Avaya Hosted IP Telephony R3.0 Solution LSP
Configuration with the Juniper VF 3000 SBC – Issue 1.0
Abstract
These Application Notes describe the configuration of Avaya Communication Manager,
Juniper NetScreen Firewall and Juniper VF 3000 Session Border Controller (SBC) and other
network components in an Avaya Hosted IP Telephony R3.0 Local Survivable Processor
(LSP) environment. These Application Notes were written at the request of the Avaya Hosted
Solutions team.
TC; Reviewed:
PV 04/24/2006
Avaya – Proprietary
Use as authorized only pursuant to your signed agreement or
Avaya policy. No other disclosure is permitted or authorized.
Use as authorized only pursuant to your signed agreement or
Avaya policy. No other disclosure is permitted or authorized.
2 of 61
HT3-LSP-VF.doc
1. Introduction
These Application notes provide instructions on how to configure Local Survivable Processor
(LSP) with the Juniper VF 3000 SBC in an Avaya Hosted IP Telephony (HIPT) R3.0 Solution
Environment. The solution described in this document requires the addition of an extra network
element, a Network Address Translation (NAT) device at the edge of the service provider’s data
center if customers with LSPs are to be supported. This document covers the configuration of
the NAT device, as well as the other components of the solution.
2. Background
2.1. On Demand Solutions
The Session Border Controller (SBC) function is an essential component of the two Avaya On
Demand/Hosted offers. The base offers for the Avaya HIPT R3.0/3.1 and Hosted Contact Center
(HCC) R3.0 will make use of the Juniper VF 3000 SBC from the Juniper VF-Series product line.
The Juniper VF 3000 SBC provides the Application Layer Gateway (ALG) and Network
Address Translation (NAT) functions for the Avaya VoIP network components. The Juniper VF
3000 SBC is deployed at the service provider’s data center and is shared amongst multiple
enterprise customers. The Juniper VF 3000 SBC segregates incoming traffic from different
customers and forwards the traffic to the associated Avaya Communication Manager. All
communication from components (i.e. endpoints, and media gateways) that passes through the
Juniper VF 3000 SBC will appear to Avaya Communication Manager as having a Juniper VF
3000 SBC IP address. These components also see Avaya Communication Manager as having a
Juniper VF 3000 SBC IP address. The Juniper VF 3000 SBC acts as a proxy in both directions.
The side of the Juniper VF 3000 SBC that is exposed to the Wide Area Network (WAN) is often
referred to as the “outside” interface – the untrusted side. The other side, the “inside” interface,
is the trusted side and is exposed to Avaya Communication Manager and the data center
network.
Figure 1 shows the high-level network architecture for a typical Avaya On Demand/Hosted
solution. The data center is owned and operated by the service provider. In this case the hosts in
the data center are in a private address space owned and managed by the service provider. The
individual customer networks include Avaya G250, G350 and G700 H.248 Media Gateways and
H.323 phones at the enterprise sites. The media gateways may include a Local Survivable
Processor (LSP) to support local survivability. The enterprise site is characterized by a private
IP address space owned and managed by the enterprise customer. Although not shown in the
diagram, each enterprise customer could have multiple, diversely located sites, any or all of
which may have MGs and LSPs in addition to endpoints. The IP address spaces in these sites are
independent, and could overlap. Transport between the enterprise sites and the data center in this
example occurs over the public addressed WAN. A NAT function is therefore required at the
TC; Reviewed:
PV 04/24/2006
Avaya – Proprietary
Use as authorized only pursuant to your signed agreement or
Avaya policy. No other disclosure is permitted or authorized.
3 of 61
HT3-LSP-VF.doc
data center edge and at the edge of each enterprise site. Note that the Juniper VF 3000 SBC can
provide this NAT function.
Figure 1 - Private-Public-Private Architecture
Another method for WAN connectivity between the enterprise sites and the data center is via a
VPN configuration. Figure 2 illustrates this case. The Juniper VF 3000 SBC here must support
private-private NAT functionality, where the data center equipment is in a private IP address
space and the customer also uses a private IP address space. In this architecture, all the
enterprise customer’s sites, as well as the VPN that interconnects and extends to the edge of the
data center, are part of one private IP address space.
Next to the data center, the WAN edge router maps the incoming VPN traffic from the WAN
into an 802.1Q trunk. Each VPN maps to a different VLAN. Note that each VPN belongs to a
TC; Reviewed:
PV 04/24/2006
Use as authorized only pursuant to your signed agreement or
Avaya policy. No other disclosure is permitted or authorized.
Avaya – Proprietary
4 of 61
HT3-LSP-VF.doc
different enterprise customer. The Juniper VF 3000 SBC in the data center can make use of this
VLAN information to resolve overlapping IP address issues
1
. The Juniper VF 3000 SBC
segregates the access traffic into separate customer streams and routes the traffic to the
respective Avaya Communication Managers based on the destination IP address. Figure 2 shows
only one enterprise network containing only a single site, but multiple sites (and multiple
enterprises using multiple Avaya Communication Manager instances) should be considered the
norm.
Figure 2 - Private-Private Architecture
Initial deployments of the Avaya On Demand/Hosted solutions using the Juniper VF 3000 SBC
will use the architectures specified in Figure 1 or Figure 2. However, there is a third
1
Different enterprises could use overlapping IP private addresses.
TC; Reviewed:
PV 04/24/2006
Use as authorized only pursuant to your signed agreement or
Avaya policy. No other disclosure is permitted or authorized.
Avaya – Proprietary
5 of 61
HT3-LSP-VF.doc
architecture that may occur. This is similar to Figure 1, except that the data center uses public
IP addressing. There is no need for a NAT function between the WAN and the data center in this
case.
2.2. Including LSPs in the Solution
The Juniper VF 3000 SBC proxies the VoIP traffic for the components located at the enterprise
sites and presents all the VoIP traffic to the Avaya Communication Manager with the same IP
address – that of the Juniper VF 3000 SBC inside interface. The Juniper VF 3000 SBC maps all
enterprise IP addresses to this one IP address, and uses different transport layer port numbers to
distinguish between each IP address. The Juniper VF 3000 SBC is not capable of using multiple
inside IP addresses. This means that if all the LSPs in a given enterprise network are presented
to Avaya Communication Manager through the Juniper VF 3000 SBC, the LSPs will all have the
same IP address. However, Avaya Communication Manager is not designed to distinguish LSPs
by port number – but only by unique IP addresses. Therefore, with the current releases of Juniper
VF 3000 SBC and Avaya Communication Manager using the architectures shown in Figures 1-2, LSP registration must bypass the Juniper VF 3000 SBC.
An Avaya Communication Manager Green feature (“SA8853 – Support of LSPs behind NAT”)
has been developed to allow the registration of LSPs to Avaya Communication Manager in a
way that does not require the ALG function of the Juniper VF 3000 SBC. Figure 3 depicts the
solution architecture when applied to the architecture shown in Figure 1. Note that a separate
NAT/FW device (FW is firewall) has been added to the edge of the data center for LSP-related
traffic only. Also, the NAT function for the LSP in the enterprise site is being handled differently
than for the other components there. A static NAT entry is needed for each LSP.
TC; Reviewed:
PV 04/24/2006
Avaya – Proprietary
Use as authorized only pursuant to your signed agreement or
Avaya policy. No other disclosure is permitted or authorized.
6 of 61
HT3-LSP-VF.doc
Figure 3 - Supporting LSPs in the Private-Public-Private Architecture
Figure 4 shows the architecture for a corresponding solution applied to the architecture of
Figure 2. As in Figure 3, an extra NAT/FW device has been placed at the data center edge. This
FW device must be VLAN supported in order to support overlapping address spaces for different
LSPs in different enterprises. However, unlike Figure 3, no changes are needed to the equipment
at the edge of the enterprise site since there is no change in address space at that point.
TC; Reviewed:
PV 04/24/2006
Use as authorized only pursuant to your signed agreement or
Avaya policy. No other disclosure is permitted or authorized.
Avaya – Proprietary
7 of 61
HT3-LSP-VF.doc
Figure 4 - Supporting LSPs in the Private-Private Architecture
3. Configuration Overview
This section gives a high-level overview of how to configure enterprise sites and data center
networks and how to administer the Avaya Communication Manager servers and LSPs for LSP
functionality to work in HIPT R3.0/3.1 and HCC R3.0 solutions. The basic configuration of the
solution without LSPs is assumed to already be in place. The remainder of this document will
provide the details for what is summarized here for the private-public-private and private-private
architectures. (The private-public-public architecture is expected to work as well, but has not
been certified.)
TC; Reviewed:
PV 04/24/2006
Use as authorized only pursuant to your signed agreement or
Avaya policy. No other disclosure is permitted or authorized.
Avaya – Proprietary
8 of 61
HT3-LSP-VF.doc
3.1. Private-Public-Private Architecture
In order to build components in Figure 3 use the following:
Enterprise site network configuration:
• On the FW/NAT device, configure a static 1-to-1 NAT mapping for each LSP.
Data center network configuration:
• Add a FW/NAT device, if one is not yet present. On the NAT device, configure static 1-
to-1 NAT mapping for each C-LAN/PE
2
IP address.
• On the Juniper VF 3000 SBC, for each VF 3000 Session Routing Policy (SRP) used by a
set of IP phones, configure the native IP address of each LSP.
Avaya Communication Manager server administration:
• SA8853 Support of LSPs Behind Nat Green feature must be installed.
• Add two IP node names for each LSP, one for the statically mapped NAT WAN IP
address of each enterprise LSP and the other for its native private IP address.
• Administer the “lsp” form with the statically mapped NAT WAN IP address of each LSP.
• Administer the LSP list on the “ip-network-region” form, page 2 with the native (private)
IP address of each LSP.
LSP configuration:
• Enter the corresponding NAT WAN IP addresses of Avaya Communication Manager
servers/C-LANs/PEs in the “primary controller” and “C-LAN IP address of the primary
controller” fields on the LSP configuration web page.
3.2. Private-Private Architecture
In order to build components in Figure 4 use the following:
Enterprise site network configuration:
• None.
Data center network configuration:
• Add a VLAN supported FW/NAT device, if one is not yet present. On the FW/NAT
device, set up static NAT mappings so that enterprise site address space is converted to
data center address space, and vice versa, for IP addresses of LSPs in enterprise sites
address spaces and CM servers/C-LANs/PEs in the data center address space.
• On the Juniper VF 3000 SBC, for each VF session routing policy (SRP) used by a set of
IP phones, configure the native IP address of each LSP.
2
PE is an acronym for Processor Ethernet, an interface to CM that was formerly known as PC-LAN.
TC; Reviewed:
PV 04/24/2006
Use as authorized only pursuant to your signed agreement or
Avaya policy. No other disclosure is permitted or authorized.
Avaya – Proprietary
9 of 61
HT3-LSP-VF.doc
Avaya Communication Manager server administration:
• SA8853 Support of LSPs Behind NAT Green feature must be installed.
• Add two IP node names for each LSP, one for the statically mapped NAT IP address in
the data center IP address space of each enterprise LSP and the other for its native private
IP address.
• Administer the “lsp” form with the statically mapped NAT IP address in the data center
address space of each LSP.
• Administer the LSP list on the “ip-network-region” form, page 2 with the native (private)
IP address of each LSP.
LSP configuration:
• Enter the corresponding IP addresses of Avaya Communication Manager servers/C-
LANs/PEs in the enterprise site IP address space in the “primary controller” and “C-LAN
IP address of the primary controller” fields on the LSP configuration web page.
3.3. Private-Public-Public architecture
Note: This configuration was not validated.
Enterprise site network configuration:
• On the FW/NAT device, configure static 1-to-1 mapping for each LSP.
Data center network configuration:
• Provide a firewall to allow LSP registration and filesync traffic to pass (or reconfigure an
existing firewall).
• On the Juniper VF 3000 SBC, for each VF 3000 Session Routing Policy (SRP) used by a
set of IP phones, configure the native IP address of each LSP.
Avaya Communication Manager server administration:
• SA8853 Support of LSPs Behind Nat Green feature must be installed.
• Add two IP node names for each LSP. One for the statically mapped NAT WAN IP
address of each enterprise LSP and the other for its native private IP address.
• Administer the “lsp” form with the statically mapped NAT WAN IP address of each LSP.
• Administer the LSP list on the “ip-network-region” form, page 2 with the native (private)
IP address of each LSP.
LSP configuration:
• No change from traditional LSP configuration. Enter the corresponding IP addresses of
CM servers/C-LANs/PEs in the “primary controller” and “C-LAN IP address of the
primary controller” fields.
TC; Reviewed:
PV 04/24/2006
Avaya – Proprietary
Use as authorized only pursuant to your signed agreement or
Avaya policy. No other disclosure is permitted or authorized.
10 of 61
HT3-LSP-VF.doc
4. Equipment and Software Validated
This application note details one way to set up the LSP solution. The table below provides the
versions used in the verification of the described configurations.
Equipment Version
Avaya S8300B Media Servers (LSPs) HW4 FW 1
Avaya G650 Media Gateway
Software Version
Avaya IP SoftPhone 5.2.3.6
Avaya Communication Manager 3.0.1 (load 346)
Microsoft DHCP Server Windows 2000 (SP4)
Checkpoint Firewall-1 (NG with Application Intelligence) R55 091
Avaya Integrated Management 3.0
IBM Director 4.2
Avaya Hosted Solution Element Manager (HSEM) 1.0
Table 2: Avaya Hosted IP Telephony Software
TC; Reviewed:
PV 04/24/2006
Use as authorized only pursuant to your signed agreement or
Avaya policy. No other disclosure is permitted or authorized.
Avaya – Proprietary
15
21
93
4.1.4
24.21
54
13
24.21
13
Patch (Red Feature)
11 of 61
HT3-LSP-VF.doc
5. Avaya HIPT R3.0 Environment
The overview of the HIPT R3.0 solution with LSP Support is shown in Figure 5.
Use as authorized only pursuant to your signed agreement or
Avaya policy. No other disclosure is permitted or authorized.
12 of 61
HT3-LSP-VF.doc
5.1. Service Provider Data Center
The Data Center simulates two customers, PC-LAN (Private-Private) and C-LAN (PrivatePublic-Private). These customers each have their own image of Avaya Communication Manager.
These Avaya Communication Manager images both run on the same blade (HT1) in the Avaya
SBS3000 environment. The Data Center is privately addressed.
The PC-LAN based Avaya Communication Manager image has VPN based enterprise sites (A1
and A2).
The C-LAN based Avaya Communication Manager image has NAT based enterprise sites (B1
and B2).
One LSP is configured for each customer site. To configure additional LSP enterprise sites refer
to Section 6.1 for PC-LAN configuration and Section 6.2 for G650/C-LAN configuration.
The Data Center contains a network based Juniper VF 3000 SBC Session Border Controller. The
Juniper VF 3000 SBC provides H.323 and H.248 NAT processing to the WAN. The Juniper VF
3000 SBC also provides firewall functionality.
The Data Center also contains a Juniper NetScreen-25 Firewall VLAN supported device. The
NetScreen-25 Firewall provides NAT processing and firewall functionality to the WAN for the
LSP Solution.
5.2. MPLS Core
An MPLS core WAN network is used between the Data Center and the Enterprise sites. The
MPLS core network is composed of Cisco routers. MPLS IP VPNs are configured between the
Data Center and enterprise sites.
5.3. Customer Enterprise Sites
The Distributed Service Model enterprise sites access the Data Center via a public WAN. The
remote sites use local private IP addressing. The enterprise sites may use either private-to-private
VPN tunnels, or private-to-public NAT addressing, to access the Data Center via the public
WAN.
All of the enterprise sites contain a Checkpoint firewall for security. The Checkpoint also
provides IP NAT functionality for those sites that use private-to-public NAT addressing to
access the Data Center.
Enterprise sites contain Avaya Media Gateways with Local Survivable Processors (LSPs). Local
Survivable Processors (LSPs) provide local IP telephony in case connectivity to Avaya
TC; Reviewed:
PV 04/24/2006
Avaya – Proprietary
Use as authorized only pursuant to your signed agreement or
Avaya policy. No other disclosure is permitted or authorized.
13 of 61
HT3-LSP-VF.doc
Communication Manager in the Data Center is lost. All enterprise Local Survivable Processors
(LSPs) will achieve registration and File Sync via the data center NetScreen-25 Firewall device
to the appropriate Avaya Communication Manager image in the Data Center.
All enterprise site IP telephones register to the Juniper VF 3000 SBC in the Data Center (which
forwards the registration requests on to the appropriate Avaya Communication Manager image).
5.3.1. PC-LAN based (Private-Private) Avaya Communication Manager
Customer HTSITEB has remote enterprise sites (A1 and A2). These sites use local private
addressing, contain Avaya IP Telephones, and contain Avaya Media Gateways for local VoIP
resources. These sites will access the Data Center via a private-to-private VPN tunnel over the
WAN.
5.3.2. G650/C-LAN based (Private-Public-Private) Avaya Communication
Manager
Customer HTG650 has remote enterprise sites (B1 and B2). These sites use local private
addressing, contain Avaya IP Telephones, and contain Avaya Media Gateways for local VoIP
resources. These sites will access the Data Center via private-to-public NAT provided by the
Checkpoint firewall.
TC; Reviewed:
PV 04/24/2006
Avaya – Proprietary
Use as authorized only pursuant to your signed agreement or
Avaya policy. No other disclosure is permitted or authorized.
14 of 61
HT3-LSP-VF.doc
6. Avaya Hosted IP Telephony Release 3.0 LSP Configuration
6.1. PC-LAN Configuration (Private-Private)
6.1.1. Configure Avaya Communication Manager
The following Avaya Communication Manager provisioning is required to support the LSP
Configuration. This provisioning is performed via the SAT interface. In the following example,
the Avaya Communication Manager for LSP support is provisioned for site A1. Refer to [3] for
additional configuration information for Avaya Communication manager.
6.1.1.1. License Avaya Communication Manager
Avaya Communication Manager must be licensed to enable the special application “SA8853
Support of LSPs behind NAT”.
Step 1. Use the “change system-parameters special-applications” command to enable the
special application “SA8853 Support of LSPs behind NAT”. Select Esc-n to page for SA8853,
select y and submit the changes as shown in Figure 6.
Figure 6
Note: If this feature is installed as a patch (red feature) the feature will not show up on the Avaya
Communication Manager SA form as shown above. In a subsequent GA release, the feature
(green feature) will be part of the SA form, which can be enabled based on licensing.
TC; Reviewed:
PV 04/24/2006
Use as authorized only pursuant to your signed agreement or
Avaya policy. No other disclosure is permitted or authorized.
Avaya – Proprietary
15 of 61
HT3-LSP-VF.doc
6.1.1.2. Configure Avaya Communication Manager for LSP Support
Step 1. Use the “change node-names ip” command to add the name and IP Address of the LSP
Native IP Address and static 1-to-1 NAT LSP IP address configured in the NetScreen-25
Firewall (Figure 20) to the node-names form shown in Figure 7. Submit the changes.
Figure 7
TC; Reviewed:
PV 04/24/2006
Avaya – Proprietary
Use as authorized only pursuant to your signed agreement or
Avaya policy. No other disclosure is permitted or authorized.
16 of 61
HT3-LSP-VF.doc
Step 2. Use the “change ip-network-region <region number>” command to add the LSP Native
IP Address to the appropriate Network Region shown in Figure 8. Submit the changes.
Figure 8
Step 3. Use the “change lsp” command to add the static 1-to-1 LSP IP address configured in the
NetScreen-25 Firewall (Figure 20) to the LSP form shown in Figure 9. Submit the changes.
TC; Reviewed:
PV 04/24/2006
Figure 9
Avaya – Proprietary
Use as authorized only pursuant to your signed agreement or
Avaya policy. No other disclosure is permitted or authorized.
17 of 61
HT3-LSP-VF.doc
6.1.2. Configure Avaya Local Survivable Processors (LSP)
Local Survivable Processors (LSP) are normally configured to register directly to Avaya
Communication Manager. In the Avaya Hosted IP Telephony environment, the LSPs must be
provisioned to register to Avaya Communication Manager via the static 1-to-1 NAT IP address
of the NetScreen-25 Firewall (Figure 18) serving the VPN enterprise site. This provisioning is
performed via the LSP web GUI interface. In the following example, the LSP for site A1 is
provisioned. Each LSP must be licensed to enable the special application “SA8853 Support of
LSPs behind NAT”. Refer to section 6.1.1.1 for instructions on the configuration.
1. Connect to the services port of the LSP and log into the web GUI.
2. From the GUI select “Launch Maintenance Web Interface”.
3. From the Maintenance page select “Configure Server” from the menu in the left hand
column.
4. Select “Continue”, and then “Continue” again.
5. Select “Configure Individual Services” and select “Continue”.
6. Select “Configure LSP” and the window shown in Figure 10 will open.
TC; Reviewed:
PV 04/24/2006
Avaya – Proprietary
Use as authorized only pursuant to your signed agreement or
Avaya policy. No other disclosure is permitted or authorized.
18 of 61
HT3-LSP-VF.doc
Figure 10 - LSP Configuration Web Page
7.Select “This is a local survivable processor with a Blade server as the primary
controller”. This option was selected for the Avaya SBS3000 shared blade server.
8.In the “CLAN IP address of the primary controller” and “Primary controller’s IP
address” fields, enter the IP address of the data center NetScreen-25 Firewall Untrusted side
Static 1-to-1 NAT IP address. In this example, the LSP is associated with IP address
101.2.15.101, which is the NAT IP address for the Avaya Communication Manager in the
Data Center and associated with Customer A1 VPN site.
TC; Reviewed:
PV 04/24/2006
Use as authorized only pursuant to your signed agreement or
Avaya policy. No other disclosure is permitted or authorized.
Avaya – Proprietary
HT3-LSP-VF.doc
19 of 61
Loading...
+ 42 hidden pages
You need points to download manuals.
1 point = 1 manual.
You can buy points or you can get point for every manual you upload.