ASBCE 1

[teletechman]

I have been handed a R10.1 ASBCE, the last ASBCE that I worked on was a R6 release which is slightly different. I have the question as I was doing a training course with Avaya on the ASBCE. They said that the ASBCE should be behind a firewall with ports forwarded, the last one I did was in parallel? Which is the way to do this. I am still pretty new to the ASBCE so I am not sure the best or recommended way to do this.
I will probably have more questions about this soon as I dig into it deeper.
Mike

 

[derfloh]

You can do both. The ASBCE is able to work directly on a public network. If you feel better you can also place it behind a firewall and allow only specific ports. But since the SBC is only listening to a few specific ports it’s not needed.

Behind a firewall you have to be aware that the firewall doesn’t adjust the SIP packages because it will cause usually more problems that it helps. It’s mostly caused by ALG (Application Layer gateways) with various names and options based on the banning of the firewall vendor.

Most important is to not have the mannend interface within the same network as the traffic networks (An, Bn).

IP Office remote service
IP Office certificate check
CLI based call blocking
SCN fallback over PSTN

 

[teletechman]

So management interface M1 should not be on the same subnet as A1? B1 will be the public so that is not a problem.
Mike

 

[derfloh]

It will work as well if M1 and A1 are in the same - trusted - network

IP Office remote service
IP Office certificate check
CLI based call blocking
SCN fallback over PSTN

 

[teletechman]

Another question that I am trying to figure out is do we need 2 public addresses if we are setting up SIP trunks and also want remote users via IX workplace? Or do we need only 1 public to handle both?
Mike

 

[derfloh]

It works with one IP as well.

It depends also on the provider if you need a static port and if you want to use the same port for SIP trunk and remote user.

IP Office remote service
IP Office certificate check
CLI based call blocking
SCN fallback over PSTN

 

[JayNEC]

IMO it's better to have two public IP's and two internal IP's as well. It makes troubleshooting down the road a bit easier, you can differentiate the traffic in your traces, pcaps etc.

New England Communications

http://www.necomm.com

 

[teletechman]

Well, the unit we are using is the Dell 3240 ASBCE which has 2 Management ports 1 A1 and 1 B1 port.
Mike

 

[teletechman]

Another question is should the SIP trunks register to the SBC or the IPO. I have a username and password that the SIP provider sent me and I wanted to know if the SBC registers in its programming or is this still done on the IP Office?
Mike

 

[derfloh]

The SBC registers with the SIP provider. The IPO will use the SBC as proxy.

If you only have one A and one B interface (physically) you can use VLAN tagging to create subinterfaces.

I did both several times.

IP Office remote service
IP Office certificate check
CLI based call blocking
SCN fallback over PSTN

 

[teletechman]

They have now added the remote phones and IX workplace as part of this. I see in all the white papers Avaya setting this up with the server edition, but I have the IP500V2. The first thing the paper talks about is the certificates and how to do them in SE. Can this also be done in the 500V2 or should we work with a public cert?
Mike

 

[derfloh]

You can use any CA you like. But IP500 is only able to create self assigned to use itself. You can use an Application Server as CA.

IP Office remote service
IP Office certificate check
CLI based call blocking
SCN fallback over PSTN

 

[teletechman]

do this need to be on the network when creating the certificate? Or can I use a test bed in my office for this?
Mike

 

[derfloh]

You can create it anywhere. You just have to deploy the root cert to the clients.

IP Office remote service
IP Office certificate check
CLI based call blocking
SCN fallback over PSTN

 

[teletechman]

I am trying to create the certificate and am not sure about some of the settings. Should the machine IP be from the SBC or the App server or the IP Office. This is to install on the SBC for remote users.

Mike

 

[derfloh]

Use B1 as IP. But it does not make a difference.

Use SIP Domain as subject name.
Set those as Subject Alternative Name:
IP: public IP
DNS: SIP FQDN
DNS: SIP Domain
URI:sip: SIP Domain

IP Office remote service
IP Office certificate check
CLI based call blocking
SCN fallback over PSTN

 

[teletechman]

Still having issues wrapping my head around this. For the Machine IP I understand we use the public IP address. The subject name should be the FQDN of the SBC, so do I need to have the customer set up the FQDN with their hosting service and also their internal DNS? Right now, I am looking at examplesbc.example.com for a FQDN with the company name being used instead of example.
Mike

 

[teletechman]

Should the FQDN on the subject name field be the FQDN that points to the public address of the SBC. I am having the customer set up sip.example.com to point to the public is that what I should use for this?
Mike