TANDBERG Gatekeeper - Manual

TANDBERG Gatekeeper User Guide Page 7 of 105 21. Bibliography 102 22. Glossary 103 23. Index 104

TANDBERG Gatekeeper User Guide Page 8 of 105 1. Product Information 1.1. Trademarks and Copyright Copyright 1993-2006 TANDBERG ASA. All rights reserved. This document contains information that is proprietary to TANDBERG ASA. No part of this publication may be reproduced, stored in a retrieval system...

TANDBERG Gatekeeper User Guide Page 10 of 105 1.4. Operator Safety Summary For your protection please read these safety instructions completely before you connect the equipment to the power source. Carefully observe all warnings, precautions and instructions both on the apparatus and in these operat...

TANDBERG Gatekeeper User Guide Page 12 of 105 2. Introduction This User Manual is provided to help you make the best use of your TANDBERG Gatekeeper. 2.1. Main Features The main features of the TANDBERG Gatekeeper are:  IPv4 and IPv6 support.  Supports up to 2500 registered endpoints.  Supports u...

TANDBERG Gatekeeper User Guide Page 14 of 105 3. Installation 3.1. Precautions  Never install communication equipment during a lightning storm.  Never install jacks for communication cables in wet locations unless the jack is specifically designed for wet locations.  Never touch uninstalled commu...

TANDBERG Gatekeeper User Guide Page 15 of 105 3.3. Unpacking The TANDBERG Gatekeeper is delivered in a special shipping box which should contain the following components:  Gatekeeper unit  Installation sheet  User manual and other documentation on CD  Rack-ears and screws  Kit with 4 rubber fee...

TANDBERG Gatekeeper User Guide Page 16 of 105 4. Getting started 4.1. Initial Configuration The TANDBERG Gatekeeper requires some configuration before it can be used. This must be done using a PC connected to the serial port (Data 1) or by connecting to the system's default IP address: 192.168.0.100...

TANDBERG Gatekeeper User Guide Page 17 of 105 9. Review other system settings. You may want to set the following: a. The name of the Gatekeeper. This is used by the TANDBERG Management Suite (TMS) to identify the Gatekeeper. See the xConfiguration SystemUnit command (section 16.2.18) for more inform...

TANDBERG Gatekeeper User Guide Page 18 of 105 You will be presented with the Overview screen: Note: HTTP and HTTPS must be enabled in order to use the web interface. This is done using the following commands: xConfiguration HTTP Mode: <On/Off> xconfiguration HTTPS Mode: <On/Off> Note: If...

TANDBERG Gatekeeper User Guide Page 19 of 105 Note: SSH and/or Telnet access must be enabled in order to use the command line interface. This is done using the following commands: xConfiguration SSH Mode: <On/Off> xconfiguration Telnet Mode: <On/Off> Note: For secure operation you should...

TANDBERG Gatekeeper User Guide Page 20 of 105 4.4. IP Configuration The Gatekeeper may be configured to use IPv4, IPv6 or both protocols. If using both protocols, the Gatekeeper will act as a gateway if necessary, allowing calls to be made between an IPv4-only endpoint and an IPv6-only endpoint. Thi...

TANDBERG Gatekeeper User Guide Page 21 of 105 When registering, the endpoint registers with one or more of the following:  One or more H.323 IDs  One or more E.164 aliases. Users of other registered endpoints can then call the endpoint by using either the H.323 ID, a URI, an E.164 alias, or one of...

TANDBERG Gatekeeper User Guide Page 23 of 105 4.7. Alternates Alternate Gatekeeper support is provided to increase the reliability of your deployment. If one Gatekeeper becomes unavailable, perhaps due to a network or power outage, another will be used as an Alternate. Alternates share responsibilit...

TANDBERG Gatekeeper User Guide Page 24 of 105 4.8. Call Processing Overview Figure 6 illustrates the process the Gatekeeper performs when receiving call requests. Receive Request from Endpoint (ARQ) or other gatekeeper (LRQ) Locally registered endpoint?   Yes Locally registered service?  Yes No I...

TANDBERG Gatekeeper User Guide Page 26 of 105 5. Transforming Destination Aliases 5.1. Alias Transforms The Alias Transforms function takes any aliases present in ARQ and LRQ messages and runs a set of transformations on them. The resulting aliases will then be used in the normal Gatekeeper logic, e...

TANDBERG Gatekeeper User Guide Page 27 of 105 5.2. Zone Transforms It is possible to direct an incoming location request to a different alias by replacing either the prefix or the suffix of the alias with a new string. Zone transform rules are created either:  using the xconfiguration zones set of ...

TANDBERG Gatekeeper User Guide Page 28 of 105 6. Unregistered Endpoints Although most calls are made between endpoints registered with a Gatekeeper or Border Controller, it is sometimes necessary to place a call to or from an unregistered endpoint. 6.1. Calling from an Unregistered Endpoint An unreg...

TANDBERG Gatekeeper User Guide Page 30 of 105 7. Bandwidth Control 7.1. About Bandwidth Control The TANDBERG Gatekeeper allows you to control endpoints' use of bandwidth on your network. Figure 9 shows a typical network deployment: a broadband LAN, where high bandwidth calls are acceptable; a pipe t...

TANDBERG Gatekeeper User Guide Page 32 of 105 Figure 11: Configuring a pipe Pipes may be shared between one or more links. This is used to model the situation where a site communicates with several other sites over the same broadband connection to the Internet. Each link may have up to two pipes ass...

TANDBERG Gatekeeper User Guide Page 33 of 105 Figure 12: Configuring downspeeding options 7.4. Bandwidth Control and Firewall Traversal When a Border Controller and Gatekeeper are being used to traverse a firewall, an additional zone and subzone come into use, as follows:  The traversal zone is use...

TANDBERG Gatekeeper User Guide Page 34 of 105 7.5. Bandwidth Control Examples 7.5.1. Example without a firewall One possible configuration for the deployment in Figure 9 is shown in Figure 13. Each of the offices is represented as a separate subzone, with bandwidth configured according to local poli...

TANDBERG Gatekeeper User Guide Page 36 of 105 8. Registration Control The TANDBERG Gatekeeper can control which endpoints are allowed to register with it. Two separate mechanisms are provided: a simple Registration Restriction Policy, and an authentication process based on user names and passwords. ...

TANDBERG Gatekeeper User Guide Page 38 of 105 8.2. Authentication The TANDBERG Gatekeeper can use a user name and password based challenge-response scheme to permit registrations. For details of how to configure your endpoint with the appropriate information, please consult your endpoint manual. The...

TANDBERG Gatekeeper User Guide Page 41 of 105 9. URI Dialing 9.1. About URI Dialing If an alias is not located in the Gatekeeper's list of registrations, it may attempt to find an authoritative Gatekeeper through the DNS system. URI dialing makes it easier for endpoints registered with different Gat...

TANDBERG Gatekeeper User Guide Page 42 of 105 In addition, the DNS records should be updated with the address of the Border Controller as the authoritative Gatekeeper for the enterprise (see Appendix A). This ensures that calls placed using URI dialing enter and leave the enterprise through the Bord...

TANDBERG Gatekeeper User Guide Page 44 of 105 10. ENUM Dialing 10.1. About ENUM Dialing ENUM provides another DNS-based dialing scheme. Users dial an E.164 number - a telephone number - which is converted in to an H.323 URI by the DNS system. The rules for URI dialing are then followed to place the ...

TANDBERG Gatekeeper User Guide Page 46 of 105 10.3. Configuring DNS NAPTR Records ENUM relies on the presence of NAPTR records, as defined by RFC 2915 [7]. This is used to obtain an H.323 URI from the E.164 number. The record format that the Gatekeeper supports is: ;; order flag preference service r...

TANDBERG Gatekeeper User Guide Page 47 of 105 11. Example Traversal Deployments 11.1. Simple Enterprise Deployment Figure 20: Simple enterprise deployment Figure 20 shows a typical enterprise deployment. Endpoints 1001, 1002 and a Gatekeeper are deployed on a private network, separated from the publ...

TANDBERG Gatekeeper User Guide Page 48 of 105 11.1.2. Enabling incoming URI calls In order to be able to receive calls placed to example.com using URI dialing, configure the following:  Set example.com as the domain name you are using on both the Gatekeeper and Border Controller. This can be done v...

TANDBERG Gatekeeper User Guide Page 49 of 105 11.3. Dialing Public IP Addresses Figure 22: Dialing a public IP address Figure 22 shows a private endpoint (1001) calling an endpoint on a public IP address. In this case the public endpoint is not registered to a Gatekeeper and can only be reached usin...

TANDBERG Gatekeeper User Guide Page 50 of 105 11.5. URI Dialing from within the Enterprise In this example, we want to set up our system so that users from within our enterprise can use URI dialing to call a user in another enterprise. To enable this: 1. Disable Allow DNS resolution on the TANDBERG ...

TANDBERG Gatekeeper User Guide Page 51 of 105 12. Third Party Call Control 12.1. About Third Party Call Control The Gatekeeper provides a third party call control API which enables you to place calls, disconnect calls, or initiate a blind transfer of an existing call. The API is provided through the...

TANDBERG Gatekeeper User Guide Page 52 of 105 12.3.2. Enabling call transfer To enable call transfer, either: issue the command: xConfiguration Services CallTransfer Mode: <On/Off> or go to Gatekeeper Configuration -> Services and in the Call Transfer section, tick the Allow call transfer b...

TANDBERG Gatekeeper User Guide Page 53 of 105 13. Call Policy 13.1. About Call Policy Your TANDBERG Gatekeeper allows you to set up policy to control which calls are allowed and even redirect selected calls to different destinations. You specify this policy by uploading a script written in the Call ...

TANDBERG Gatekeeper User Guide Page 54 of 105 13.2. Making Decisions Based on Addresses 13.2.1. address-switch The address-switch node allows the script to run different actions based on the source or destination aliases of the call. The address-switch specifies which fields to match and then a list...

TANDBERG Gatekeeper User Guide Page 55 of 105 address The address construct is used within an address-switch to specify addresses to match. It supports the use of Regular Expressions (see Appendix C for further information). Note: All address comparisons ignore upper/lower case differences so addres...

TANDBERG Gatekeeper User Guide Page 56 of 105 13.3.2. proxy On executing a proxy node the Gatekeeper will attempt to forward the call to the locations specified in the current location set. If multiple entries are in the location set then they are treated as different aliases for the same destinatio...

TANDBERG Gatekeeper User Guide Page 58 of 105 14. Logging 14.1. About Logging The Gatekeeper provides logging for troubleshooting and auditing purposes. 14.2. Viewing the event log To view the event log, either issue the command: eventlog [n/all] where n The number of lines (from end of event log) t...

TANDBERG Gatekeeper User Guide Page 59 of 105 14.4. Event Log Format The event log is displayed in an extension of the UNIX syslog format: date time host_name facility_name <PID>: message_details where date the local date on which the message was logged time the local time at which the message...

TANDBERG Gatekeeper User Guide Page 60 of 105 14.5. Logged Events Events logged at level 1 Event Description Eventlog Cleared An operator cleared the event log. Admin Session Start An administrator has logged onto the system. Admin Session Finish An administrator has logged off the system. System Co...

TANDBERG Gatekeeper User Guide Page 64 of 105 Field Description Applicable Events Time A full UTC timestamp in YYYY/MM/DD-HH:MM:SS format. Using this format permits simple ASCII text sorting/ordering to naturally sort by time. This is included due to the limitations of standard syslog timestamps. Al...

TANDBERG Gatekeeper User Guide Page 65 of 105 15. Software Upgrading 15.1. About Software Upgrading Software upgrade can be done in one of two ways:  Using a web browser (HTTP/HTTPS).  Using secure copy (SCP). Note: To upgrade the Gatekeeper, a valid Release key and software file is required. Cont...

TANDBERG Gatekeeper User Guide Page 66 of 105 3. Browse to the file containing the software and select Install . You will see a page indicating that upload is in progress: When the upload is completed you will see the following: 4. Select Restart . You will see a confirmation window: The system will...

TANDBERG Gatekeeper User Guide Page 68 of 105 16. Command Reference This chapter lists the basic usage of each command. The commands also support more advanced usage, which is outside the scope of this document. 16.1. Status The status root command, xstatus , returns status information from the Gate...

TANDBERG Gatekeeper User Guide Page 69 of 105 16.1.5. ExternalManager xstatus ExternalManager Returns information about the external manager. The External Manager is the remote system, such as the TANDBERG Management Suite (TMS) used to manage the endpoints and network infrastructure. Address Return...

TANDBERG Gatekeeper User Guide Page 70 of 105 16.1.9. Links xstatus Links R eports call and bandwidth information for all links on the system. xstatus Links Link <index> Reports call and bandwidth information for the specified link. Name Returns the name assigned to this link Calls Returns a l...

TANDBERG Gatekeeper User Guide Page 71 of 105 16.1.13. ResourceUsage xstatus ResourceUsage Returns information about the usage of system resources. Registrations Number of currently active registrations. MaxRegistrations Maximum number of concurrent registrations since system TraversalCalls Number o...

TANDBERG Gatekeeper User Guide Page 72 of 105 16.1.16. Zones xstatus Zones Returns call and bandwidth information for all zones on the system. Also shows status of the zone as a whole and the status of each gatekeeper in the zone. 16.2. Configuration The configuration root command, xconfiguration , ...

TANDBERG Gatekeeper User Guide Page 84 of 105 16.3. Command The command root command, xcommand , is used to execute commands on the Gatekeeper. To list all xcommand s type: xcommand ? To get usage information for a specific command, type: xcommand <command_name> ? 16.3.1. AllowListAdd xCommand...

TANDBERG Gatekeeper User Guide Page 85 of 105 16.3.7. CredentialDelete xCommand CredentialDelete <index> Deletes the indexed credential. 16.3.8. DefaultLinksAdd xCommand DefaultLinksAdd Restores the factory default links for bandwidth control. 16.3.9. DefaultValuesSet xCommand DefaultValuesSet...

TANDBERG Gatekeeper User Guide Page 90 of 105 16.4. History The history root command, xhistory , is used to display historical data on the Gatekeeper. To list all xhistory commands type: xhistory ? To list all history data, type: xhistory To show a specific set of history data, type: xhistory <na...

TANDBERG Gatekeeper User Guide Page 91 of 105 16.5. Feedback The feedback root command, xfeedback , is used to control notifications of events and status changes on the Gatekeeper. A Feedback Expression describes an interesting event or change in status. When a Feedback Expression is registered, a n...

TANDBERG Gatekeeper User Guide Page 92 of 105 16.5.3. Register event xfeedback Register Event Registers for all available Events. xfeedback Register Event/ <CallAttempt/Connected/Disconnected/ConnectionFailure/Registration/ Unregistration/Bandwidth/ResourceUsage> Registers for feedback on the ...

TANDBERG Gatekeeper User Guide Page 93 of 105 16.6. Other Commands 16.6.1. about about Returns information about the software version installed on the system. 16.6.2. clear clear <eventlog/history> Clears the event log or history of all calls and registrations. 16.6.3. eventlog eventlog <n/...

TANDBERG Gatekeeper User Guide Page 94 of 105 17. Appendix A: Configuring DNS Servers In the examples below, we set up an SRV record to handle H.323 URIs of the form [email protected] These are handled by the system with the fully qualified domain name of gatekeeper1.example.com which is listening on...

TANDBERG Gatekeeper User Guide Page 95 of 105 18. Appendix B: Configuring LDAP Servers 18.1. Microsoft Active Directory 18.1.1. Prerequisites These comprehensive step-by-step instructions assume that Active Directory is installed. For details on installing Active Directory please consult your Window...

TANDBERG Gatekeeper User Guide Page 96 of 105 18.1.3. Securing with TLS To enable Active Directory to use TLS, you must request and install a certificate on the Active Directory server. The certificate must meet the following requirements:  Be located in the Local Computer's Personal certificate st...

TANDBERG Gatekeeper User Guide Page 99 of 105 19. Appendix C: Regular Expression Reference Regular expressions can be used in conjunction with a number of Gatekeeper features such as alias transformations, zone transformations, CPL policy and ENUM. The Gatekeeper uses POSIX format regular expression...

TANDBERG Gatekeeper User Guide Page 100 of 105 20. Appendix D: Technical data 20.1. Technical Specifications 20.1.1. System Capacity  2500 registered traversal endpoints  100 traversal calls at 384 kbps  500 non-traversal calls  100 zones Option keys may restrict the system to a lower capacity t...

TANDBERG Gatekeeper User Guide Page 101 of 105 20.1.9. Hardware MTBF  Hardware MTBF: 80,479 hours 20.1.10. Power Supply  250 Watt  90-264V full range @47- 63 Hz 20.1.11. Certification  LVD 73/23/EC  EMC 89/366/ECC 20.2. Approvals This product has been approved by various international approval ...

TANDBERG Gatekeeper User Guide Page 103 of 105 22. Glossary Alias The name an endpoint uses when registering with the Gatekeeper. Other endpoints can then use this name to call it. ARQ, Admission Request An endpoint RAS request to make or answer a call. DNS Zone A subdivision of the DNS namespace. e...

TANDBERG Gatekeeper User Guide Page 104 of 105 23. Index — A — about .........................................................................93 account Administrator Account........................................19 Root Account ......................................................19 Active Direct...