Nortel SMC 2450, Руководство по внедрению

Страница: 138 / 262

Page 138 of 260 Secure UNIStim deployment
553-3001-225 Standard 1.00 May 2006
The following section explains why Secure UNISTIM reregistration can be
delayed and how to speed the process up.
When an insecure IP Client is rebooted, it goes through the following process:
1 The phone communicates to the CSE Node IP address on port 4100.
2 The Node TPS redirects the IP Client to either:
• the TLAN IP of the same Node TPS
• another TPS device TLAN address (load balancing process)
3 The IP Client communicates to the TPS TLAN IP at the supplied address
on port 7300
4 After registration completes, the IP client communicates to the same TPS
as step 3 on TLAN IP port 5100
The IP Client is now registered and ready to operate.
Note: The 4100/7300/5100 port numbers are factory default.
When secure UNIStim is disabled and phones are operating normally, the
phones operate in the final state, as identified in step 4.
When security is enabled, the SMC firewall is designed to do the following
for both secure and insecure IP Clients:
• recognize that an IP Client is communicating to the CSE Node address
on port 4100. During the configuration of the Secure Unistim feature on
the SMC, the TPS server IP address is provided.
• watch IP client communications move to the assigned TPS TLAN
address using port 7300
• watch the IP client finish registration on port 5100
• track this activity using a firewall-based client table
When secure unistim is enabled on the SMC, the phones are most likely still
in step 4; therefore, the firewall does not get the opportunity to track the IP
client through the registration process.