Mitel MIVOICE OFFICE 250, Руководство по установке и администрированию

Страница: 470 / 585

MiVoice Office 250 Installation and Administration Guide
442
Port Usage and Protocols
Stateful Packet Inspection (SPI) is required when a MiVoice Office 250 is placed in a non-NATed
DMZ in a Private Networking scenario and is communicating over the Internet.
A port is a form of addressing that is subordinate to IP addressing. As such, port numbers serve to
distinguish one protocol or application from another at the same IP address. For example, the primary
protocol that browsers such as Internet Explorer use to access Web pages is HTTP, and HTTP uses
port TCP 80. A single device with a single IP address can support many protocols simultaneously
by using different port numbers.
Separate sets of ports exist for Transfer Control Protocol (TCP) and User Datagram Protocol (UDP).
For port-assignment details, see “UDP Port Assignments” on page 1-444 .
Firewalls are devices used to promote network integrity and security by filtering data packets based
on IP addresses and port numbers. For example, suppose a firewall is configured to allow
communication with a Web server, which uses HTTP and TCP port 80. This configuration would
prevent the server from being accessed as a mail server, which uses SMTP and TCP port 25.
For security reasons, all ports should be disabled except those that are specifically required. The
default state for many routers is to disallow everything, but this practice varies from one manufacturer
to another.
A firewall is designed to prevent access from an untrusted network such as the Internet while allowing
communication initiated from within a trusted network. This capability is referred to as Stateful Packet
Inspection (SPI) when the firewall is configured to keep track of the state of each session.
When enabled, SPI makes the firewall remember that an outbound TCP connection was initiated
from behind the firewall and allows packets associated with this connection back through the firewall.
The port numbers listed on the following page are system defaults for the MiVoice Office 250, but
many of them are configurable by the system administrator.
Except where otherwise noted, these are ports on which the MiVoice Office 250 can listen for new
connections. The MiVoice Office 250 may also establish outbound connections with random source
ports. For proper operation, the network should not limit outbound connections from the MiVoice
Office 250 or responses to these established outbound connections.
NOTE
This appendix assumes that everything is disallowed unless specifically allowed.
IMPORTANT
If:
You use Private Networking over the Internet.
and
You have placed the MiVoice Office 250 in a non-NATed DMZ to provide port-filtering
protection from Internet threats.
Then:
In addition to opening the ports specified in
Table 74
, you must also enable SPI between
the Internet and the DMZ.