Intertex Data AB, Sweden Firewall and NAT Traversal Bringing SIP the LAN Prepared for: International SIP 2003 By: Karl Erik Ståhl President Intertex Data AB Chairman Ingate Systems AB karl.stahl@intertex.se © 2003 Intertex Data AB 1

Is there a next big steps in Internet usage? Email World Wide Web Will there be Real Time Communication Person-to-Person?

Remember how it started in 95? VoIP as we have seen it… Remember how it started in 95? Internet PC Wanna talk to me? Now it is coming back in a most useful form!

Then this service was offered to end users? VoIP as we have seen it… Gateway Internet STO LA Then this service was offered to end users? Nowdays long distance VoIP minutes are bought by the established telcos. Your normal international calls often run over the public Internet!

VoIP as we have seen it… PSTN Internet VoIP between branch offices VPN US Gateway IP PSTN Europe Gateway IP VoIP between branch offices - But NOT globally to others!

VoIP as we see it… PSTN Internet MGCP often used to phones SOFT SWITCH Internet FW MGCP often used to phones Phones get locked to operator

Hmm, didn’t we pass this stage… PSTN Organization 1 Email system 1 fax Organization 2 Email system 2 fax fax fax printer email email Paper was a very compatible media - So is POTS today… But we need to move beyond!

What about universal connectivity? PSTN RJ11 Black Phone RJ45 LAN Intranet Internet IP Phone Wouldn’t that be fine?

Is black telephony all we want? “We need QoS of PSTN…” 3 kHz bandwith? Video? Presence? draft-ietf-simple-presence-07.txt Instant Messaging? RFC3428, December 2002 And more…

Is the protocol part of the game? SMTP Created Email HTTP Created the Web SIP Can Create IP Communication Person-to-Person!

Microsoft is pushing – New RTC is SIP-based Voice & Video (XP) Windows Messenger 4.6 and later has SIP-mode Presence & IM 4255551212 Dial to phone Rich SIP APIs .NET Server will include SIP server, with API (3Q2) Applications will arise 10:s of millions of RTC (SIP) users within a year

Let SIP clients talk to each other! Internet Connect to PSTN when required! PSTN SIP/PSTN Gateway SIP Server XP PIM IP Phone IP Phone Home LAN Business LAN IAP IP Phone IP Phone

Operator network with NAT But there is a problem… IP Phone PSTN SIP/PSTN Gateway Internet Home LAN Business LAN SIP Server IAP XP PIM Status until recently: SIP is the Protocol for IP Communication Person-to-Person, BUT IT DOES NOT REACH THE EDGE! Firewall/NAT problems! DSL Cable MTU Operator network with NAT NAT FirewallNAT

Locate the person - Set up a session - Open real time media streams What is the difference? Typical Internet protocol (SMTP, HTTP…) Internet HOST SERVER SIP (and H.323…) connects person-to-person Internet PERSON Locate the person - Set up a session - Open real time media streams

SIP Firewall Problems Firewall Problems: Sessions initiated from outside the firewall - OK, open port 5060, but… Media streams on dynamically allocated port numbers - Ooops…  ! Even with public IP addresses inside

SIP NAT/PAT Problems NAT & PAT Problems: Where is the device? - Registration/location function Private IP addresses and ports in SIP messages - Rewrite with globally routable addresses IP address and port of media stream has to be modified - NAT engine has to be dynamically controlled Worse with private IP addresses inside

Suggested Solutions Dynamically controlled Firewall/NATs Midcom: By Firewall Control Proxy [Dynamicsoft…] uPnP: By the client (Windows) [Microsoft] SIP aware Firewall/NATs (SIP Proxy + Registrar) [Intertex (SOHO), Ingate (enterprise), …] SIP aware Firewall/NATs (SIP ALG) [Cisco,… TLS not possible] Making SIP NAT friendly - Drafts in progress: draft-ietf-sipping-nat-scenarios-00.txt draft-ietf-midcom-stun-02.txt draft-ietf-sip-nat-02.txt draft-ietf-sip-symmetric-response-00.txt

Adding SIP Support to a Firewall Important components: Firewall & NAT Dynamic Firewall Engine SIP Proxy SIP Proxy Server, controlling the firewall Firewall Control Protocol Communication between SIP Proxy and firewall User Location SIP Registrar, user location information

SIP Enabling the Private Networks IP Phone SIP Server PSTN SIP/PSTN Gateway Operator network with NAT Internet NAT FirewallNAT Enterprise LAN DSL Cable MTU DMZ inGate SIParator inGate Firewall IX66 IP Phone Office or home LAN IP Phone Firewall/NAT problems! Firewall/NAT SIP transparency! IP Phone IAP

Just Another Internet Service… PSTN SIP/PSTN Gateway Internet IX66 IAP Home LAN SOHO LAN IX66 XP Helsinki IX66 Intertex Stockholm LAN Sweden Enterprise LAN XP inGate Firewall DMZ inGate SIParator XP Ingate Linköping LAN IX66 Home User USA Sweden DNS SRV

IP Communications Using IP Networks …other… IM Conf Vmail OSS SIP Server SIP Routing IN Dialing Plans Global IP Comm WorldCom Public IP Network Network GWY SIP Phone Firewall Router Intranet IP Comm IP VPN Enterprise Gateway Managed Services Customer Premises WorldCom PSTN PBX PSTN Phone PSTN Phone Many call routing options: Private/Public IP address DNS and DNS SRV records SIP aware NAT/PAT servers Henry Sinnreich 4/10/2002 Intranet IP VPN with IP communications Domestic and global IP communications PBX and PSTN – E.164 resolution

IP Communications Using IP Networks …other… IM Conf Vmail OSS No IP PBX Needed! Enhanced Functionality Enterprise LAN SIP Capable Firewall Ingate and Intertex First through SIT SIP Server SIP Routing IN Dialing Plans Global IP Comm WorldCom Public IP Network Network GWY SIP Phone Firewall Router Intranet IP Comm IP VPN Enterprise Gateway Customer Premises Managed Services Integration with existing phones WorldCom PSTN PBX PSTN Phone PSTN Phone

Product Examples – Ingate Systems AB Enterprise Products A Complete Firewall An add-on to an Existing Firewall DMZ Existing Firewall Firewall 1400 SIParator 40 Firewall & NAT/PAT SIP Proxy SIP Registrar

Product Examples – Intertex Data AB SOHO Products IX66 Internet Gate with or without ADSL modem built-in OEM as: Telia SurfinBird Gate PowerBit SafeGate Review at: www.adslguide.org.uk/hardware/reviews/2002/q1/intertex_ix66-edflc.asp

The Intertex IX66 Internet Gate A closer look Firewall & NAT/PAT Router SIP Proxy and Registrar DHCP Server and Client WEB Server for configuration Smart Card Reader for security applications Optional 802.11b Wireless Lan SIP Appliance Control, LAC via expansion port Optional ADSL and Splitter Built-in

SIP-capable firewalls! Intertex Data AB www.intertex.se Rissneleden 45 SE-174 44 Sundbyberg, Sweden VD Karl Erik Ståhl karl.stahl@intertex.se Tel +46 8 6282828 Ingate Systems AB www.ingate.com Box 10013, Slakthusplan 4 SE-121 26 Stockholm, Sweden VD Olle Westerberg olle.westerberg@ingate.com Tel +46 8 6007750