注册 登录  
 加关注
   显示下一条  |  关闭
温馨提示!由于新浪微博认证机制调整,您的新浪微博帐号绑定已过期,请重新绑定!立即重新绑定新浪微博》  |  关闭

我的博客

 
 
 

日志

 
 

Configuring R2 A/V Edge Service for NAT  

2010-08-06 10:43:07|  分类: OCS 2007 R2 |  标签: |举报 |字号 订阅

  下载LOFTER 我的照片书  |

引用地址:http://blogs.technet.com/b/rickva/archive/2009/04/03/configuring-a_2f00_v-edge-service-for-nat.aspx


OCS 2007 R2 introduced support for configuring a firewall to perform Network Address Translation (NAT) for the A/V Edge external interface. This option is available only with the Single Consolidated Topology as shown in figure 1.0.

When configuring the A/V Edge for NAT it’s possible that remote users (both employees and federated) will be able to establish IM connectivity and view presence data but not escalate the conversation to an audio session. The call will typically appear to connect but then drop within about 5 seconds with the error message: The call was disconnected because you stopped receiving audio from firstName lastName. Please try the call again.”

Figure 1.0 – Typical AV Edge Configured for NAT

EdgeSingleConsolidatedR2(ISO)_AVNAT

Cause:

The error only occurs when remote users are trying to establish a MOC to MOC audio conference with an internal user (with 2 remote MOC clients, the audio stream is point to point between them via the Internet).

The error is caused by a change in R2 A/V Edge service behavior. When the “External IP address is translated by NAT” checkbox is checked, it signals the A/V Edge service to provide the Pool front end server with the IP address associated with A/V Edge’s external FQDN. That IP address is then returned to the remote client via in-band provisioning and if it happens to be the NAT’d IP address of the A/V Edge service instead of the Public IP address, the remote MOC client will not be able to connect.

Detection:

A Snooper trace of the Communicator-uccapi-0.uccapilog will look something like this:

Figure 1.1 – Snooper trace showing sample A/V Conference Initiation

AVNATSnooperTrace(contoso) 

Trace of Failed Connection:

200OK from Address Exchange (16:18:07.558) – a=candidate: list indicates which IP Addresses are available to the remote endpoint. Note that all candidates are non-routable in this trace.

AddressExchangeBAD

200OK from Candidate Promotion (16:18:13.246) – a=candidate: list indicates which IP Addresses the remote endpoint will attempt to connect to. The remote endpoint will fail when trying to connect to10.45.16.5

CandidatePromotionBAD

For comparison, the trace from a successful connection below shows that the remote endpoint will attempt to connect to a publicly routable IP address (which will NAT to the A/V Edge service’s private IP address) and the audio conferencing session will be established.

Trace of Successful Connection:

200OK from Address Exchange (16:18:07.558) – a=candidate: list indicates which IP Addresses are available to the remote endpoint. Note that 4 of the candidates are publicly addressable in this trace.

AddressExchangeGOOD

200OK from Candidate Promotion (16:18:13.246) – a=candidate: list indicates which IP Addresses the remote endpoint will attempt to connect to. The remote endpoint will succeed when trying to connect to63.123.155.5

CandidatePromotionGOOD

Prevention:

To avoid this issue perform the following 4 steps as part of the A/V Edge service configuration. And keep in mind they are unique to the single consolidated Edge topology.

Step 1 –  Configure the firewall to perform DNAT inbound and SNAT outbound for the A/V Edge external interface

In any location with multiple Edge Servers deployed behind a load balancer, the external firewall cannot function as a network address translation (NAT) device. However, in a site with only a single Edge Server deployed, the external firewall can be configured as a NAT.

If you do so, configure the NAT as a destination network address translation (DNAT) for inbound traffic—in other words, configure any firewall filter used for traffic from the Internet to the Edge Server with DNAT, and configure any firewall filter for traffic going from the Edge Server to the Internet (outbound traffic) as a source network address translation (SNAT). The A/V Edge server external interface will have a private IP address, as shown in Figure 1.2.

Figure 1.2 Sample AV Edge configuration for NAT

  AVEdgeNATIPAddress - Adobe Copy  

 

Step 2 –  Configure the Edge server to resolve the FQDN associated with public A/V Edge service to the public IP Address, not the NAT’d IP address. Using Figure 1.0 for reference; assume your A/V Edge service has a public IP address of 63.123.155.5 and a NAT’d IP address of 10.45.16.5; if you run CMD.exe from the Edge server and type ping av.contoso.com it must return 63.123.155.5

Step 3 –  Configure the A/V Edge service to support NAT by checking the “External IP address is translated by NAT” checkbox

Step 4 –  Restart the Edge server (or at least the A/V Edge service) to force the changes to take effect

Remember, if the A/V Edge external interface is not publicly addressable, federated A/V conferencing with OCS 2007 R1 clients is not an option.

  评论这张
 
阅读(904)| 评论(0)
推荐 转载

历史上的今天

评论

<#--最新日志,群博日志--> <#--推荐日志--> <#--引用记录--> <#--博主推荐--> <#--随机阅读--> <#--首页推荐--> <#--历史上的今天--> <#--被推荐日志--> <#--上一篇,下一篇--> <#-- 热度 --> <#-- 网易新闻广告 --> <#--右边模块结构--> <#--评论模块结构--> <#--引用模块结构--> <#--博主发起的投票-->
 
 
 
 
 
 
 
 
 
 
 
 
 
 

页脚

网易公司版权所有 ©1997-2017