Mitel MIVOICE OFFICE 250, Руководство по установке и администрированию

Страница: 467 / 585

Network IP Topology
439
• “System NAT IP Address” in System\IP Settings in DB Programming to the statically mapped
public IP address of the Processing Server.
• “NAT IP Address” in System\Devices and Feature Codes\IP Connections\<
node
>\P6000 to the
statically mapped public IP address of the Processor Module.
• “NAT IP Address” in System\Devices and Feature Codes\IP Connections\<
node
>\P6001 to the
statically mapped public IP address of the Expansion Card.
Scenario 3 – Not Recommended
The MiVoice Office 250 is in the public network with no NAT between the MiVoice Office 250 and
the SIP peer. This is not a recommended configuration for security reasons. However, if it is done,
then set the NAT Type for the SIP peer to “No NAT or SIP-Aware NAT.”
Near-End NAT/Firewall Configuration Recommendations
The following are some near-end NAT/firewall recommendations:
• Create a static mapping for the MiVoice Office 250.
• If you use an unsupported SIP-aware firewall or NAT device, you must disable peer-to-peer
traffic between any Mitel component (except the MiVoice Office 250) and the SIP trunk. All traffic
to or from the SIP trunk terminates at the MiVoice Office 250.
Firewall Configuration in MiVoice Office 250 Admin Web Portal
Security Updates
New OpenSSL Version
There is a new OpenSSL version 1.0.2l.
Firewall Improvements
Improvements have been made to the existing Firewall , including the ability to Save and Restore
settings. Firewall Configuration options have been extended to include the PS-1.
This also includes fixes for system reset/lockup issues that happen due to specific network activity.
These systems use remote IP and MiNet Phones remotely and were experiencing excessive TCP
Duplicate ACK Message storms.
Extensive port scanning applications can also lead to a high packet rate that can slow down and
freeze the system.
The programming of Firewall Rules is only available in the A dministrator Web Portal . System
defined rules are grouped by their purpose, into:
• initial_filtering
• tcp_dup_acks
• port_scanning chains