1. The Firewall as a SIP Server Much more than firewall SIP traversal! Prepared for:Spring VON 2003 Enterprise Solutions By: Karl Erik Ståhl President Intertex Data AB Chairman Ingate Systems AB karl.stahl@intertex.se © 2003 Intertex Data AB 1

2. IP Phone Internet SOHO LAN Enterprise LAN We have a “new” network XP PIM But do we use it for person to person communication? Everyone has a connection… Operator Network

3. © 2003 Ingate Systems AB © 2003 Intertex Data AB 3 VoIP as we have seen it… PSTN But no connectivity between the IP clouds! Europe IP US VPN Tunnel IP Gateway Toll Bypass SOFT SWITCH MGCP

4. © 2003 Ingate Systems AB © 2003 Intertex Data AB 4 What about universal connectivity? Wouldn’t that be fine? Black Phone RJ45 LAN Intranet Internet IP Phone PSTN RJ11

5. © 2003 Ingate Systems AB © 2003 Intertex Data AB 5 We have SIP – Session Initiation Protocol An Internet Standard IETF RFC 2543, replaced by new RFC 3261 Used for real time person to person IP Communication VoIP, IP Telephony Audio, Video, Data Collaboration Presence, Instant Messaging Lots of activity, ongoing work and development http://www.cs.columbia.edu/~hgs/sip/ http://www.sipforum.org http://www.sipcenter.com http://www.pulver.com

6. © 2003 Ingate Systems AB © 2003 Intertex Data AB 6 “We need QoS of PSTN…” 3 kHz bandwith? Video? Presence? draft-ietf-simple-presence-07.txt Instant Messaging? RFC3428, December 2002 And more… Is black telephony all we want?

7.  Voice & Video (XP) Greenwich includes SIP server with API (3Q3)  Applications will arise Windows Messenger 4.6 and later has SIP-mode  Presence & IM 10:s of millions of RTC (SIP) users within a year 4255551212  Dial to phone  Rich SIP APIs Microsoft is pushing – New RTC is SIP-based

8. © 2003 Ingate Systems AB © 2003 Intertex Data AB 8 The Next Big Usage of the Internet! HTTP created the Web SIP will create IP Communication person to person! SMTP created Email

9. IP Phone PSTN SIP /PSTN Gateway Internet SOHO LAN Business LAN SIP Server IAP XP PIM Firewall/NAT problems! DSL Cable MTU Operator network with NAT NAT Firewall NAT Status until recently: SIP is the Protocol for IP Communication Person to Person, BUT IT DOES NOT REACH THE EDGE! So, why don’t we just connect?

10. © 2003 Ingate Systems AB © 2003 Intertex Data AB 10 What is the difference? Typical Internet protocol (SMTP, HTTP…) Internet HOST SERVER SIP (and H.323…) connects person to person Internet PERSON Locate the person - Set up a session - Open real time media streams

11. © 2003 Ingate Systems AB © 2003 Intertex Data AB 11 SIP Firewall Problems Firewall Problems: Sessions initiated from outside the firewall - OK, open port 5060, but… Media streams on dynamically allocated port numbers - Ooops…  ! Even with public IP addresses inside

12. © 2003 Ingate Systems AB © 2003 Intertex Data AB 12 SIP NAT/PAT Problems NAT & PAT Problems: Where is the device? - Registration/location function Private IP addresses and ports in SIP messages - Rewrite with globally routable addresses IP address and port of media stream has to be modified - NAT engine has to be dynamically controlled Worse with private IP addresses inside

13. © 2003 Ingate Systems AB © 2003 Intertex Data AB 13 Suggested Solutions Dynamically controlled Firewall/NATs Midcom: By Firewall Control Proxy (IETF work) uPnP: By the client (Windows) SIP aware Firewall/NATs (SIP Proxy + Registrar) General, handles complex scenarios [Intertex (SOHO), Ingate (enterprise), …] SIP aware Firewall/NATs (SIP ALG – non Proxy) TLS not possible STUN - Can cope with certain types of existing NATs SIP clients need to get STUN into their SIP stacks Requires STUN servers on the net, RTCP is lost Tunnelling - Connects SIP clients to an operator or a corporate LAN Requires ALG for each client with NATed address Tunnels by IPSec or proprietary

14. Firewall/NAT problems! Firewall/NAT SIP transparency! Office or home LAN IP Phone SIP Server PSTN SIP /PSTN Gateway Operator network with NAT Internet NAT Firewall NAT Enterprise LAN DSL Cable MTU DMZ inGate SIParator SIP Enabling the Private Networks inGate Firewall IP Phone IX66 IAP

15. © 2003 Ingate Systems AB © 2003 Intertex Data AB 15 Adding General SIP Traversal to a Firewall Important components: Firewall & NAT Dynamic Firewall Engine SIP Proxy SIP Proxy Server, controlling the firewall User Location SIP Registrar, user location information Firewall Control Protocol Communication between SIP Proxy and firewall In the Ingate and Intertex products: You got a SIP server! Use it just for firewall traversal AND/OR as your - SIP Server - Outgoing proxy - Inbound proxy What have you got?

16. Internet Just Another Internet Service… Enterprise LAN XP inGate Firewall PSTN SIP /PSTN Gateway DNS SRV DMZ inGate SIParator XP Ingate Linköping LAN IX66 Intertex Stockholm LAN Sweden IX66 FWD Booth #301 IX66 SIP Forum Booth #210 USA Sweden IX66 Home Office Users SOHO LAN IX66 XP San Jose Booth #520

17. IP Communications Using IP Networks Intranet IP VPN with IP communications Domestic and global IP communications PBX and PSTN – E.164 resolution Customer Premises PBX PSTN Phone Managed Services Router Vmail OSS SIP Phone WorldCom PSTN Dialing Plans Network GWY Conf PSTN Phone IM IN Enterprise Gateway SIP Routing Firewall SIP Server IP VPN Global IP Comm Intranet IP Comm …other… Many call routing options: Private/Public IP address DNS and DNS SRV records SIP aware NAT/PAT servers Henry Sinnreich 4/10/2002 WorldCom Public IP Network

18. IP Communications Using IP Networks PBX PSTN Phone Managed Services Router Vmail OSS SIP Phone WorldCom PSTN Dialing Plans Network GWY Conf PSTN Phone IM IN Enterprise Gateway SIP Routing Firewall SIP Server IP VPN Global IP Comm Intranet IP Comm …other… Integration with existing phones SIP Capable Firewall Ingate and Intertex First through SIT Customer Premises No IP PBX Needed! Enhanced Functionality Enterprise LAN WorldCom Public IP Network

19. Firewall Presence IM Greenwich Edge Proxy DMZ Microsoft Greenwich Home Server: Presence IM Audio Video Data Col. TLS

20. © 2003 Ingate Systems AB © 2003 Intertex Data AB 20 Product Examples – Ingate Systems AB Complete Firewalls Add-on to Existing Firewalls  Firewall & NAT/PAT  SIP Proxy  SIP Registrar Enterprise Products DMZ Existing Firewall SIParator

21. © 2003 Ingate Systems AB © 2003 Intertex Data AB 21 Product Examples – Intertex Data AB IX66 Internet Gate with or without ADSL modem built-in OEM as: Telia SurfinBird Gate PowerBit SafeGate Review at: www.adslguide.org.uk/hardware/reviews/2002/q1/intertex_ix66-edflc.asp SOHO Products

22. © 2003 Ingate Systems AB © 2003 Intertex Data AB 22 The Intertex IX66 Internet Gate A closer look  Firewall & NAT/PAT Router  SIP Proxy and Registrar  DHCP Server and Client  WEB Server for configuration  Smart Card Reader for security applications  Optional 802.11b Wireless Lan  SIP Appliance Control, LAC via expansion port Optional ADSL and Splitter Built-in

23. © 2003 Ingate Systems AB © 2003 Intertex Data AB 23 SIP Capable Firewalls! Ingate Systems AB www.ingate.com Box 10013, Slakthusplan 4 SE-121 26 Stockholm, Sweden CEO Olle Westerberg olle.westerberg@ingate.com Tel +46 8 6007750 Intertex Data AB www.intertex.se Rissneleden 45 SE-174 44 Sundbyberg, Sweden President Karl Erik Ståhl karl.stahl@intertex.se Tel +46 8 6282828