it to ring. If the far-end user has multiple endpoints registered in their name (for example, a Personal Telepresence system and a Breeze client) all of the endpoints will ring. 3. While ringing, the endpoints at both ends work out the most efficient way to route media between themselves. In this scenario, a direct IP route exists. When the far end picks up, signaling is sent back to the calling endpoint via the border controller. The call is now connected. 4. Media is sent directly between the two endpoints (not via the border controller), using the route established in Step 3. The direct route avoids unnecessary usage of the organization s connection. The signaling traffic represents only a tiny amount of data, by comparison. We call this method Private Direct Media. Network Guide May

7 In the next scenario, the company has a single organization with endpoints distributed between different sites that have separate connections. There is no company WAN, so there is no direct IP route between the private IP addresses of the endpoints. Figure 3. Point-to-point calls within a organization Public Direct Media Endpoint A Media (audio, video, and content) Signaling Routers/Firewalls Endpoint B Customer LANS (no private route between LANS) Data Centers In this scenario, the endpoints establish that no direct route exists between them. They perform an Interactive Connectivity Establishment (ICE)-like probing process to see if they are able to route media direct between their NAT addresses, instead. This attempt is likely to be successful if the two NAT gateways do not implement symmetric NAT this is most likely to be the case if at least one of them is a domestic router (as opposed to two enterprise-class firewalls). Symmetric NAT imposes tight restrictions on which external host address/port combinations are able to route packets into the firewall. Your firewall might give you the flexibility to configure this behavior. If the endpoints are able to route media into each other s NAT pinholes, the media path shown by the blue line in Figure 2 on page 6 will be used. This gives the shortest, lowestlatency media path possible between the two endpoints and reduces load on the service. We call this Public Direct Media. If Public Direct Media is not possible, the media is backhauled to the Border controller, as shown in Figure 4 on page 8. Network Guide May

8 Figure 4. Point-to-point call in the same organization (media via border controller) MyCompany Endpoint A Routers/Firewalls Signaling Media (audio, video, and content) via MyCompany Endpoint B Customer LANS (no private route between LANS) Data Centers The advantage of the media via border controller method is that it uses the already-established tunnel routes between the company s firewalls and the border controller, so it is certain to work. The disadvantage is that this might not be the most direct route for the traffic. Network Guide May

9 Point-to-point calls between organizations The first point-to-point scenario between organizations is between endpoints. A user in one company calls a user in another company. The call can be dialed either by address or directly by URI. Figure 5. Point-to-point call between organizations Media (audio, video, and content) via Signaling MyCompany Endpoint A Router/Firewall London Data Center OtherCompany Endpoint A Router/Firewall othercompany.call.sl New York Data Center Customer LANS Data Centers When dialled by address, the call control engine performs a lookup within the portal database to check if that address corresponds to a user and, if so, where within the that user is hosted. When dialed by URI, no such lookup is necessary because the destination information (the far side s border controller) is contained in the URI. The format of a URI is: 8XXXX2YYY@othercompany.call.sl...where 8XXXX is the unique identifier of the othercompany organization, 2YYY is the called user s extension, and othercompany.call.sl resolves to the public IP address of the destination company s border controller. The unique URI of each user is in the Welcome sent by the to that user when they were first provisioned, and can be found and re-sent to them via the portal web interface. This URI can also be found in the settings of the Phone/Touch or Breeze. The call control engine attached to the calling company organization receives the call setup signaling from the calling endpoint. The call control engine sends a setup message to the destination organization. The destination organization s call control engine signals the destination endpoint(s) to ring, via its established tunnel connections to those endpoints. Signaling is exchanged back and forth along this route in order to connect the call. When the call is connected, media negotiation takes place and media channels are established along the same route that the signaling took. Network Guide May

10 The second point-to-point scenario between organizations is between a endpoint in one organization and an H.323 endpoint in another organization. In Figure 6, a endpoints calls a publicly-accessible H.323 endpoint which is not registered to the. Figure 6. Point-to-point call between a endpoint and a third-party H.323 endpoint Endpoint A at MyCompany Router/Firewall RTP H.323 EVSIP H.323 Endpoint at OtherCompany Customer LANS Data Centers A endpoint will be unable to call an H.323 endpoint which is connected only on a private IP address with no provision made for public connectivity. For example, if a Polycom endpoint is on a customer LAN and has the private IP address , dialling from a endpoint, even on the same LAN, will not work, because is not routable from (which is on the public ). Note: When a endpoint calls an H.323 endpoint which is registered to the same organization, that H.323 endpoint is registered to the organization s border controller (which has the ability to behave as an H.323 gatekeeper). Registering an H.323 endpoint with a organization allows its H.460 capabilities to be used for firewall traversal. Network Guide May

11 Calling from a endpoint to the public telephone network (PSTN) PSTN connectivity is a non-standard feature that can be enabled for organizations on a custom basis, in conjunction with a suitable PSTN SIP trunking provider. Your sales contact will be able to give you more information about this, including any setup and monthly recurring costs involved. When this feature is set up, a SIP trunk is actively registered from the organization s call controller to the gateway of the PSTN SIP trunking provider. Calls made from endpoints to telephone numbers are routed from the call controller to the SIP provider, via the border controller and using SIP signaling over the. The provider completes the call to the telephone number and media is routed as shown in the diagram. Calls between endpoints and publicly-accessible SIP video systems work in the same way. The diagram below shows PSTN to connectivity. Figure 7. Endpoint A Audio Call Calling from a endpoint to the public telephone network (PSTN) Router/Firewall RTP SIP EVSIP Customer LAN PSTN SIP Trunk Provider PSTN Data Centers Network Guide May

12 Multipoint conferencing This section illustrates various different multipoint calling scenarios. Multipoint conference between endpoints in the same organization In this calling scenario, the endpoints are in the same organization and have a direct IP route to each other. However, in a multipoint conference, all of the media has to be transcoded, and transcoding is all done by the. Therefore, each endpoint sends and receives all of its signaling and media via the organization s border controller, through which it accesses the call control and media engines that are needed to make the multipoint conference work. Figure 8. Multipoint conference between endpoints in a single organization Endpoint A LAN 1 Router Endpoint B LAN 2 Endpoint C LAN 3 Media (audio, video, and content) Signaling Tunnel Customer Network (WAN/MPLS) Data Centers Clearly, this situation leads to a higher load on the organization s connection. In mitigation, because the video contributed from each endpoint in the conference is shown at a much lower resolution than it would be on a point to point call, the bit rate at which each endpoint transmits media is much lower than on a point to point call typically, 0.5 mb/s instead of 1.5 mb/s. Network Guide May

13 Multipoint conferences between endpoints in different organizations When endpoints outside the conference host organization are included in a conference, their signaling and media are routed via the other organization s border controller (in the case of external endpoints) or via standard H.323 or SIP calls across the to the destination endpoint, as shown in the following diagram. Figure 9. Conference including external endpoints MyCompany LAN 1 Router Media (audio, video, and content) Signaling Tunnel MyCompany LAN 2 OtherCompany LAN Router othercompany.call.sl Customer Networks Data Centers Network Guide May

14 Multipoint conferences including third-party endpoints In the following diagram the conference includes a third-party endpoint outside the organization that has a public IP address. Figure 10. Conference including a third party endpoint tthe is connected to the third-party endpoint using H.323 or SIP MyCompany LAN 1 Router Media (audio, video, and content) Signaling Tunnel MyCompany LAN 2 OtherCompany LAN Company Networks Data Centers Network Guide May

15 Network Guide May