HP 3Com Telecommuting Module Administrator's Guide

3Com® Telecommuting Module

User Manual

Version 4.6.5

3Com® Telecommuting Module User Manual: Version 4.6.5

Part Number BETA Published April 2009

3Com Corporation, 350 Campus Drive, Marlborough MA 01752-3064

Copyright © 2005, 3Com Corporation. All rights reserved. No part of this documentation may be reproduced in any form or by any means or used to make any derivative work (such as translation, transformation, or adaptation) without written permission from 3Com Corporation. 3Com Corporation reserves the right to revise this documentation and to make changes in content from time to time without obligation on the part of 3Com Corporation to provide notiﬁcation of such revision or change. 3Com Corporation provides this documentation without warranty, term, or condition of any kind, either implied or expressed, including, but not limited to, the implied warranties, terms, or conditions of merchantability, satisfactory quality, and ﬁtness for a particular purpose. 3Com may make improvements or changes in the product(s) and/or the program(s) described in this documentation at any time. If there is any software on removable media described in this documentation, it is furnished under a license agreement included with the product as a separate document, in the hardcopy documentation, or on the removable media in a directory ﬁle named LICENSE.TXT or !LICENSE.TXT. If you are unable to locate a copy, please contact 3Com and a copy will be provided to you.

UNITED STATES GOVERNMENT LEGEND

If you are a United States government agency, then this documentation and the software described herein are

provided to you subject to the following:

All technical data and computer software are commercial in nature and developed solely at private expense. Software is delivered as "Commercial Computer Software" as deﬁned in DFARS 252.227-7014 (June 1995) or as a "commercial item" as deﬁned in FAR 2.101(a) and as such is provided with only such rights as are provided in 3Com’s standard commercial license for the Software. Technical data is provided with limited rights only as provided in DFAR 252.227-7015 (Nov 1995) or FAR 52.227-14 (June 1987), whichever is applicable. You agree not to remove or deface any portion of any legend provided on any licensed program or documentation contained in, or delivered to you in conjunction with, this guide. Unless otherwise indicated, 3Com registered trademarks are registered in the United States and may or may not be registered in other countries. 3Com, the 3Com logo, NBX, and SuperStack are registered trademarks of 3Com Corporation. NBX NetSet, pcXset, and VCX are trademarks of 3Com Corporation. Adobe is a trademark and Adobe Acrobat is a registered trademark of Adobe Systems Incorporated. Microsoft, Windows, Windows 2000, Windows NT, and Microsoft Word are registered trademarks of Microsoft Corporation. All other company and product names may be trademarks of the respective companies with which they are associated.

Chapter 1. Introduction to 3Com VCX IP Telecommuting Module

Some of the functions of 3Com VCX IP Telecommuting Module are:

• SIP proxy: Forwarding of SIP requests.

• SIP registrar: Registration of SIP users.

• Protection against such attacks as address spooﬁng.

• Logging/alarm locally on the Telecommuting Module, via email and/or via syslog.

• Managing several logical/directly-connected networks and several network connec-

tions/physical networks.

• Administration of the Telecommuting Module through a web browser using http or https.

• QoS - bandwidth limitation and trafﬁc prioritizing (using the QoS module).

• Failover - connect two Telecommuting Modules in parallel; one handles trafﬁc and the

other acts as a hot standby.

• STUN server and Remote SIP Connectivity for SIP clients behind NAT boxes which are

not SIP aware (using the Remote SIP Connectivity module).

Note that some of the functions mentioned here are only available if the corresponding extension module has been installed.

What is a Telecommuting Module?

A Telecommuting Module is a device which processes trafﬁc under the SIP protocol (see RFC 3261). The Telecommuting Module receives SIP requests, processes them according to the rules you have set up, and forwards them to the receiver.

The Telecommuting Module connects to an existing enterprise ﬁrewall through a DMZ port, enabling the transmission of SIP-based communications without affecting ﬁrewall security. SIP messages are then routed through the ﬁrewall to the private IP addresses of authorized users on the internal network.

The Telecommuting Module can also be used as an extra gateway to the internal network without connecting to the ﬁrewall, transmitting only SIP-based communications.

Conﬁguration alternatives

The 3Com VCX IP Telecommuting Module can be connected to your network in three different ways, depending on your needs.

Note that if the Standalone type is used, the interface which should receive trafﬁc from the outside must have a public IP address (no NAT).

1

Chapter 1. Introduction to 3Com VCX IP Telecommuting Module

For a DMZ or DMZ/LAN type which uses a private IP address on the interface connected to the DMZ of the ﬁrewall, its corresponding public IP address must be entered on the Interoperability page.

DMZ Conﬁguration

Using this conﬁguration, the Telecommuting Module is located on the DMZ of your ﬁrewall, and connected to it with only one interface. The SIP trafﬁc ﬁnds its way to the Telecommuting Module using DNS or by setting the Telecommuting Module as an outbound proxy on the clients.

This is the most secure conﬁguration, since all trafﬁc goes through both your ﬁrewall and your Telecommuting Module. It is also the most ﬂexible, since all networks connected to any of your ﬁrewall’s interfaces can be SIP-enabled.

The drawback is that the SIP trafﬁc will pass the ﬁrewall twice, which can decrease performance.

Fig 1. Telecommuting Module in DMZ conﬁguration.

DMZ/LAN Conﬁguration

Using this conﬁguration, the Telecommuting Module is located on the DMZ of your ﬁrewall, and connected to it with one of the interfaces. The other interfaces are connected to your internal networks. The Telecommuting Module can handle several networks on the internal interface even if they are hidden behind routers.

This conﬁguration is used to enhance the data throughput, since the trafﬁc only needs to pass your ﬁrewall once.

Fig 2. Telecommuting Module in DMZ/LAN conﬁguration.

2

Chapter 1. Introduction to 3Com VCX IP Telecommuting Module

Standalone Conﬁguration

Using this conﬁguration, the Telecommuting Module is connected to the outside on one interface and your internal networks on the others.

Use this conﬁguration only if your ﬁrewall lacks a DMZ interface, or for some other reason cannot be conﬁgured for the DMZ or DMZ/LAN alternatives.

Fig 3. Telecommuting Module in Standalone conﬁguration.

Quick guide to 3Com VCX IP Telecommuting Module installation

3Com VCX IP Telecommuting Module is easy to install:

• Select an IP address for the Telecommuting Module on your network.

• The network interfaces are marked with 1 and 2. These numbers correspond to the physi-

cal interfaces eth0 and eth1 respectively, the latter which should be use in the installation program.

• Plug in the power cord and turn on the Telecommuting Module.

• Wait while the Telecommuting Module boots up.

• Connect the network cables to the network interfaces.

• Connect a monitor and a keyboard to the Telecommuting Module.

• Log in as admin. No password is needed the ﬁrst time you log in.

• Run the installation script, where you assign IP address, conﬁguration computers and

password.

• Direct your web browser to the IP address of the Telecommuting Module.

• Now you can see the main page of 3Com VCX IP Telecommuting Module. Click on the

Telecommuting Module Type link and select the conﬁguration for your Telecommuting Module. The types are described on the corresponding help page.

• Go to the Basic Conﬁguration page and enter a DNS server. See also the Basic Conﬁg-

uration section.

• Go to the Access Control page and make settings for the conﬁguration of the Telecom-

muting Module. See also the Access Control section.

3

Chapter 1. Introduction to 3Com VCX IP Telecommuting Module

• Go to the Network Interface 1 page under Network Conﬁguration and enter the neces-

sary conﬁguration. See also the Interface section. Note that the Telecommuting Module must have at least one IP address which can be reached from the Internet.

• If one of the Telecommuting Module Types DMZ/LAN or Standalone was chosen, move

on to the Network Interface 2 page and give the Telecommuting Module at least one IP address on this interface and state the networks connected to the interface. See also the Interface section.

• Go to the Default Gateway page and enter a Default gateway. See also the Default

Gateway section.

• Go to the Networks and Computers page. Deﬁne the networks that will send and receive

SIP trafﬁc using the Telecommuting Module. Usually, you need at least one network per interface of the ﬁrewall connected to the Telecommuting Module (or, for the Standalone type, per interface of the Telecommuting Module). Some computers should be handled separately, and they therefore need their own networks. See also the Networks and Computers section.

• Go to the Surroundings page (for the DMZ Telecommuting Module Type) and state the

networks connected to the ﬁrewall. See also the Surroundings section in the chapter titled Network Conﬁguration.

• Go to Basic Settings under SIP Services and switch the SIP module on. Enter the port

range to be used by the Telecommuting Module for the media streams. See also the Basic Settings section.

• Go to the Filtering page under SIP Trafﬁc to create Proxy rules for the SIP trafﬁc from

different networks and allow the content types which should be allowed in the SIP media streams. See also the Filtering section.

• Go to the Interoperability page. Set URI Encoding to "Keep username in URIs".

• Go to the Save/Load Conﬁguration page under Administration. Select Apply conﬁgu-

ration. Now you can test your new conﬁguration and save it permanently if you are satisﬁed with it. If the conﬁguration is not satisfactory, select Revert or restart the Telecommuting Module. The old conﬁguration will remain.

• When the conﬁguration has been applied, you should save a backup to ﬁle. Press Save to

local ﬁle to save the conﬁguration.

When the Telecommuting Module is conﬁgured, the ﬁrewall connected to it must also be reconﬁgured (for the DMZ and DMZ/LAN Telecommuting Module Types).

• Allow UDP and TCP trafﬁc in the port interval used for media streams by the Telecom-

muting Module, and port 5060. This trafﬁc must be allowed to all networks which should be reached by SIP trafﬁc.

See also the chapter titled Firewall and Client Conﬁguration, for information on conﬁguring the ﬁrewall and the SIP clients.

4

Chapter 1. Introduction to 3Com VCX IP Telecommuting Module

About settings in 3Com VCX IP Telecommuting Module

3Com VCX IP Telecommuting Module uses two sets of Telecommuting Module conﬁgurations: preliminary and permanent conﬁguration. The permanent conﬁguration is what is used in the active Telecommuting Module. The preliminary conﬁguration is where you change and set the conﬁguration. See chapter 3, Conﬁguring 3Com VCX IP Telecommuting Module, for instructions.

The changes you make in the preliminary conﬁguration are not stored in the permanent conﬁguration until you click on Apply conﬁguration on the Save/Load Conﬁguration page under Administration.

The password conﬁguration and time setting are the exceptions to this rule; they are saved immediately. Change the administrator passwords and create more administrator users on the User Administration page under Administration.

3Com VCX IP Telecommuting Module displays serious errors in red, e.g., if mandatory information is not entered. Blank ﬁelds are shown in red. Fields that you correct remain red until you select Save, Add new rows or update the page in some other way.

If you have a web connection with the Telecommuting Module that is inactive for 10 minutes, it will ask for a password again.

Always log out from the Telecommuting Module administration interface when you are not using it. Press the Log out button on the left to log out.

The terms used in the book are explained in appendix D, Deﬁnitions of Terms. For a general description of how to conﬁgure and administer the Telecommuting Module,

see chapter 3, Conﬁguring 3Com VCX IP Telecommuting Module.

5

Chapter 1. Introduction to 3Com VCX IP Telecommuting Module

6

Chapter 2. Installing 3Com VCX IP Telecommuting Module

Installation

There are three ways to install an 3Com VCX IP Telecommuting Module: using a serial cable, using a diskette or perform a magic ping.

Installation with a serial cable or a diskette requires being at the same place as the Telecommuting Module, but will give more options for the start conﬁguration.

Installation with magic ping does not require being on the same place as the Telecommuting Module (but the computer has to be connected to the same logical network as the Telecommuting Module), but restricts the start conﬁguration.

Installation with magic ping

You can use the magic ping to set an IP address for the Telecommuting Module. This is how to perform a magic ping:

• Plug in the power cord and turn the Telecommuting Module on.

• Wait while the Telecommuting Module boots up.

• Connect the network cables to the network interfaces.

• Find out the MAC address of the Telecommuting Module (printed on the Telecommuting

Module label). This is the MAC address of Network Interface 1.

• Add a static entry in your local ARP table consisting of the Telecommuting Module’s

MAC address and the IP address it should have on eth0. This is how to add a static ARP entry if you use a Windows computer: Run the command command (or cmd). In the Command window, enter the command arp -s ipaddress macaddress where ipad-

dress is the new IP address for the eth0 interface, and macaddress is the MAC address printed on the Telecommuting Module, but with all colons (:) replaced with dashes (-).

• Ping this IP address to give the Telecommuting Module its new IP address. You should

receive a ping reply if the address distribution was successful.

• Conﬁgure the rest through a web browser.

The magic ping will not set any password. Set a password immediately via the web user interface. Before any conﬁguration has been made, only the computer which performed the magic ping will be able to conﬁgure the 3Com VCX IP Telecommuting Module.

Installation with a serial cable

These steps are performed when installing with a serial cable:

7

Chapter 2. Installing 3Com VCX IP Telecommuting Module

• Connect the Telecommuting Module to your workstation with the enclosed serial cable.

• Plug in the power cord and turn the Telecommuting Module on.

• Wait while the Telecommuting Module boots up.

• Log on from your workstation.

• Run the installation program (see following instructions).

• Connect the network cables to the network interfaces.

• Conﬁgure the rest through a web browser.

Connect the Telecommuting Module to your workstation with the enclosed serial cable, plug in the power cord and turn the Telecommuting Module on. You will have to wait a few minutes while it boots up.

• If you use a Windows workstation, connect like this: Start Hyperterm. A Location dia-

logue will show, asking for your telephone number and area. Click Cancel followed by Yes. Then you will be asked to make a new connection. Type a name for this connection, select an icon and click OK. The Location dialogue will show again, so click Cancel followed by Yes.

Now you can select Connect using COM1 and click OK. A Port settings dialogue will show, where you select 19200 as Bits per second. Use the default conﬁguration for all other settings. Click OK and wait for a login prompt. (In some cases you have to press Return to get the login prompt.)

• If you use a Linux workstation, connect like this: Make sure that there is a symbolic

link named /dev/modem which points to the serial port you connected the Telecommuting Module to. Connect using minicom with the bit rate 19200 bits/s, and wait for a login prompt.

Log on as the user admin. The ﬁrst time you log on, no password is required. You set the password when you run the installation script, which starts automatically when you have logged on.

Each network interface is marked with a name (1 and 2), which corresponds to a tab under Network Conﬁguration. All eth interfaces belong to ethernet cards and should only be connected using ethernet cables.

Decide which computer(s) are allowed to conﬁgure 3Com VCX IP Telecommuting Module and enter the name of the network interface to which they are connected, for example, eth0. You must use the physical device name (eth0 and eth1).

Enter the IP address of the Telecommuting Module on this interface and the network mask for the network.

A network mask can be written in two ways in 3Com VCX IP Telecommuting Module:

• The ﬁrst looks just like an IP address, for example 255.255.192.0 or 255.255.254.0.

8

Chapter 2. Installing 3Com VCX IP Telecommuting Module

• The other way is as a number between 0 and 32. An IP address has 32 bits, where the

number of the network mask indicates how many bits are used in the network’s addresses. The rest of the bits identiﬁes the computer on the network.

Now, you can select to deactivate any network interfaces. Select y to deactivate all interfaces but the one you just conﬁgured. The remaining network interfaces can be activated later when you complete the conﬁguration via the web interface from your work station. This only applies to interfaces which was previously active; you can’t activate interfaces with this setting.

Now enter the computer or computers from which the Telecommuting Module may be conﬁgured (the conﬁguration computers).

Then enter a password for the Telecommuting Module. This is the password you use in your web browser to access and change the Telecommuting Module’s conﬁguration. Finally, you can reset all other conﬁguration if you want to.

Following is a sample run of the installation program.

3Com VCX IP Telecommuting Module Administration

1. Basic conﬁguration

2. Save/Load conﬁguration

5. Wipe email logs

6. Set password

7. Command line interface a. About q. Exit admin ==>

Select 1 to install your 3Com VCX IP Telecommuting Module.

Basic unit installation program version 4.6.5

Press return to keep the default value

Network conﬁguration inside:

Physical device name[eth0]: IP address [0.0.0.0]: 10.47.2.242 Netmask/bits [255.255.255.0]: 255.255.0.0 Deactivate other interfaces? (y/n) [n]

Computers from which conﬁguration is allowed:

You can select either a single computer or a network.

Conﬁgure from a single computer? (y/n) [y]

9

Chapter 2. Installing 3Com VCX IP Telecommuting Module

If you choose to allow only one computer to conﬁgure the Telecommuting Module, you are asked for the IP address (the mask is set automatically).

IP address [0.0.0.0]: 10.47.2.240

If this IP address is not on the same network as the IP address of the Telecommuting Module, you are asked for the router. Enter the IP address of the router on the network where the Telecommuting Module is connected. Then enter the network address and mask of the network containing the conﬁguring computer.

Static routing: The computer allowed to conﬁgure from is not on a network local to this unit. You must conﬁgure a static route to it. Give the IP address of the router on the network the unit is on.

The IP address of the router [0.0.0.0]: 10.47.3.1 Network address [10.47.0.0]: 10.10.0.0 Netmask [255.255.255.0]:

You can choose to allow several computers to conﬁgure the Telecommuting Module, by answering no to the question:

Conﬁgure from a single computer? (y/n) [y] n

The installation program then asks for the network number. The conﬁguration computers must be entered as a complete subnet, i. e. a range which can be written as a network number and a netmask (like 10.47.2.128 with netmask 255.255.255.128, which means the computers

10.47.2.128-10.47.2.255). All computers on this subnet will be allowed to conﬁgure the Telecommuting Module. For more information about network numbers and netmasks, see chapter 3, Conﬁguring 3Com VCX IP Telecommuting Module.

Network number [0.0.0.0]: 10.47.2.0 Netmask/bits [255.255.255.0]: 255.255.255.0

If the network or partial network is not directly connected to the Telecommuting Module, you must enter the IP address of the router leading to that network. Then enter the network’s address and mask.

Static routing: The network allowed to conﬁgure from is not on a network local to this unit. You must conﬁgure a static route to it. Give the IP address of the router on the network this unit is on.

The IP address of the router [0.0.0.0]: 10.47.3.1 Network address [10.47.0.0]: 10.10.0.0 Netmask [255.255.255.0]:

Then enter a password.

10

Chapter 2. Installing 3Com VCX IP Telecommuting Module

Password []:

Finally, you are asked if you want to reset other conﬁguration.

Other conﬁguration Do you want to reset the rest of the conﬁguration? (y/n) [n]

If you answer n, nothing is removed. If you answer y, you have three alternatives to select from:

1. Clear as little as possible. This is the alternative that is used if you answer n to the question above. Both the preliminary and the permanent conﬁgurations will be updated with the conﬁguration speciﬁed above.

2. Revert to the factory conﬁguration and then apply the conﬁguration speciﬁed above. This will affect the permanent but not the preliminary conﬁguration.

3. Revert to the factory conﬁguration and empty all logs and then apply the conﬁguration speciﬁed above. Both the preliminary and the permanent conﬁgurations will be affected.

Select the update mode, which is what you want to remove.

Update mode (1-3) [1]:

All conﬁguration is now complete. The installation program shows the conﬁguration and asks if it is correct.

yes saves the conﬁguration. no runs the installation program over again. abort ends the installation program without saving.

You have now entered the following conﬁguration

Network conﬁguration inside:

Physical device name: eth0 IP address: 192.168.150.2 Netmask: 255.255.255.0 Deactivate other interfaces: no

Computer allowed to conﬁgure from:

IP address: 192.168.128.3

Password: eeyore

The rest of the conﬁguration is kept.

Is this conﬁguration correct (yes/no/abort)? yes

11

Chapter 2. Installing 3Com VCX IP Telecommuting Module

Now, ﬁnish conﬁguration of the Telecommuting Module from the computer/computers speciﬁed in the installation program.

Installation with a diskette

These steps are performed when installing with a diskette:

• Select an IP address and store it on the installation diskette as described below.

• Insert the installation diskette into the Telecommuting Module’s ﬂoppy drive.

• Plug in the power cord and turn the Telecommuting Module on.

• Connect the network cables to the network interfaces.

• Wait while the Telecommuting Module boots up.

• Conﬁgure the rest through a web browser.

You must ﬁrst insert the diskette into your PC. If the PC is running Windows, open a Command window and run the ﬁnst-en script from the diskette. If the PC is running Linux, mount the diskette, change directory to the mounted one, and run the ﬁnst-en script.