During a Diagnosis, Vivinet Diagnostics runs two simulated VoIP telephone calls, one in each direction, between two Target Devices on the network to test VoIP performance. If a firewall is present between these devices, you need to specify a port to use for this RTP traffic.
To set a specific port for test VoIP traffic, click Firewall on the Options menu. The Call Traffic Port value in the Firewall dialog box refers to the firewall port through which simulated VoIP traffic will travel during a Diagnosis.
The port setting you supply applies only to the present Diagnosis unless you select Set As Default. When you set a new port as the default, Vivinet Diagnostics uses it in any new Diagnosis you run. You can change this value at any point. Existing results will not be affected. Click Restore Default to replace any current value with the default value. Until you change the setting and select Set As Default, the default call traffic port is AUTO, which means the Target Devices select the port dynamically during VoIP performance testing.
Vivinet Diagnostics also runs traceroute tests using RTP or ICMP packets between the Target Devices. A firewall may prevent the traceroute from providing information about the path, so configure the firewall to allow the traceroute to work.
Finally, because Vivinet Diagnostics uses SNMP to query routers and switches along the path, configure the firewall to pass SNMP traffic.
The extra configuration you do at the firewall depends on the type of firewall you are using and whether the firewall is located between the Vivinet Diagnostics Console and the Target Devices, or between the Target Devices themselves. However, for any firewall, click Firewall on the Options menu to ensure your firewall and Console settings are in agreement.
See the following topics for more information:
Network Address Translation (NAT) can disrupt VoIP networks because the addresses the firewall needs to translate are hidden within the payload of each VoIP packet. One solution is to use static NAT, which maps each IP address for points on the secure side of the firewall to its own static IP address on the non-secure side. With dynamic NAT, in which all internal IP addresses are mapped to a single external address on the unsecure side, you are unable to run a Diagnosis through the firewall because you cannot send UDP (RTP) packets to an overloaded address.
With static NAT enabled between the Target Devices, provide the static NAT IP address as the address for Endpoint 2 when you configure a Diagnosis. Vivinet Diagnostics then communicates with Target Device 1 using TCP on the secure side of the firewall.
If the firewall is located between the Console and the Target Devices, see Section 4.1.2, All Firewalls.
Use the Firewall dialog box to configure a Call Traffic Port range. Call Traffic refers to bi-directional VoIP traffic between Target Devices using RTP, which is recognized as UDP by many firewalls.
The necessary firewall and Console configuration depends on the location of the firewall in your network.
|
Location |
Configuration Details |
|---|---|
|
Firewall located between the Console and the endpoints |
Configure this firewall to pass TCP streams from the Console through port 10115 to the endpoints. |
|
Firewall located between the endpoints |
Configure this firewall to pass bi-directional VoIP (RTP) streams through a port. In addition, configure the firewall to pass bi-directional TCP and UDP streams through port 10115 — the endpoints need to be able to send setup and clock synchronization messages to each other through the firewall. In addition, configure the firewall to pass ICMP responses. On the Firewall dialog box, type the call traffic port you configured at the firewall for VoIP RTP (UDP) flows between the endpoints. The default Call Traffic Port setting, AUTO, lets the endpoints choose the port dynamically. For VoIP traffic, the endpoints use even-numbered ports between 16384 and 65534. |
|
Firewall located between the Console and Cisco IP phones |
Configure the firewall to pass TCP HTTP requests, through Port 80, to the phones selected as Target Devices. When you define the problem using phones, Vivinet Diagnostics needs to be able to contact the phones to extract information about their calls, about their network configuration, and about their CallManager. |
|
Firewall located between the Console and one or more CallManagers |
Configure the firewall to pass TCP through port 1433, the well-known port for SQL Server. Vivinet Diagnostics needs to be able to access the CallManager SQL database to retrieve CDRs. The firewall also needs to pass bi-directional UDP traffic using port 161. |
|
Firewall located between the Console and the Signaling Server and Call Server |
The telnet port (Port 23) for the Signaling Server must be open, as should the rlogin port (Port 513) for the Call Server. And, in order for AppManager to trigger a Diagnosis if the R-value trap is received, the SNMP trap port must be open. Otherwise, traps cannot pass from the Signaling Server to the trap receivers. |
|
Firewall located between the Console and network devices along the path |
Configure this firewall to pass bi-directional UDP traffic using the SNMP port (161) between the Console and network devices between the Target Devices. And it also needs to pass bi-directional UDP traffic using the TFTP port (69). |