Need to know what settings for remote NBX phones

[Yankees$$$]

What are the necessary phones setting to bring up a phone remotely over and IPsec tunnel ?



Is this different for traditional NBX phones versus a phone on a system running SIP ?

[bosoxfan_1]

Hi

yes, it is different for NBX since the NBX phones talk a different protocol when not in SIP mode



Fix: Open the following ports to allow a remote phone to access the NBX:

TCP port 1040 (used for call setup)

UDP ports 2093 through 2096

Port use specifics:

NBX_CALL_CONTROL_UDP_PORT = 2093

NBX_AUDIO_UDP_PORT = 2094

NBX_INTER_NCP_SIGNALING_UDP_PORT = 2095

NBX_DIRECTORY_SERVICES_UDP_PORT = 2096

[rojasm]

Yankees$$$



Please keep in mind that when you are using IPsec you also need to Encapsulate that traffic in order to pass Multicast traffic. NBX by nature ( same for other devices ) needs Multicast to propagate messages like

time and date.

Bosoxfan is right, you most open those ports to get this done. Also make sure that MTU is to to 1500 Bytes.

:)

Marco Vinicio Rojas Rivera

[merlin_1]

When an NBX tel is running in say NBX mode , it uses 2 protocols , NIP and H3 . These are the secure protocols that we use to communicate .



In SIP mode



When an NBX device tries to talk to a device in SIP mode it has to convert to a SIP language from Native mode and then talk SIP to the device . So the NBX tel will talk native mode to another NBX device in SIP mode , but will talk SIP to another SIP device connected to the NBX in SIP mode - We call it a NIP to SIP conversion . The audio stream is 5060 , The same Audio stream in SIP mode for both Native and SIP protocols .

This message was edited by merlin on 1-30-09 @ 11:02 AM

[Luckycharms]

Regardless of SIP or Native NIP. The NBX must be using IP and not ethernet only to work over IPSec tunnel.



If date/time and paging is needed then you will need to get IP Multicast traffic across the VPN. Unlike PPTP tunnels, IPSec tunnels by themselves do not support IP Multcast. So you need something else. In most case assuming the Firewall supports it. GRE tunnels are used between sites for IP Multicast.



Since the entire purpose of VPN tunnels is not to have to open up holes in the firewalls in the first place. You should not need to open up any UDP port numbers. Now the assumption here is this is Firewall to Firewall tunnels not PC to Firewall.



Most firewall default actions are to "allow all". However. there are some very specfic scenarios where there maybe a need to open up UDP ports i.e. The firewall default action "block all" then you will need to allow these ports but normally this is not the case.