Re : NAT required ?

[blackberry1980]

Can someone explain why it is a requirement for enabling nat on the client side router of a teleworker set ?
What would result if it werent enabled ?

Just curious

 

[slapin]

If your phone is obtaining a public IP address and can reach TW gateway then there is no need in NAT. In 99.99% of all installatins clients accessing Internet through some sort of router with a single public address and a private network behind NAT. So this requirement placed just in case when a user will demend to make his/her phone work without access to the public Internet. At least I get these requests once in a while.

 

[blackberry1980]

The problem i am having is that teleworker phones are getting intermittant one way audio during a call. In the beggining of a call call 2 way transmission is ok but later into the call it turns into one way trans.

Any thoughts/suggestions on this ?

 

[slapin]

Bad or overloaded connection, bad or low performance client router.

 

[Mitelmatt]

you need the inside NAT so that the media streams from internal phones to a Teleworker phones stream through the Teleworker server. It has to be this way for securit and also to allow for a phone to be moved from your home to the office without the need to change the IP address (more for softphones)

So yes without the inside NAT you will experience one way transmission when installed i server only in the DMZ

Hope that helps

 

[slapin]

Mitelmatt, that would be incorrect. In properly configured network it doesn't matter. The only difference that TW server can detect when multiple phones coming in from the same public address and enable local streaming, so media streams don't go through the server but from one local phone to another local phone.

 

[Mitelmatt]

sorry slapin have a doc from Mitel and experience that when NAT is involved that is the case

Also you seem to misunderstand, i agree that local streaming for multiple phones at a remote site. What i'm talking about is when a phone on a local lan (i.e office hq) talks to a home worker and the teleworker is Nated, then the LAN phones MUST talk to the teleworker's external address not internal address.

 

[Mitelmatt]

FYI, this may help

From Article 05-6050-00009 entitled Network Address Translation for Teleworker:

"Network address translation must be performed on the customer's firewall between the external interface and the DMZ. This allows the Teleworker server's public address to be translated to it's address within the DMZ.

Network address translation must also be performed between the internal and DMZ network interface. The ICP and IP sets located on the internal network stream to the Teleworker server's public address located on the external firewall interface. This address must then be translated to the IP address of the Teleworker server in the DMZ by the firewall. Without this configuration, one way transmission will be experienced in the direction of internal IP phones to the remote Teleworker IP devices.

The Teleworker server has been designed to work in this way for 2 main reasons:-

1)Internal and Teleworker sets stream to the same IP address (public routable IP address). Therefore, sets do not need to be internally reprogrammed depending on whether they're at home or at work.

2)Because they always stream to the same IP address, the Teleworker server cannot know where they are physically located, so it handles all calls in the same way.

 

[nappyshock]

What firewall are they using

 

[slapin]

And why I have to place external TW interface behind a wirewall and introduce additional delay and jitter? TW server has pretty good local firewall. This manual built for standard DMZ deployment when company polycy doesn't allow any servers to be exposed to the Internet. If it is not the case there is no need in NAT, TW server can have globaly routable public IP. TW phones while in the office will talk to external IP and local office phones will communicate with internal interface of the server. Obviously standard NAT has to be set for the office network providing access to the Internet.

 

[Mitelmatt]

slapin,

Agree but i think really it depends on your set up. Each site could be different.

But it is an answer tas to why you need an inside NAT under certain cicumstances.