TANDBERG Border Controller User Manual Download Page 1

Page: 1 / 118

TANDBERG Border Controller

User Guide

Software version Q6.0

D13691.08

February 2008

This document is not to be reproduced in whole or in part without permission in writing from:

Summary of Contents for Border Controller

Page 1: ...TANDBERG Border Controller User Guide Software version Q6 0 D13691 08 February 2008 This document is not to be reproduced in whole or in part without permission in writing from...

Page 2: ...1 1 4 9 Accessories 11 2 Introduction 12 2 1 Main Features 12 2 2 Hardware Overview 12 3 Installation 14 3 1 Precautions 14 3 2 Preparing the Installation Site 14 3 3 Unpacking 15 3 4 Mounting 15 3 5...

Page 3: ...egistration Control 39 9 1 Setting Registration Restriction Policy 39 9 1 1 Viewing the Allow and Deny lists 39 9 1 2 Activating use of Allow or Deny lists 39 9 1 3 Managing entries in the Allow and D...

Page 4: ...8 15 Call Policy 59 15 1 About Call Policy 59 15 1 1 Uploading the CPL script 59 15 1 2 Enabling use of the CPL script 59 15 1 3 Call Policy and Authentication 59 15 1 4 CPL Standard 59 15 2 Making De...

Page 5: ...79 18 1 16 SystemUnit 79 18 1 17 Zones 80 18 2 Configuration 80 18 2 1 Authentication 80 18 2 2 Ethernet 81 18 2 3 ExternalManager 81 18 2 4 Gatekeeper 81 18 2 5 HTTP HTTPS 86 18 2 6 IP 86 18 2 7 LDAP...

Page 6: ...ete 102 18 3 32 ZoneAdd 102 18 3 33 ZoneDelete 102 18 4 History 103 18 4 1 calls 103 18 4 2 registrations 103 18 5 Feedback 104 18 5 1 Register status 104 18 5 2 Register History 104 18 5 3 Register e...

Page 7: ...e Port 113 22 1 4 ITU Standards 113 22 1 5 Security Features 113 22 1 6 System Management 113 22 1 7 Environmental Data 113 22 1 8 Physical Dimensions 113 22 1 9 Hardware MTBF 114 22 1 10 Power Supply...

Page 8: ...TANDBERG ASA assumes no responsibility or liability for any errors or inaccuracies that may appear in this document nor for any infringements of patents or other rights of third parties resulting from...

Page 9: ...ife equipment in a sound way TANDBERG products put on the market after August 2005 are marked with a crossed out wheelie bin symbol that invites you to use those take back systems Please contact your...

Page 10: ...ng Do not use liquid cleaners or aerosol cleaners Use a lint free cloth lightly moistened with water for cleaning the exterior of the apparatus Unplug the apparatus from communication lines before cle...

Page 11: ...tug the power cord If the provided plug does not fit into your outlet consult an electrician Never install cables or any peripherals without first unplugging the device from its power source 1 4 8 Se...

Page 12: ...with other Border Controllers and Gatekeepers Secure firewall traversal of any firewall or NAT Up to 100 traversal calls Can be used to control the amount of bandwidth used both within the Border Con...

Page 13: ...e Page 13 of 118 Figure 1 Front panel of Border Controller On the back of the Border Controller see Figure 2 there are a power connector a power switch a serial port Data 2 for connecting to a PC Figu...

Page 14: ...he leak The socket outlet shall be installed near to the equipment and shall be easily accessible Never install cables without first switching the power OFF This product complies with directives LVD 7...

Page 15: ...hat the mounting space is according to the Installation site preparations in section 3 2 3 Attach the brackets to the chassis on both sides of the unit 4 Insert the unit into a 19 rack and secure it w...

Page 16: ...r approximately 2 minutes you will get a login prompt none login admin Password 4 Enter the username admin and your password The default password is TANDBERG You will be prompted if you want to run th...

Page 17: ...2 6 for more information 10 To make your new settings take effect reboot the Border Controller by typing the command xCommand boot 11 Disconnect the serial cable Note To securely manage the Border Co...

Page 18: ...t not be password protected To upload the HTTPS server certificate files navigate to Border Controller Configuration Files In the Server Certificate section browse to the appropriate file s and then s...

Page 19: ...administration account with the user name admin and a password The default password is TANDBERG which you are recommended to change as soon as possible Choose a strong password particularly if admini...

Page 20: ...ll will restore your configuration 4 4 IP Configuration The Border Controller may be configured to use IPv4 IPv6 or both protocols If using both protocols the Border Controller will act as a gateway i...

Page 21: ...y frequently receive a new IP address causing unwanted registration rejections When it tries to register it may be rejected because the Border Controller still has a registration from its old IP addre...

Page 22: ...In a URI based dial plan similar behavior may be obtained by configuring neighbors with a suffix to match the desired domain name It may be desirable to have endpoints register with just the subscrib...

Page 23: ...call features such as authentication bandwidth control and policy If you do not do this endpoint behavior will vary unpredictably depending on which Alternate it is currently registered with Alternate...

Page 24: ...TANDBERG Border Controller User Guide Page 24 of 118 Figure 5 Alternate Border Controller configuration...

Page 25: ...G Border Controller User Guide Page 25 of 118 4 8 Call Processing Overview Figure 6 illustrates the process the Border Controller performs when receiving call requests Figure 6 Location decision flow...

Page 26: ...Dialing by IP address is necessary when the destination endpoint is not registered with a Gatekeeper or Border Controller If it is registered then one of the other addressing schemes should be used in...

Page 27: ...e created either using the xconfiguration Gatekeeper Transform commands or using the web interface via Border Controller Configuration Transforms and selecting Add New Transform Alias transforms suppo...

Page 28: ...ller Configuration Zones You must first select from the Match 1 Match 2 etc sections a Mode of PatternMatch in order to access the options see Figure 4 Zone transforms support the use of Regular Expre...

Page 29: ...oint by dialing its IP address or if the DNS system has been appropriately configured using an H 323 URI If URI dialing is used DNS is queried for a call signaling address and if found the call is pla...

Page 30: ...will typically set CallsToUnknownIPAddresses to Indirect on the Gatekeeper and Direct on the Border Controller This will allow endpoints registered to the gatekeeper to successfully traverse the fire...

Page 31: ...al outbound traffic to designated ports on the Border Controller and return traffic from those ports For a traversal zone using the Assent protocol the default ports are UDP 1719 TCP 2776 UDP 2776 UDP...

Page 32: ...th its account name which may be set with the command xConfiguration Zones TraversalZone 1 50 AccountName or using the Gatekeeper s web interface via Gatekeeper Configuration Traversal Zones selecting...

Page 33: ...h different bandwidth limitations In order to model this the local zone is made up of one or more subzones When an endpoint registers with the Border Controller it is assigned to a subzone based on it...

Page 34: ...nfigured using the web interface via Border Controller Configuration Links or via the command line using the following commands xConfiguration Links Link 1 100 Name xConfiguration Links Link 1 100 Nod...

Page 35: ...s you may place and receive calls to Gatekeepers you are not neighbored with see URI Dialing section 10 These Gatekeepers and any unregistered endpoints reached by dialing their IP address are placed...

Page 36: ...as follows A traversal zone is used to represent each zone containing a traversal client system e g Gatekeeper or VCS that is using this Border Controller for firewall traversal A Border Controller ca...

Page 37: ...between each of the offices Each link is then assigned two pipes representing the Internet connections of the offices at each end of the link A call placed between the Home Office and Branch Office w...

Page 38: ...re 15 may be used to control the amount of traffic flowing through the Border Controller itself Because the Gatekeeper is only managing endpoints on the LAN its configuration is simpler as shown in Fi...

Page 39: ...ses one of which matches a pattern on the Deny list that endpoint s registration will be denied Likewise if the Registration Restriction policy is set to Allow only one of the endpoint s aliases needs...

Page 40: ...only 1234567 First 7 characters are an exact match last character may be anything 123 123 followed by anything example com Anything ending with example com To add and remove entries from the Allow an...

Page 41: ...dress or use the web interface via System Configuration IP and in the Date and Time Settings section enter the IP Address or name of the NTP server you wish to use 9 2 2 Authentication using a local d...

Page 42: ...re common third party LDAP servers see Appendix B To configure the Border Controller to use the LDAP server directory during authentication either use the command line interface to issue the following...

Page 43: ...n the Border Controller and the LDAP server either issue the following command xstatus LDAP or navigate to Border Controller Configuration Authentication The server status will be shown in a panel on...

Page 44: ...the certificate of the Certificate Authority CA that issued the LDAP server with its certificate must be uploaded to the Border Controller To install the CA s certificate navigate to Border Controlle...

Page 45: ...o five DNS servers To do this either issue the following command xConfiguration IP DNS Server 1 Address address or navigate to System Configuration IP and under the DNS section enter the IP address es...

Page 46: ...ialed URI in the form user host As described in DNS Records section 10 4 several mechanisms could have been used to locate the Border Controller Depending on which was used the received URI could be i...

Page 47: ...ery for a Location SRV record to discover the authoritative Gatekeeper for the destination DNS zone 2 If is not located the Border Controller will query for a Call SRV record and try to place the call...

Page 48: ...NUM This could either be within your corporate DNS zone or could use a public ENUM database such as http www e164 org The DNS zone used for ENUM contains NAPTR records as defined by RFC 2915 7 These p...

Page 49: ...TANDBERG Border Controller User Guide Page 49 of 118 Figure 19 Setting the ENUM Zone...

Page 50: ...ord Only the value u is supported service states that this record is intended to describe E 164 to URI conversion for H 323 Its value must be E2U h323 regex describes the conversion from the given E 1...

Page 51: ...ps a home worker on an DSL connection A Border Controller is deployed on the public network to allow traversal across the firewalls Endpoints 1001 1002 may be any H 323 compliant endpoint They will us...

Page 52: ...re 21 Neighboring with an enterprise gatekeeper The TANDBERG Gatekeeper and Border Controller are configured as described in Simple Enterprise deployment section 12 1 in order to provide firewall trav...

Page 53: ...s addresses before the call can be made Each Gatekeeper and its matching Border Controller are neighbored as described in section 12 1 Border Controllers A and B are then neighbored together 12 5 URI...

Page 54: ...neighbors 12 5 2 Enabling incoming URI calls In order to be able to receive calls placed to example com using URI dialing configure the following Set example com as the domain name you are using on bo...

Page 55: ...l Like other asynchronous Border Controller commands progress information may be obtained by registering for feedback using the command xFeedback Register status calls 13 3 Transferring a Call A call...

Page 56: ...e On Off or go to Border Controller Configuration Services and in the Call Transfer section tick the Allow call transfer box see Figure 23 Figure 23 Enabling call transfer 13 4 Disconnecting a Call An...

Page 57: ...on how this is done Upon receiving the ad hoc conference request from the endpoint the Border Controller puts the two legs of the existing call on hold It then creates a unique number that will be se...

Page 58: ...ing prefix box Note This prefix will be the same on all alternates registered to the MPS MCU 4 Configure the Border Controller with the prefix it is to use for encrypted conference requests Again this...

Page 59: ...the path of the file in the CPL file field Note The CPL script cannot be uploaded via the command line interface 15 1 2 Enabling use of the CPL script To enable or disable use of the CPL script either...

Page 60: ...LRQ or ARQ that started the call If a SETUP is received without a preceding RAS message then the origin is taken from the SETUP authenticated origin The source aliases from the original LRQ or ARQ th...

Page 61: ...s it is the entire ID and for E 164 numbers it is the entire number host For URI aliases this selects the domain name part If the alias is an IP address then this subfield is the complete address in d...

Page 62: ...dress specified in the address switch was not present in the call setup message This form is most useful when authentication is being used With authentication enabled the Border Controller will only u...

Page 63: ...troller stops any further script processing and rejects the current call 15 4 Unsupported CPL Elements The Border Controller does not currently support some elements that are described in the CPL RFC...

Page 64: ...switch incoming cpl 15 5 3 Call redirection This example redirects all calls to user barney to voicemail cpl incoming address switch field destination address is barney location clear yes url barney v...

Page 65: ...ur network calling in via the gateway and then using it to make outbound calls cpl incoming address switch field origin address is MyGateway check if this is an incoming call from the ISDN gateway add...

Page 66: ...and call attempts Easily human readable For example call attempt connected disconnected registration attempt accepted rejected Level 2 Protocol Logs of protocol messages sent and received H 323 LDAP e...

Page 67: ...ocesses but will differ for messages from third party processes which are used in the Border Controller product message_details the body of the message see below for further information For all messag...

Page 68: ...nt parameter contains the H225 cause code Optionally the Detail event parameter may contain a textual representation of the H 225 additional cause code Registration Removed A registration has been rem...

Page 69: ...t of service due to an unexpected failure License Limit Reached Licensing limits for a given feature have been reached The event detail field specifies the facility limits concerned Possible values fo...

Page 70: ...al Server Communication Failure Message Sent Message Received Registration Accepted Registration Rejected Registration Removed Registration Requested Reason Textual string containing any reason inform...

Page 71: ...cation attempt As Src ip Src port Specifies the source port the IP port of the device attempting to establish communications As Src ip Src Alias If present the first H 323 Alias associated with the or...

Page 72: ...ct copies of all event logs from various systems in a single location A computer running a BSD style syslog server as defined in RFC 3164 4 may be used as the central log server Note A Border Controll...

Page 73: ...our TANDBERG representative for more information Note Configuration is restored after performing an upgrade but we recommend that you make a backup of the existing configuration using the TANDBERG Man...

Page 74: ...e system parameters After 3 4 minutes the Border Controller is ready for use 17 3 Upgrading Using SCP PSCP To upgrade using SCP or PSCP part of the PuTTY free Telnet SSH package you need to transfer t...

Page 75: ...root 10 0 0 1 tmp release key 3 Enter password when prompted 4 Copy the software image using SCP PSCP The target name must be tmp tandberg image tar gz e g scp s42100q60 tar gz root 10 0 0 1 tmp tand...

Page 76: ...status root It is possible to reduce the amount of information returned by xstatus by specifying a more detailed status command 18 1 2 Listing all status commands To list all xstatus commands availabl...

Page 77: ...dback expressions xstatus Feedback index Returns the specified feedback expression 18 1 7 IP xstatus IP Returns the active IP configuration of the system including protocol IP address subnet mask and...

Page 78: ...s link together with bandwidth currently in use 18 1 10 NTP xstatus NTP Reports the status of any connection to an NTP server 18 1 11 Options xstatus Options Reports the status of the option keys inst...

Page 79: ...al number of traversal calls since system start 18 1 15 SubZones xstatus SubZones Returns call and bandwidth information for all subzones on the system xstatus SubZones SubZone index Returns call and...

Page 80: ...1 Authentication The Authentication group of commands allow you to configure parameters relating to how an endpoint authenticates itself with the Border Controller xconfiguration Authentication Crede...

Page 81: ...onfigured a FQDN The External Manager is the remote system such as the TANDBERG Management Suite TMS used to manage endpoints and network infrastructure xconfiguration ExternalManager Path path Sets t...

Page 82: ...TANDBERG Border Controller User Guide Page 82 of 118 xconfiguration Gatekeeper CallRouted On Off Specifies whether the Border Controller should operate in call routed mode The defaults is Off...

Page 83: ...ds xconfiguration Gatekeeper DNSResolution Mode On Off Determines whether or not DNS lookup of H 323 URIs is enabled on this system The default is On xconfiguration Gatekeeper Downspeed PerCall Mode O...

Page 84: ...G Border Controller User Guide Page 84 of 118 Sets the local zone prefix of the system xconfiguration Gatekeeper Policy Mode On Off Determines whether or not the CPL policy engine is active The defaul...

Page 85: ...Specifies the pattern to be used when deciding whether or not to transform a destination alias xconfiguration Gatekeeper Transform 1 200 Priority 1 65534 Determines the order in which transforms are m...

Page 86: ...0 1 When using IPv6 addresses are entered in colon hexadecimal form 2001 db8 2AA FF FE9A 4CA2 xConfiguration IPProtocol Both IPv4 IPv6 Selects whether the Border Controller is operating in IPv4 IPv6...

Page 87: ...Address address Sets the IP address of the LDAP server to be used when making LDAP queries This can be either an IP Address or if DNS is configured a FQDN xconfiguration LDAP Server Port 1 65534 Sets...

Page 88: ...iguration can be used to discover the existing options 18 2 12 Pipes xconfiguration Pipes Pipe 1 100 Bandwidth Total Limit 1 100000000 Bandwidth associated with a pipe keyed by index xconfiguration Pi...

Page 89: ...or unencrypted conference requests xconfiguration Services AdHocConferencing Encryption Prefix prefix Specifies the prefix to be used for encrypted conference requests xConfiguration Services CallTran...

Page 90: ...ew xconfiguration SNMP SystemLocation name Used to identify the system location via SNMP tools such as TANDBERG Management Suite or HP OpenView 18 2 16 SSH xconfiguration SSH Mode On Off Enables disab...

Page 91: ...bandwidth available on the indexed subzone xconfiguration SubZones SubZone 1 100 Bandwidth PerCall Mode None Limited Unlimited Whether or not the indexed subzone is enforcing per call bandwidth restri...

Page 92: ...2 21 Traversal xconfiguration Traversal UDPProbe RetryInterval seconds Sets the interval with which a failed attempt to establish a UDP channel should be repeated xconfiguration Traversal UDPProbe Ret...

Page 93: ...cooperating to provide firewall traversal xconfiguration Zones TraversalZone 1 50 Name name Sets the name of the TANDBERG Gatekeeper which is allowed to connect to this Border Controller xconfiguratio...

Page 94: ...cifies the port on which the indexed gatekeeper is listening for RAS messages xconfiguration Zones Zone 1 100 HopCount count Specifies the hop count to be used when originating an LRQ xconfiguration Z...

Page 95: ...If set to Leave the alias will be unmodified If set to Strip the matching prefix or suffix will removed from the alias If set to Replace the matching part of the alias will be substituted for the rep...

Page 96: ...ther be a specific alias or use the wildcards for a single character and for a single character or string of characters to pattern match a group of possible aliases 18 3 3 AllowListDelete xCommand All...

Page 97: ...no level 2 parameters so setting that level has the same effect as setting level 1 Level 3 resets all level 1 and 2 parameters as well as the following IP address subnet mask gateway and interface sp...

Page 98: ...ide Page 98 of 118 18 3 12 DenyListDelete xCommand DenyListDelete index Removes the pattern with the specified index from the deny list Deny list entries can be viewed using the command xconfiguration...

Page 99: ...ns on the event or status change described by the Expression Notifications are sent in XML format to the specified URL Up to 15 Expressions may be registered for each of 3 feedback IDs The following E...

Page 100: ...cified nodes and pipes The nodes and pipes must already exist on the system 18 3 19 LinkDelete xCommand LinkDelete index Deletes the link with the specified index 18 3 20 Locate xCommand Locate alias...

Page 101: ...ddress to be in this subzone totalmode Determines whether bandwidth is controlled for this node None prevents any calls Limited imposes bandwidth limits Unlimited imposes no bandwidth limits 18 3 27 S...

Page 102: ...nes may be created The new zone is pre configured with a link to the traversal subzone and with a pattern match mode of AlwaysMatch 18 3 31 TraversalZoneDelete xCommand TraversalZoneDelete index Remov...

Page 103: ...s are added to the Call History on call completion Call histories are listed in reverse chronological order of completion time xhistory calls call index Displays data for the call with the specified i...

Page 104: ...ck commands type xfeedback To list all currently active feedback expressions type xfeedback list To register a feedback expression type xfeedback register expression To deregister the feedback express...

Page 105: ...n Unregistration Bandwidth ResourceUsage Registers for feedback on the occurrence of the specified Event Note Registering for the ResourceUsage event will return the entire ResourceUsage structure eve...

Page 106: ...ys the whole event log 18 6 4 license license Returns a list of the third party software licenses incorporated in the product license index Returns the terms of the license with the specified index 18...

Page 107: ...ased around two sets of text files named conf which describes which zones are represented by the server and a selection of zone files which describe the detail of each zone BIND is sometimes run chroo...

Page 108: ...ectory in its own organizational unit to separate out H 350 objects from other types of objects This allows access controls to be setup which only allow the Border Controller read access to the BaseDN...

Page 109: ...AP see the documentation at http www openldap org The following examples use a standard OpenLDAP installation on the Linux platform For installations on other platforms the location of the OpenLDAP co...

Page 110: ...s from other types of objects This allows access controls to be setup which only allow the Border Controller read access to the BaseDN and therefore limit access to other sections of the directory 2 A...

Page 111: ...that was used to sign the LDAP server s certificate All three files should be in PEM file format The LDAP server must be configured to use the certificate To do this edit etc openldap slapd conf and a...

Page 112: ...a range can be specified by giving the first character in the range followed by the character and then the last character in the range For example a z will match against any lower case alphabetical ch...

Page 113: ...323 DB 9 connector 2 x USB disabled 22 1 4 ITU Standards ITU T H 323 version 5 including Annex O ITU T H 460 18 H 460 19 ITU T H 235 ITU T H 350 22 1 5 Security Features IP Administration passwords Ma...

Page 114: ...show that the TANDBERG Border Controller Type number TTC2 02 complies with the following standards 22 2 1 EMC Emission Radiated Electromagnetic Interference EN55022 1994 A1 1995 A2 1997 Class A FCC R...

Page 115: ...txt 4 RFC 3164 The BSD syslog Protocol http www ietf org rfc rfc3164 txt 5 RFC 3880 Call Processing Language CPL A Language for User Control of Internet Telephony Services http www ietf org rfc rfc38...

Page 116: ...25 to determine which phone line in Lysaker External Manager The remote system that is used to manage endpoints and network infrastructure The TANDBERG Management Suite TMS is an example of an externa...

Page 117: ...Deny List 39 76 89 dial plan enforced 42 flat 21 hierarchical 21 structured 21 directory gatekeeper 21 disconnect call 90 DNS 16 23 44 47 53 76 DNS lookup 47 76 DNS zone 47 107 documentation 15 domain...

Page 118: ...9 97 remote logging 67 resetting password 19 restriction policy 76 RFC 2782 46 98 106 RFC 2915 47 49 106 RFC 3164 67 106 RFC 3761 47 106 RFC 3880 56 106 S SCP 68 69 82 84 search order 23 serial cable...

Search results

Summary of Contents for Border Controller

Reviews:

Related manuals for Border Controller

Brands by name

Popular brands

TANDBERG Border Controller, User Manual

Search results

Summary of Contents for Border Controller

Reviews:

Related manuals for Border Controller

Brands by name

Popular brands