User manual POLYCOM VBP V9.1.5.3 CONFIGURATION GUIDE

[. . . ] Polycom® VBPTM System Configuration Guide 9. 1. 5. 3 | January 2011 | 3725-78301-001B VBP Series Configuration Guide Trademark Information Polycom ®, the Polycom logo design, [and others that appear in your document] are registered trademarks of Polycom, Inc. TM are trademarks of Polycom, Inc. in the United States and various other countries. All other trademarks are the property of their respective owners. 4750 Willow Road Pleasanton, CA 94588-2708 USA No part of this document may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without the express written permission of Polycom, Inc. [. . . ] The public key is used to encrypt information and the private key is used to decipher it. When a CMA desktop clients points to the Access Proxy, a Secure Sockets Layer handshake authenticates the server (Access Proxy) and the client (CMAD). An encryption method is established with a unique session key and secure transmission can begin. Theory - Imagine sending mail through the postal system in a clear envelope. Anyone with access to it can see the data. If it looks valuable, they might take it or change it. An SSL Certificate establishes a private communication channel enabling encryption of the data during transmission. Encryption scrambles the data, essentially creating an envelope for message privacy. The VBP is pre-installed with self signed certificates to configure the Access Proxy. These certificates can be changed with Signed certificates, from a CA (certificate authority) if you choose to. Access Proxy can have different certificates for each protocol making the SSL encryption different for each service 78 VBP Series Configuration Guide Access Proxy Diagram This diagram shows the supported network methods for deploying remote dynamic mode based clients. The Access Proxy enabled VBP-ST is installed at the core location with the CMA server. The remote locations have standard NAT/FW devices, the list of tested and known working devices will be listed later in this document. 79 VBP Series Configuration Guide NAT routers tested Manufacture Netgear Linksys Dlink Linksys Belkin Model ­HW version WGR614-v9 WRT54GL-v1. 1 WBR-1310-B1 WRT54G2-v1 F5D9231-4-v1 SW version 1. 2. 2NA 4. 30. 11 2. 00 1. 0. 01 1. 00. 01 Multiple H. 460 endpoints Yes Yes No * Yes Yes Issues noticed none none Router tends to reboot occasionally none none * Dlink WBR-1310 can support only 1 H. 460 endpoint, the first endpoint that registers is the only endpoint that will work, even if this 1st endpoint has been powered down. This router creates "H. 323" connection tracking at the MAC layer, the only way to clear this is to reboot the router. After a reboot you can now register a new H. 460 device. Software requirements for Interoperability · · · CMA 4000/5000 server ­ 4. 01. 02 or higher (see note) CMA Desktop ­ 4. 1. 1 or higher HDX ­ 2. 5. 0. 5 or higher Note: The following issues, which may impact VBP functionality, exist in CMA 4. 01. 02. These issues are addressed in CMA version 4. 01. 04 · Duplicate Aliases ­ When a CMAD or HDX in dynamic mode moves from an internal CMA connection to an external VBP Access Proxy connection you might experience a scenario where the endpoint cannot connect to the CMA Server. An HDX endpoint is likely in this state if it displays an indicator stating that the gatekeeper service is down. A CMAD client is likely in this state if cannot progress beyond the "signing into the media server" message. In some cases, gracefully logging out of the internal location and waiting at least 10 minutes before an external login can reduce the chances of experiencing this issue. Dual Redundancy ­ When deploying 2 VBP's and 2 CMA server's for what is called "Dual Redundancy" if the MASTER CMA server fails, this forces the BACKUP CMA server to have control of all services, it is possible when this CMA failover happens, this CMA server may NOT send responses from the VIP (virtual IP) causing messages to be sent from the physical IP, the VBP is expecting messages to come from the VIP and will not be forwarded to the remote client. When deploying "Single Redundancy" 2 VBP's and 1 CMA server, If the MASTER VBP fails, the BACKUP VBP will take over and function as expected. · 80 VBP Series Configuration Guide Prerequisites CMA server installed on the LAN subnet, this subnet can be on the same broadcast domain as the VBP, however it is not required. If the CMA is on a remote LAN subnet from the VBP's providers interface, there can be NO NAT devices between these subnet's, traffic to and from the CMA and to and from the VBP need's to be on routed subnets ­ "routes" will need to be added to the VBP for all subnet's to contact the CMA and all video endpoint's. [. . . ] Before installing this equipment, users should ensure that it is permissible to be connected to the facilities of the local telecommunications company. The equipment must also be installed using an acceptable method of connection. The customer should be aware that compliance with the above conditions may not prevent degradation of service in some situations. Repairs to certified equipment should be coordinated by a representative designated by the supplier. [. . . ]