NATs & Firewalls The General SIP Proxy Firewall Prepared for:Spring VON 2003 By: Karl Erik Ståhl President Intertex Data AB Chairman Ingate Systems AB © 2003 Intertex Data AB 1

IP Phone Internet SOHO LAN Enterprise LAN We have a “new” network XP PIM But do we use it for person to person communication? Everyone has a connection… Operator Network

© 2003 Ingate Systems AB © 2003 Intertex Data AB 3 VoIP as we have seen it… PSTN But no connectivity between the IP clouds! Europe IP US VPN Tunnel IP Gateway Toll Bypass SOFT SWITCH MGCP

© 2003 Ingate Systems AB © 2003 Intertex Data AB 4 What about universal connectivity? Wouldn’t that be fine? Black Phone RJ45 LAN Intranet Internet IP Phone PSTN RJ11

IP Phone PSTN SIP /PSTN Gateway Internet SOHO LAN Business LAN SIP Server IAP XP PIM Firewall/NAT problems! DSL Cable MTU Operator network with NAT NAT Firewall NAT Status until recently: SIP is the Protocol for IP Communication Person to Person, BUT IT DOES NOT REACH THE EDGE! So, why don’t we just connect?

© 2003 Ingate Systems AB © 2003 Intertex Data AB 6 What is the difference? Typical Internet protocol (SMTP, HTTP…) Internet HOST SERVER SIP (and H.323…) connects person to person Internet PERSON Locate the person - Set up a session - Open real time media streams

© 2003 Ingate Systems AB © 2003 Intertex Data AB 7 SIP Firewall Problems Firewall Problems: Sessions initiated from outside the firewall - OK, open port 5060, but… Media streams on dynamically allocated port numbers - Ooops…  ! Even with public IP addresses inside

© 2003 Ingate Systems AB © 2003 Intertex Data AB 8 SIP NAT/PAT Problems NAT & PAT Problems: Where is the device? - Registration/location function Private IP addresses and ports in SIP messages - Rewrite with globally routable addresses IP address and port of media stream has to be modified - NAT engine has to be dynamically controlled Worse with private IP addresses inside

© 2003 Ingate Systems AB © 2003 Intertex Data AB 9 Suggested Solutions Dynamically controlled Firewall/NATs Midcom: By Firewall Control Proxy (IETF work) uPnP: By the client (Windows) SIP aware Firewall/NATs (SIP Proxy + Registrar) General, handles complex scenarios [Intertex (SOHO), Ingate (enterprise), …] SIP aware Firewall/NATs (SIP ALG – non Proxy) TLS not possible STUN - Can cope with certain types of existing NATs SIP clients need to get STUN into their SIP stacks Requires STUN servers on the net, RTCP is lost Tunnelling - Connects SIP clients to an operator or a corporate LAN Requires ALG for each client with NATed address Tunnels by IPSec or proprietary

© 2003 Ingate Systems AB © 2003 Intertex Data AB 10 Adding General SIP Traversal to a Firewall Important components: Firewall & NAT Dynamic Firewall Engine SIP Proxy SIP Proxy Server, controlling the firewall User Location SIP Registrar, user location information Firewall Control Protocol Communication between SIP Proxy and firewall

Firewall/NAT problems! Firewall/NAT SIP transparency! Office or home LAN IP Phone SIP Server PSTN SIP /PSTN Gateway Operator network with NAT Internet NAT Firewall NAT Enterprise LAN DSL Cable MTU DMZ inGate SIParator SIP Enabling the Private Networks inGate Firewall IP Phone IX66 IAP

© 2003 Ingate Systems AB © 2003 Intertex Data AB 12 What have we got? Important components: Firewall & NAT Dynamic Firewall Engine SIP Proxy SIP Proxy Server, controlling the firewall User Location SIP Registrar, user location information Firewall Control Protocol Communication between SIP Proxy and firewall In the Ingate and Intertex products: You’ve got a SIP server! Use it just for firewall traversal AND/OR as your - SIP Server - Outgoing proxy - Inbound proxy

Internet Just Another Internet Service… Enterprise LAN XP inGate Firewall PSTN SIP /PSTN Gateway DNS SRV DMZ inGate SIParator XP Ingate Linköping LAN IX66 Intertex Stockholm LAN Sweden IX66 FWD Booth #301 IX66 SIP Forum Booth #210 USA Sweden IX66 Home Office Users SOHO LAN IX66 XP San Jose Booth #520

IP Communications Using IP Networks Intranet IP VPN with IP communications Domestic and global IP communications PBX and PSTN – E.164 resolution Customer Premises PBX PSTN Phone Managed Services Router Vmail OSS SIP Phone WorldCom PSTN Dialing Plans Network GWY Conf PSTN Phone IM IN Enterprise Gateway SIP Routing Firewall SIP Server IP VPN Global IP Comm Intranet IP Comm …other… Many call routing options: Private/Public IP address DNS and DNS SRV records SIP aware NAT/PAT servers Henry Sinnreich 4/10/2002 WorldCom Public IP Network

IP Communications Using IP Networks PBX PSTN Phone Managed Services Router Vmail OSS SIP Phone WorldCom PSTN Dialing Plans Network GWY Conf PSTN Phone IM IN Enterprise Gateway SIP Routing Firewall SIP Server IP VPN Global IP Comm Intranet IP Comm …other… Integration with existing phones SIP Capable Firewall Ingate and Intertex First through SIT Customer Premises No IP PBX Needed! Enhanced Functionality Enterprise LAN WorldCom Public IP Network

Firewall Presence IM Greenwich Edge Proxy DMZ Microsoft Greenwich Home Server: Presence IM Audio Video Data Col. TLS

© 2003 Ingate Systems AB © 2003 Intertex Data AB 17 Product Examples – Ingate Systems AB Complete Firewalls Add-on to Existing Firewalls  Firewall & NAT/PAT  SIP Proxy  SIP Registrar Enterprise Products DMZ Existing Firewall SIParator

© 2003 Ingate Systems AB © 2003 Intertex Data AB 18 Product Examples – Intertex Data AB IX66 Internet Gate with or without ADSL modem built-in OEM as: Telia SurfinBird Gate PowerBit SafeGate Review at: SOHO Products

© 2003 Ingate Systems AB © 2003 Intertex Data AB 19 The Intertex IX66 Internet Gate A closer look  Firewall & NAT/PAT Router  SIP Proxy and Registrar  DHCP Server and Client  WEB Server for configuration  Smart Card Reader for security applications  Optional b Wireless Lan  SIP Appliance Control, LAC via expansion port Optional ADSL and Splitter Built-in

© 2003 Ingate Systems AB © 2003 Intertex Data AB 20 SIP Capable Firewalls! Ingate Systems AB Box 10013, Slakthusplan 4 SE Stockholm, Sweden CEO Olle Westerberg Tel Intertex Data AB Rissneleden 45 SE Sundbyberg, Sweden President Karl Erik Ståhl Tel