Steven J. Johnson President Ingate Systems Inc. Enabling SIP to the Enterprise Steven J. Johnson President Ingate Systems Inc.

Welcome SIP Trunking Summit

Ingate Systems Products: Ingate Firewall® and Ingate SIParator® Founded in 2001 SIP aware firewall HW & SW technology Headquarters in Stockholm, Sweden Ingate Systems Inc. North American subsidiary Hollis, NH and Ottawa, Canada Focus: Enabling SIP to the enterprise Products: Ingate Firewall® and Ingate SIParator® Driving SIP Trunking education Eighth SIP Trunking Seminar series offered in conjunction with TMC and ITExpo

Ingate Products are the choice of a broad range of customers Global Customer Base Over 5,000 units installed Products covering 5 -10,000 seats SIParator 95 SIParator 19 SIParator 50, 55 & 65 Ingate Products are the choice of a broad range of customers

What is SIP Trunking? SIP trunking is the IP connection between an IP-PBX and a service provider Ingate SIParator PSTN gateway IP-PBX Firewall IP Network PSTN Service Provider Ingate contributes with 10 years of experience and product development Products based on ICSA Lab Certified firewall Built for integrated VoIP and IP LAN traffic NAT/Firewall traversal Interoperability between PBX and Service Providers Quality of Service (QoS) Security Demarcation point of Service Connecting remote users to the PBX Secure interoffice connection WiFi mobile phone communication Unified Communications ready

SIP Trunking is Hot SIP Trunking is currently the fastest-growing segment of VoIP services. It’s expected to have an 89 percent CAGR from 2008 to 2013. Infonetics Research

The SIP Trunking Challenge "Interoperability is a challenge facing SIP trunking. There are organizations such as the SIP Forum looking to solve such problems, but at the end of the day, realized end-to-end solutions for customers with multiple vendor and service provider solutions will continue to be an obstacle," (Rebecca Swensen, Research Analyst, IDC) Solution: Ingate

Confirmed Interoperability IP-PBXs 3Com Aastra Digium / Asterisk Avaya Cisco Call Manager Ericsson MX-One Fonality Innovaphone Interactive Intelligence Iwatsu Microsoft Mitel NEC / Sphere Nortel Objectworld Pingtel SER Shoretel Siemens SIP-Gear Swyx 360 Networks AGN Networks AT&T BandTel Bandwidth.com Broadvox Cbeyond Cellip Cordia Corporation Deltacom Excel Switching Gamma Global Crossing IP-Only Level 3 Service providers Ingate SIParator® -or- Ingate Firewall Netlogic NetSolutions Nexvortex Nuvox One Comm. Paetec Primus Skype TDC Tele2 Toplink Verizon VoEX VoIP Unlimited Voxbone More in pipeline..... SIP Trunk Compliant with As Ingate have interop’ed with many IP-PBX vendors like we will also guarantee interoperability for the Service Provider. The Service Provider only have to ensure interop’ with Ingate and then a number of different IP-PBXs will automatically be supported. Carrier Equipment Acme Packet; Broadsoft; Sonus See: www.siptrunk.org

SIP Trunking is only the Beginning “To date, SIP trunking has been largely focused on recreating current TDM voice services (“trunks”) over IP. While useful, that’s only one possible use. We see the true market potential of SIP trunking in its ability to act as a hosted services “conduit” and to carry media other than standard PSTN quality voice – capabilities impossible with TDM.” - Broadsoft

NAT/Firewall Traversal Problem when SIP Trunking over the Internet SIP Trunking Provider Public Internet PSTN GW SIP System SIP Trunking does not pass a SIP unaware NAT/firewall! …and the firewall cannot be opened enough to make it work because of NAT. Firewall IP-PBX NAT and firewall traversal: Since ordinary firewalls are unaware of SIP, SIP communication does not work between the Local Area network (LAN) and the outside world. For SIP trunking, this issue has to be resolved so the SIP trunk can reach the PBX system. Ingate’s security products handle these issues generally, permitting SIP traffic to enter the network while preventing unauthorized access. With a SIP trunking service delivered over the Internet, the Ingate edge device enables robust connection of modern SIP IP-PBXs (where only the signaling is handled by the IP-PBX, while the voice goes the shortest way between the endpoints).

With a SIP Trunk over the Internet, it is not really an option to just connect it to a VoIP LAN. SIP Trunking Provider Public Internet PSTN GW SIP System SIP Trunk Over the Internet Severe Security Warning! No one wants the whole Voice LAN exposed to the Internet. Any extra firewall here needs to be SIP aware or widely open. Firewall IP-PBX Data LAN Who will issue a public white IP addresses to every Phone? VoIP LAN No Soft or Multimedia Clients! ?? UC?

Ingate Firewall® Creating a Common Data and VoIP LAN for SIP-Trunking over the Internet SIP Trunking Provider Public Internet PSTN GW SIP System Service Provider Remote Users Data & VoIP LAN with QoS SIP Trunk over Internet Ingate Firewall® Firewall Demarcation point and bringing SIP communication to the LAN IP PBX Data LAN Soft Clients and Multimedia Terminals

Ingate SIParator® Used with Existing Firewall for SIP Trunking Service over Internet SIP Trunking Provider Public Internet PSTN GW SIP System Service Provider Remote Users Data & VoIP LAN SIP Trunk over Internet Ingate SIParator® Firewall Demarcation point and bringing SIP communication to the LAN IP-PBX Interfacing all IP-PBXs: With an Ingate product in the customer network edge, Internet Telephony Service Provider (ITSP) can interface with any SIP-enabled IP-PBX, eliminating the need to achieve interoperability with every IP-PBX vendor and address the widest number of customers. Ingate Firewalls and SIParators serve as a “normalization engine” between the IP-PBX and ITSP, paving the way for a successful SIP trunk roll-out. Ingate products have proven seamless interoperability with the leading IP-PBX vendors, ensuring that SIP trunks are deployed quickly and with a minimum of effort. Ingate’s SIP proxy integrated with its NAT and firewall provides advanced routing capabilities for deploying SIP trunks. Combined with the optional Back-to-Back User Agent functionality, all service provider requirements for authentication and signaling from any IP-PBX can be supported. Support for Remote Workers: Ingate products also support remote workers by allowing SIP phones and soft clients to connect to the company SIP IP-PBX. Ingate solves the NAT traversal issues both at the enterprise edge and at the remote site; no additional hardware or software is required for the remote worker. Data LAN Soft Clients and Multimedia Terminals

SIP Trunking Provider Network Managed SIP Trunk Connected to Separate Enterprise VoIP LAN in Operator’s Space SIP Trunking Provider Network Public Internet GW PSTN SIP System No Remote Users! Provider: Security Warning! Managed SIP Trunk Firewall Enterprise: Security Warning! IP-PBX In enterprises where the VoIP LAN is logically separated from data LAN, it is possible to directly connect to a managed SIP Trunking service over a separate pipe (Nobody would even consider connecting such VoIP LAN directly to a SIP Trunking Service Provider offering his service on open Internet!). There are however security issues in addition to the restrictions in features a separate VoIP LAN introduces… (no remote users, no PC softphones, no multimedia handsets, etc.) Even with a managed SIP trunking service, where the service provider uses a central Session Border Controller (SBC) to do the NAT translation, the Ingate edge device gives valuable benefits by assuring network integrity and allowing remote users. Data LAN Will Service Provider issue IP addresses to every Phone? VoIP LAN No Soft or Multimedia Clients! ?? UC? 14

SIP Trunking Provider Network Ingate Firewall® Creating a Common Data and VoIP LAN for Managed SIP Trunking Service SIP Trunking Provider Network Public Internet GW PSTN SIP System Service Provider Remote Users Managed SIP Trunk Ingate Firewall® IP-PBX Demarcation point and SIP communication via both WAN pipes. Demarcation point: Many service providers want a clear hand-off point between their network service and the end customer. The Ingate Firewall and SIParator serve this important function, not only delivering health and quality statistics to the service provider, but also establishing a security boundary between the provider network and the customer. The Ingate units can report Mean Opinion Score (MOS) and R values either to a service provider management system, or to the Ingate Element Management System. Data & VoIP LAN Soft Clients and Multimedia Terminals

SIP Trunking Provider Network Ingate SIParator® Used with Existing Firewall for Managed SIP Trunking Service SIP Trunking Provider Network Public Internet GW PSTN SIP System Service Provider Remote Users Managed SIP Trunk Firewall Ingate SIParator® IP-PBX Demarcation point and SIP communication via both WAN pipes. Firewall / NAT Traversal Normalization of SIP between IP-PBXs and SIP Trunking Service Provider Network demarcation point Security - Policing – Classification Platform for Unified Communications extensions Data & VoIP LAN Soft Clients and Multimedia Terminals

SIP Trunking and Beyond Ingate contributes with 10 years of experience and SIP product development Products based on ICSA Lab Certified firewall Built for integrated VoIP and IP LAN traffic including: NAT/Firewall traversal Interoperability between PBX and Service Providers Quality of Service (QoS) Security Demarcation point of Service Connecting remote users to the PBX Unified Communications ready

Enabling SIP to the Enterprise Ingate Systems Steven J. Johnson 603-883-6569 steve@ingate.com www.ingate.com Enabling SIP Trunking