PSTN Survivability - Sentinel in the LAN with PBX Registering to Sentinel. Dgw v Revision 01 April 30,

Transcription

1 PSTN Survivability - Sentinel in the LAN with PBX Registering to Sentinel Dgw v Revision 01 April 30,

2 PSTN Survivability - Sentinel in the LAN with PBX Registering to Sentinel Table of Contents Copyright Notice... 4 PSTN Survivability...5 Getting Started...5 Logging On To the Sentinel Web Interface...6 Configuring the Uplink Network Interface...6 Configuring the uplink_s Signaling Interface... 7 Configuring the lan1_s Signaling Interface...8 Configuring the uplink_m Media Interface...8 Configuring the lan1_m Media Interface... 9 Configuring the Office NAT/FW Configuring the wan_ip_trunk_ca Call Agent...10 Configuring the lan_ip_pbx_ca Call Agent Configuring a Registration Agent...11 Configuring the Call Agent Penalty Box...12 Associating Call Agent Rulesets to a Call Agent Call Agent Rulesets Associating Routing Rulesets to Your Configuration...13 Routing Rulesets Configuring the E1/T1 Port...13 Configuring the Sentinel FXO Port Configuring the IP PBX Configuring Your Main Office Phones Call agents...15 Call Agents...15 Rulesets...18 Rulesets Importing Rulesets...18 Call Agent Rulesets Routing Rulesets

3 Table of Contents Local Firewall Copyright

4 PSTN Survivability - Sentinel in the LAN with PBX Registering to Sentinel Copyright Notice Copyright 2015 Media5 Corporation. This document contains information that is confidential and proprietary to Media5 Corporation. Media5 Corporation reserves all rights to this document as well as to the Intellectual Property of the document and the technology and know-how that it includes and represents. This publication cannot be reproduced, neither in whole nor in part, in any form whatsoever, without written prior approval by Media5 Corporation. Media5 Corporation reserves the right to revise this publication and make changes at any time and without the obligation to notify any person and/or entity of such revisions and/or changes. 4

5 PSTN Survivability PSTN Survivability This use case describes the configuration of PSTN Survivability with the Mediatrix Sentinel located in the LAN. When PSTN survivability is configured it implies that: The Mediatrix Sentinel is setup as a demarcation point. When SIP trunk fails, calls go through the Sentinel's PRI or FXO port. The Mediatrix Sentinel may or may not register to SIP trunk. PBX may or may not register to the Mediatrix Sentinel. The Mediatrix Sentinel is located in the LAN, behind a Near-end NAT. Getting Started 1) Make sure the ETH1 connector of your Mediatrix Sentinel is connected to your router/switch connected to your LAN. 2) Make sure the ETH5/EXT connector of your Mediatrix Sentinel is connected to your computer. 3) Log on to the Mediatrix Sentinel Management interface. If you are using your Mediatrix Sentinel for the first time, refer to the Mediatrix Sentinel Quick Start guide. Logging On To the Sentinel Web Interface (p. 6) Copyright

6 PSTN Survivability - Sentinel in the LAN with PBX Registering to Sentinel Logging On To the Sentinel Web Interface For better performances, it is recommended to use the latest available version of Microsoft Internet Explorer, Google Chrome or Mozilla Firefox. You may not be able to log on to the Management Interface if you are using older versions. 1) In your web browser, enter the IP address used by your Mediatrix Sentinel to communicate with the Management Interface. If your computer is connected to the ETH5/EXT Ethernet connector of the Mediatrix Sentinel, use the IP address. If your Mediatrix Sentinel is configured to use a DHCP, use the DHCP- provided IP address. 2) Enter public as your username and leave the password field empty. 3) Click Login. You can also use admin as a username and administrator as password. Result The page of the Management Interface is displayed. Configuring the Uplink Network Interface (p. 6) Configuring the Uplink Network Interface Before you start You must be logged on to the Mediatrix Sentinel Management Interface. If you are not familiar with the meaning of the fields, click Show Help, located at the upper right corner of the Web page, to display field description when mousing over the field name. 1) Go to Network > Interfaces. 2) In the Network Interface Configuration table, from the Link selection list located next to Uplink, select eth1. 3) From the Type selection list, select IpStatic (IPv4 Static). 4) In the Static IP Address field, enter the static IP address as defined in your network address range. The Uplink Network Interface must be set with a fixed public IP address for the NAT/ router to be able to do port-forwarding to the unit. It will also be easier for the PBX to communicate with the unit if the address is static. 5) In the Static Default Router field, enter the IP address of the router or of the NAT/FW located in the LAN. 6

7 PSTN Survivability 6) Click Apply to apply all changes to the configuration. Result The unit can be reached (via the web) with the Static Address. Configuring the uplink_s Signaling Interface (p. 7) Configuring the uplink_s Signaling Interface Before you start Configuring the Uplink Network Interface (p. 6) must be completed. If you are not familiar with the meaning of the fields, click Show Help, located at the upper right corner of the Web page, to display field description when mousing over the field name. 1) Go to SBC > Configuration. 2) In the Signaling Interface Configuration table, from the Network selection list located next to uplink_s, select Uplink. The Network Interfaces displayed in the Network column, are created under the Network > Interfaces page. 3) In the Public Address field, indicate the main office NAT/FW public IP Address. 4) Click Save. 5) Click Apply to apply all changes to the configuration. 6) Click Restart required services, located at the top of the page. Result The Signaling Interface will be available when configuring a Call Agent, in the Configure Call Agent page in the Signaling Interface selection list. Configuring the lan1_s Signaling Interface (p. 8) Copyright

8 PSTN Survivability - Sentinel in the LAN with PBX Registering to Sentinel Configuring the lan1_s Signaling Interface Before you start Configuring the Uplink Network Interface (p. 6) must be completed. If you are not familiar with the meaning of the fields, click Show Help, located at the upper right corner of the Web page, to display field description when mousing over the field name. 1) Go to SBC > Configuration. 2) In the Signaling Interface Configuration table, from the Network selection list located next to lan1_s, select Uplink. 3) In the Port field, enter a port number (not the same as the one used for the uplink_s signaling interface). 4) Click Save. 5) Click Apply to apply all changes to the configuration. 6) Click Restart required services, located at the top of the page. Result The Signaling Interface will be available when configuring a Call Agent, in the Configure Call Agent page in the Signaling Interface selection list. Configuring the uplink_m Media Interface (p. 8) Configuring the uplink_m Media Interface Before you start Configuring the Uplink Network Interface (p. 6) must be completed. If you are not familiar with the meaning of the fields, click Show Help, located at the upper right corner of the Web page, to display field description when mousing over the field name. 1) Go to SBC > Configuration. 2) In the Media Interface Configuration table, from the Network selection list located next to uplink_m, select Uplink. The Network Interfaces displayed in the Network column, are created under Network > Interfaces page. 3) In the Public Address field, enter the main office NAT/FW public IP address. 4) In the Port Range field set the port range ( ). 5) Click Save. 8

9 PSTN Survivability 6) Click Apply to apply all changes to the configuration. 7) Click Restart required services, located at the top of the page. Result The Media Interface will be available when configuring a call agent, in the Configure Call Agent page, in the Media Interface selection list. Configuring the lan1_m Media Interface (p. 9) Configuring the lan1_m Media Interface Before you start Configuring the Uplink Network Interface (p. 6) must be completed. If you are not familiar with the meaning of the fields, click Show Help, located at the upper right corner of the Web page, to display field description when mousing over the field name. 1) Go to SBC > Configuration. 2) In the Media Interface Configuration table, from the Network selection list next to lan1_m, select Uplink. The Network Interfaces displayed in the Network column, are created under the Network > Interfaces page. 3) In the Port Range field, enter the port range ( ) but make sure it is not the same as the port range selected for uplink_m. 4) Click Save. 5) Click Apply to apply all changes to the configuration. 6) Click Restart required services, located at the top of the page. Result The Media Interfacewill be available when configuring a call agent, in the Configure Call Agent page in the Media Interface selection list. Configuring the Office NAT/FW (p. 10) Copyright

10 PSTN Survivability - Sentinel in the LAN with PBX Registering to Sentinel Configuring the Office NAT/FW This procedure is executed on the device that is used as the NAT/FW. 1) Set port forwarding on the public IP address for UDP/UTC protocols port 5060 to the Mediatrix Sentinel's IP address on port This allows the connection to the Mediatrix Sentinel uplink_s Signaling Interface. 2) Set port forwarding on the public IP address for UDP port to the Sentinel's IP address on port This allows the connection to the Mediatrix Sentinel uplink_m Media Interface. 3) Allow connections from the service provider's IP address to port 5060 and ports Configuring the wan_ip_trunk_ca Call Agent (p. 10) Configuring the wan_ip_trunk_ca Call Agent If you are not familiar with the meaning of the fields, click Show Help, located at the upper right corner of the Web page, to display field description when mousing over the field name. 1) Go to SBC > Configuration. 2) Select the Enable check box, located next to wan_ip_trunk_ca. 3) In the Call Agent Configuration table, click next to wan_ip_trunk_ca. 4) In the Configure Call Agent table, complete the following fields: a) From the Signaling Interface selection list, select uplink_s. b) From the Media Interface selection list, select uplink_m. c) Set the Peer Host to the IP address of the service provider server. 5) Click Save. 6) Click Apply to apply all changes to the configuration. Result No will be displayed in the Config. Modified field, indicating that the configuration that was modified is now applied to the system. When the Mediatrix Sentinel will use the selected Call Agent for a communication, the selected parameters will be applied. Configuring the lan_ip_pbx_ca Call Agent (p. 11) 10

11 PSTN Survivability Configuring the lan_ip_pbx_ca Call Agent If you are not familiar with the meaning of the fields, click Show Help, located at the upper right corner of the Web page, to display field description when mousing over the field name. 1) Go to SBC > Configuration. 2) Select the Enable check box located next to lan_ip_pbx_ca. 3) In the Call Agent Configuration table, click next to lan_ip_pbx_ca. 4) In the Configure Call Agent table, complete the fields as follows: a) From the Signaling Interface selection list, select lan1_s. b) From the Media Interface selection list, select lan1_m. c) Set the Peer Host to IP address of the IP PBX. 5) Click Save. 6) Click Apply to apply all changes to the configuration. Result No will be displayed in the Config. Modified field, indicating that the configuration that was modified is now applied to the system. When the Mediatrix Sentinel will use the selected Call Agent for a communication, the selected parameters will be applied. Configuring a Registration Agent (p. 11) Configuring a Registration Agent This procedure is only necessary if your Mediatrix Sentinel registers to the service provider. 1) Go to SBC >Registration. 2) In the Registration Agent Configuration table, click +. A new line of fields is added. 3) Complete the User Name, Friendly Name and Domain parameters fields according to the service provider's requirements. 4) In the Contact field, enter sip:user:password@public_ip. 5) If necessary repeat steps 2 to 4 if you are using more than one service provider. 6) Click Apply. Configuring the Call Agent Penalty Box (p. 12) Copyright

12 PSTN Survivability - Sentinel in the LAN with PBX Registering to Sentinel Configuring the Call Agent Penalty Box If you are not familiar with the meaning of the fields, click Show Help, located at the upper right corner of the Web page, to display field description when mousing over the field name. 1) Go to SBC/Configuration. 2) Click next to the Call Agent you wish to configure. 3) In the Configure Call Agent table, complete the fields as required. 4) Click Save. Associating Call Agent Rulesets to a Call Agent (p. 12) Associating Call Agent Rulesets to a Call Agent Before you start The Call Agents must be configured. Importing Rulesets (p. 18) must be completed. 1) Go to SBC > Configuration. Refer to Call Agent Rulesets to identify which Rulesets are associated with the Call Agents used in this Use Case. 2) From the Call Agent Configuration table, click located on the same row as the Call Agent to which you wish to associate a Ruleset. 3) In the Call Agent Rulesets table, click. 4) From the Name selection list, select a Ruleset. 5) To add other Rulesets, click. 6) Click Save. 7) In the Configure Call Agent page, click Save. 8) Click Apply to apply all changes to the configuration. Associating Routing Rulesets to Your Configuration (p. 13) Call Agent Rulesets lan_ip_pbx_ca Call Agent registrar_in 12

13 PSTN Survivability wan_ip_trunk_ca Call Agent. uac_authentication_out Remember to enter in the Parameters field USERNAME=your_username PASSWORD=your_password corresponding to the username and password used for authentication. The parameters are case sensitive and are separated by a space. rate_limit_invite_per_source_in automatic_media_relay Associating Routing Rulesets to Your Configuration Before you start Importing Rulesets (p. 18) must be completed for Routing Rulesets to be available. 1) Go to SBC > Rulesets. 2) In the Routing Rulesets table, select the Routing Rulesets you wish to apply to the configuration. 3) Click Attach. 4) Click Save. Refer to Routing Rulesets (p. 13) to identify the Rulesets that apply to this Use Case. The Configuration page is displayed. 5) Click Apply to apply all changes to the configuration. Configuring the E1/T1 Port (p. 13) Routing Rulesets lan_pbx_to_wan_ip_trunk_failover_to_trunk_dm trunk_lines_to_local_pbx_dm wan_ip_trunk_to_lan_pbx If your Sentinel Registers to the Service Provider registration_to_wan_ip_trunk Configuring the E1/T1 Port 1) Connect the E1 or T1 line to the PRI port(s). 2) Initiate the automatic Configuration. Configuring the Sentinel FXO Port (p. 14) Copyright

14 PSTN Survivability - Sentinel in the LAN with PBX Registering to Sentinel Configuring the Sentinel FXO Port Connect the telco line(s) to the FXO port(s). Configuring the Sentinel FXO Port (p. 14) Configuring the IP PBX The IP PBX server is configured with the IP address and port of the Sentinel lan1_s Signaling Interface. The Sentinel unit must be configured in the PBX as a SIP Trunk. Configure the PSTN phone number(s) to be forwarded to the PBX's IVR. Configuring Your Main Office Phones (p. 14) Configuring Your Main Office Phones 1) Set the SIP server, username and password according to the IP PBX configuration. These phones do not use the Mediatrix Sentinel to communicate with the PBX. 2) Make a call from the PSTN to the Lan. 3) Make a call from the Lan to the PSTN. Result The call signal should be routed from the PSTN to the Lan, and vice-versa. At this point, the configuration of this use case is completed. Under SBC/Registration, in the Registration Cache table, a value should be displayed in the AoR field. 14

15 Call agents Call agents Call Agents Call Agents represent logical end-points that connect the Mediatrix Sentinel to peers. For security reasons, the Mediatrix Sentinel communicates by default only with well-known and defined peers. When a request cannot be associated with a Call Agent, it is rejected. The same Call Agent can be used for inbound and outbound requests. However, in most cases, the inbound request will go through one Call Agent and the outbound request will use another Call Agent. Call Agents are then identified as the inbound Call Agent and the outbound Call Agent, indicating if the Call Agent is managing an inbound or an outbound request. Call Agents can be associated with one or several Rulesets which can be applied to the inbound or the outbound requests. A Call Agent can be assigned to Signaling and Media Interfaces which are associated to Network Interfaces. To determine the Call Agent an incoming request will go through, the Mediatrix Sentinel uses the destination IP address to choose the Network interface. Then the destination port of the inbound request will determine the Signaling Interface used. Finally, the source address and the source port, will allow the Mediatrix Sentinel to direct the request to the appropriate Call Agent. At this point any Rulesets associated with the Call Agent will be applied in order of priority. Incoming Request Destination IP address Network Interface Destination Port Signaling Interface Media Interface Source Address Incoming Call Agent Rulesets Incoming Call Agent When a request is sent out, the Routing Rulesets will determine which Call Agent will be used. Then the Call Agent Rulesets will be applied to the outbound request, in reverse priority order. The request will then be sent to the Signaling Interface associated with the Call Agent. The outbound request will be sent to the Network Interface associated with the Signaling Interface. If the public IP address is used, then the SIP request will use this address as the source IP address. The outbound request will then be sent to the peer address of the Call Agent or according to the routing Ruleset if the peer is a Network. Copyright

16 PSTN Survivability - Sentinel in the LAN with PBX Registering to Sentinel Outbound Request Routing Rulesets Outbound Call Agent Outbound Call Agent Rulesets Source Port Signaling Interface Media Interface Source IP Address Network Interface In addition, a Call Agent can initiate REGISTER requests or monitor the peer host using SIP options. When these features are activated, the Call Agent registration state and monitoring state is updated allowing a routing Ruleset to select an alternative Call Agent based on the state of a primary Call Agent. Eight default types of Call Agents were created for Mediatrix Sentinel. This should be enough to cover all your needs. However, for advanced users, it is possible to create new Call Agents. Seven default Call Agents allow the Mediatrix Sentinel to communicate with eight different types of endpoints. Call Agent Name wan_ip_trunk_ca trunk_lines_ca phone_lines_ca lan_ip_pbx_ca local_users_ca remote_users_ca registration_ca secondary_ip_trunk_ca Endpoint Type SIP server located on the WAN. Public Switch Telephony Network (PSTN), through PRI, BRI or FXO ports. Telephones, through FXS ports. IP Private branch exchange (PBX) located on the LAN. Users via SIP telephony located on the LAN. Users using SIP telephony located on the WAN. Used to manage all SBC registrations. SIP server if the wan_ip_trunk_ca Call Agent is not available. For more details on Rulesets, refer to Rulesets (p. 18). 16

17 Call agents Copyright

18 PSTN Survivability - Sentinel in the LAN with PBX Registering to Sentinel Rulesets Rulesets Rulesets define one or several rules used to filter, manipulate or route inbound or outbound requests. There are two types of Rulesets: Call Agent Rulesets : they describe how inbound or outbound requests are handled by a specific Call Agent. They can also implement services or collect data. Routing Rulesets: they are used to globally route outbound requests, i.e. that they apply to all Call Agents. When a request arrives at a Call Agent from a peer, the inbound rules of the Rulesets associated with the Call Agent are executed. Then, Routing Rulesets are executed until a Call Agent is selected for the destination. Last, the outbound rules of the Rulesets associated with the destination Call Agent are executed before sending the request to the Peer. Inbound rules of the Ruleset are executed in ascending Ruleset priority order. Outbound rules are executed in descending Ruleset priority order. The Mediatrix Sentinel is fundamentally rule driven. This means that almost all features can be activated based on certain conditions evaluated at run-time, based on parts of the signaling messages or media payload. All rules are constructed using the same pattern. They consist of a set of one or more conditions. If all conditions apply (logical conjunction), a set of one or more actions is executed. It is important to understand that rules are generally applied only on incoming or outbound requests. However, some rules have a scope that goes beyond these incoming or outbound requests. For example, header filters apply to all requests exchanged, including incoming requests. Call Agent Rulesets have an *.crs extension and Routing Rulesets use the *.rrs extension. For more details on Ruleset conditions and descriptions, refer to the Reference Guide. Importing Rulesets Before you start Rulesets must be created. This procedure is valid for Call Agent and Routing Rulesets. 1) Go to Management > File. Step 2 is only required when importing the first Ruleset and if you are not using a secure connexion to access the Management Interface ( 2) Click Activate unsecure file transfer through web browser. 3) From the Path field, select sbc/rulesets/. 4) Click Browse, and navigate to the Ruleset you wish to import. 5) Click Import. Ruleset file extension must be *.crs for Call Agent Rulesets or *.rrs for Routing Rulesets. 18

19 Rulesets Result The imported Ruleset will appear in the Internal Files table, with the selected path in front of the name. The Ruleset will be available in the tables of the SBC > Rulesets page. Call Agent Rulesets Name automatic_media_relay drop_common_scanners_in drop_register_in drop_unregistered_users_in media_relay rate_limit_invite_per_source_in rate_limit_register_per_source_in register_cache_out registrar_in registration_throttling_in reject_unregistered_users_in remote_users_behind_nat topology_hiding_out uac_authentication_out Description Media goes through the SBC except for users in the same network. Drop requests from known SIP scanners. Drop all inbound registration requests. Drop inbound requests from unregistered users. Force Media to go through the SBC. Limit call attempts per second per source IP address. Limit registration attempts per minute per source IP address. Create alias in cache for outbound registrations and restore the contact from the cache for inbound requests. Store contact locally and reply to inbound registration requests. Use different expiration for UA and registrar. Reject inbound requests from unregistered users. Handle far-end NAT for registrations and calls. Remove user-agent or server header on outbound requests. Provide authentication credentials for outbound requests. Routing Rulesets Name lan_pbx_to_remote_users lan_pbx_to_wan_ip_trunk_failover_to_second lan_pbx_to_wan_ip_trunk_failover_to_second_dm Description Route from lan_ip_pbx_ca to remote_users_ca Route from lan_ip_pbx_ca to wan_ip_trunk_ca with failover to secondary_ip_trunk_ca Route from lan_ip_pbx_cato wan_ip_trunk_cawith failover to secondary_ip_trunk_ca in demarcation set Copyright

20 PSTN Survivability - Sentinel in the LAN with PBX Registering to Sentinel Name lan_pbx_to_wan_ip_trunk_failover_to_trunk_dm local_users_to_wan_ip_trunk_failover_to_second registration_to_wan_ip_trunk_failover_to_second registration_to_wan_ip_trunk remote_users_to_lan_pbx secondary_ip_trunk_to_lan_pbx trunk_lines_to_local_pbx_dm wan_ip_trunk_to_lan_pbx Description Route from lan_ip_pbx_ca to wan_ip_trunk_ca with failover to trunk_lines_ca in demarcation setup Route from local_users_ca to wan_ip_trunk_ca with failover to secondary_ip_trunk_ca Route from registration_ca to wan_ip_trunk_ca with failover to secondary_ip_trunk_ca Route from registration_ca to wan_ip_trunk_ca Route from remote_users_ca to lan_ip_pbx_ca Route from secondary_ip_trunk_ca to lan_ip_pbx_ca Route from trunk_lines_ca to lan_ip_pbx_ca in demarcation setup Route from wan_ip_trunk_ca to lan_ip_pbx_ca 20

21 Local Firewall Local Firewall The local firewall allows you to create and configure rules to filter incoming packets that have the Mediatrix Sentinel as destination. The Local Firewall is a security feature that allows you to protect your Mediatrix Sentinel from receiving packets from unwanted or unauthorized peers. As a best practice, the way the Local Firewall should work is to by default drop all incoming packets (i.e. not forward the packet to its destination) and let incoming packets go through only if they match a rule's requirements. However, incoming packets for an IP communication established by the Mediatrix Sentinel are always accepted (Example : If the Mediatrix Sentinel sends a DNS request, the answer will be accepted). When configuring the Local Firewall, enabling the Default policy to drop all incoming packets should be the last step you perform otherwise you may lose contact with the Mediatrix Sentinel, even if you are performing the initial configuration of your system. Therefore, start by creating the rules that allow the Mediatrix Sentinel to accept some packets. This way communication will not be lost and you will not need to perform a partial or factory reset to reconnect with the Mediatrix Sentinel. Rules can be configured to accept or to decline packets. Make sure that the order in which the rules are executed does not cause a rule to be systematically excluded. For example, if the first rule excludes all packets coming from a specific net mask, providing a second rule for an IP address with that same net mask will have no effect. On the other hand if the first rule indicates actions to be taken for a specific IP address with a given net mask, and the second rule indicates to exclude all IP addresses with that net mask, both rules will be applied and have a result on the incoming packets. Of course, the more rules are enabled, the more overall performance is affected. You can use a maximum of 20 rules. Copyright

22 4229, rue de la Garlock Sherbrooke (Quebec) J1L 2C8 Canada Learn more at