Application Note. Onsight TeamLink And Firewall Detect v6.3

Transcription

1 Application Note Onsight And Firewall Detect v6.3

2 1 ONSIGHT TEAMLINK HTTPS TUNNELING SERVER Encapsulation Firewall Detect Firewall Detect Test Server Options: Firewall Detection Status WEB HTTPS PROXY CONFIGURATION TEAMLINK FIREWALL DETECT LIMITATIONS ONSIGHT CONNECT SERVICE CHECK LIST... 9 Application Note: Onsight and Firewall Detect Librestream

3 1 Onsight HTTPS Tunneling Server Onsight is for situations when it is not possible to open SIP and Media ports on the Firewall, in these cases is used to tunnel all SIP and Media traffic encapsulated in HTTPS packets to a Server. The Server proxies all traffic to the SIP and Media Servers on behalf of the Onsight Endpoint behind the Firewall. The advantage of this method is that can use existing open ports on the Firewall, TCP 443 for HTTPS (or TCP 80 for HTTP if preferred). Direct communication with the SIP Server is the preferred method of establishing communication between Onsight endpoints. Whenever possible the firewall should be configured to allow direct communication to the SIP and Media Servers. 1.1 Encapsulation When using the Onsight Endpoint will encapsulate SIP (TCP) and Media (RTP/RTCP/UDP) traffic in HTTPS protocol packets. The Server receives these packets and strips off the HTTPS encapsulation before forwarding them to the SIP (and Media Servers). The SIP Server will send responses to the Server. encapsulates the packets before sending them back to the Onsight Endpoint. When is enabled Onsight Endpoints will first contact a Cluster Manager (TCM) which will assign a Server to the endpoint. The Onsight Endpoint will then register to the Server. 1.2 Firewall Detect Firewall Detect is an Onsight System feature that tests the ports on the local Firewall to determine the best method for SIP Registration or rather when to use versus direct registration to the SIP server. Firewall Detect is only active if is enabled. The test is conducted by sending test traffic to a Test Server, one of either: the Cluster Manager, the server or the Onsight SIP Server. The destination is dependent on configuration of the Onsight endpoint s SIP Detection Method. If the Firewall test detects that the local firewall ports are open to the Test server, then the Onsight Endpoint assumes the ports are also open to the SIP Server. That is, if SIP ports are open to the Test Server the Onsight Endpoint attempts to SIP register directly to the SIP Server; if SIP ports are closed the Onsight Endpoint will use to register to the SIP Server indirectly. Application Note: Onsight and Firewall Detect Librestream

4 Firewall Detect determines the best method of SIP Registration based on the results of the port tests to the Test server. If your Enterprise allows direct SIP registration to the SIP server and has endpoints that will migrate from inside the Firewall to outside, Firewall Detect will provide the most accurate results if the Enterprise s Firewall allows traffic to Servers over the following ports: The tested range of SIP, HTTP, HTTPS and UDP ports is configured on the Onsight Endpoint by Librestream. They are based on the required ports for Librestream s Onsight SIP Service. The Firewall Detect Test uses Session Traversal Utilities for NAT (STUN) protocol to determine the mapped Public IP address of the Firewall. STUN traffic is sent to UDP destination port 3478 of the Test Server by the Onsight Endpoint. STUN is also used to test UDP ports and Firewall Detect: Protocols, Ports and Transports Protocols Ports Transport SIP 5060 TCP SIP-TLS 5061 TCP RTP* * UDP HTTP 80 TCP HTTPS 443 TCP STUN 3478 UDP SIP.LIBRESTREAM.COM Firewall Detect Matrix: SIP Detection IP Type Protocol / Port # Method/Destination UDP or TCP Port Range under Test UDP 3478 SIP Server (Full or Basic), sip.librestream.com ( ) Result Method, Hostname (IP Address) Open Closed, tcmx.librestream.com TCP SIP Server (Full or Basic), sip.librestream.com ( ), tcmx.librestream.com Public IP Address of the Firewall is discovered; the remaining port tests are run Direct SIP Server Registration is attempted Public IP Address of Firewall cannot be determined; the remaining port tests are aborted. tunneling is enabled SIP Registration is proxied through Application Note: Onsight and Firewall Detect Librestream

5 UDP SIP Server (Full or Basic), sip.librestream.com ( ), tcmx.librestream.com TCP 80, 443 SIP Server (Full or Basic), sip.librestream.com ( ), tcmx.librestream.com Media streams are sent directly to the SIP Server registration and HTTP/S tunneling are enabled Media streams are tunneled through is blocked, can t register to For v6.3 the SIP Detection Method: should be used when using either sip.librestream.com or your company s own SIP Server. Only use SIP Detection: SIP Server Full or Basic when using sip.librestream.com as the SIP domain. If Firewall Detect determines that all ports are blocked to the Test Server, including HTTPS and HTTP, Onsight Connect will attempt to register directly to the SIP Server as a last attempt at SIP Registration Firewall Detect Test Server Options: There are some important differences between v6.3 and v6.2 Onsight Connect architectures with regards to the Firewall Detect test. Previously, with v6.2 and earlier, firewall detection to determine SIP connectivity was done against a single server which was configured on the client. With v6.3, Firewall detection occurs through different paths depending on the configuration of the Onsight Client. The configuration is controlled by the OAM Client Policy under Firewall Detect-SIP Detection Method. Firewall Detect Tests are only run when is enabled. v6.3 is under Cluster management control (tcm.librestream.com). This means each endpoint is configured to contact a Cluster Manager (TCM). The Cluster Manager assigns the Onsight Client a server dynamically. At that point the Onsight Client connects to the server directly. If an Onsight client is enabled for with TCM: A. HTTP/HTTPS tests are done directly to the configured Cluster Manager server. If the cluster is load balanced, the load balancer decides with cluster manager this request goes to. B. SIP tests are done according to the following: 1. If a private SIP server is configured, a simple OPTIONS ping test will be done to the configured private SIP server. 2. If SIP Detection Method is configured to be SIP Server Full. Then the Onsight client will interrogate the configured public SIP server with a full SIP/STUN test. 3. If SIP Detection Method is configured to be SIP Server Basic. Then the Onsight client will interrogate the configured public SIP server with a simple OPTIONS ping test. Application Note: Onsight and Firewall Detect Librestream

6 4. If SIP Detection Method is configured to be. Then the Onsight client will interrogate the configured Cluster Manager server with a full SIP/STUN test. If the cluster is load balanced, then the TCM that is interrogated is the same as the one that received the request in A. Onsight Endpoints using v6.3 can still be configured to register directly to servers without first contacting a Cluster Manager. If an Onsight client is enabled for without TCM: A. HTTP/HTTPS tests are done directly to the configured server B. SIP tests are done according to the following: 1. If a private SIP server is configured, a simple OPTIONS ping test will be done to the configured private SIP server. 2. If SIP Detection Method is configured to be SIP Server Full. Then the Onsight client will interrogate the configured public SIP server with a full SIP/STUN test. 3. If SIP Detection Method is configured to be SIP Server Basic. Then the Onsight client will interrogate the configured public SIP server with a simple OPTIONS ping test. 4. If SIP Detection Method is configured to be. Then the Onsight client will interrogate the configured server with a full SIP/STUN test Firewall Detection Status For a summary of all the Firewall Detect settings and status, select Details and the following screen will appear. Application Note: Onsight and Firewall Detect Librestream

7 The following table describes each of the fields shown above. Client state Indicates whether Firewall Detect is active Connectivity Reports the Status of the SIP Registration methods and Network. Connection Method is Open/Network is connected Connection Method is Disabled Connection Method is Blocked Local Address Mapped Address Path MTU Server SIP Server SIP Detection Method UDP Connectivity SIP Connectivity Reports the Local IP address of the Host PC running Onsight Connect for PC Reports the external IP address of the Firewall the PC sits behind Reports the size of the Maximum Transmission Unit for the Host PC Load Balancer SIP Registration Server SIP test method for Firewall Detect Reports the status of the listed UDP ports on the Firewall Reports the status of the listed TCP ports on the Firewall The UDP test checks the ports used for the media such as audio, video and data. For efficiency, set the boundaries of the port range you would like to test as in the example above by separating them by commas e.g , Testing a complete range e.g could take an excessive amount of time. Application Note: Onsight and Firewall Detect Librestream

8 The SIP test will check for TCP ports 5060 and 5061 and it will test for SIP aware Firewalls. The SIP Aware NAT test is a SIP header test looking for Public IP addresses being inserted in the SIP header in place of private LAN IP addresses. When a SIP Aware NAT is present it can cause confusion for the SIP Server so it is best to use SIP-TLS as the transport. SIP-TLS will encrypt the SIP headers and make these unavailable for inspection by the SIP Aware NAT. 2 Web HTTPS Proxy Configuration Onsight Connect and use HTTPS to communicate with the Onsight Connect service and tunnel SIP traffic. It is possible that it will need to be routed through an internal Web HTTPS Proxy at your location. Onsight Endpoints can be configured to use the Web Proxy at your location. Proxy Settings options include: No Proxy, Use System Settings, or Manual Proxy configuration. Onsight Connect also supports Proxy Authentication. On a PC, the Onsight Connect option, Use System Settings will use the client s Proxy configuration found under Control Panel-Internet Properties-Connections-LAN Settings. Onsight Connect Devices, e.g. 2500/2000/1000, support Manual Proxy configuration and Authentication. Onsight for ios Devices supports Use System Settings and Manual. If Use System Settings is selected the proxy configuration will be used from the currently selected Wireless Network configuration under Settings. Your Enterprise s Web Proxy must allow traffic to the both Onsight.librestream.com and Servers. Direct SIP Traffic is not sent through a Web Proxy, it is only routed through a Web Proxy when is enabled and the connection method is HTTPS or HTTP. Recall that the Firewall Detect test determines the suitable connection method: SIP, HTTPS or HTTP, depending on the results of the Firewall test. 3 Firewall Detect Limitations The firewall detection implementation of and the Onsight Connect endpoints have these known limitations: 1. Onsight Endpoints who use SIP Detection, won't correctly interpret the Firewall Detect test if the Firewall has been configured to block SIP and Media ports to either the TCM or server but allow HTTP/S. This may result in the use of s HTTPS tunneling when it is not required. This is because the SIP ports are tested using either TCM or as the destination. If the Firewall blocks SIP to either this will be reported as SIP blocked even though it allows SIP to an unknown SIP Server. (Note: the term unknown SIP Server is meant only to indicate that is unaware of the SIP Server in terms of Firewall Detect.) Application Note: Onsight and Firewall Detect Librestream

9 2. Customers who are using 3 rd party SIP Servers must use the SIP Server Basic method for SIP Detection. The 3 rd Party SIP Server must respond to SIP OPTIONS requests in order for the Firewall Detect Test to function correctly. 4 Onsight Connect Service Check List Firewall ports have been configured to allow Onsight Connect Service, SIP and (if required) Onsight devices are connected to the network (WiFi or Ethernet) Onsight Account Manager has been configured with Users, Client Policies and SIP Account information: o SIP server address o URI o User name and password o Authentication Transport Setting Install Certificates (if necessary, for SIP-TLS) If required, has been enabled For further information regarding Onsight Connect Setup consult the Onsight Connect User Manuals. Application Note: Onsight and Firewall Detect Librestream