MirrorOp on the Network
44
Administrators Guide - NMX-MM-1000 Enzo Meeting Presentation System
Firewall Traversal and ACLs
A common request is to allow an Enzo in a conference room to be available from the organizations computers on the protected
enterprise network as well as from visitor’s computers on a guest network. This can be accomplished by setting up firewall rules or
Router Access Control Lists to allow the required traffic to pass. Below are some common scenarios to choose the best logical
placement of the Enzo. A primary concern for placement of the Enzo on the Enterprise or Guest network will be the requirements
for other Enzo functions to access content.
Scenario 1: Firewalled / DMZ Guest Network
This configuration works well when MirrorOp is the primary application and the Guest network is firewalled from an Enterprise
network.
Configuration
Since all traffic is initiated by the MirrorOp Sender no configuration would be required on a standard firewall.
Limitations
Device Discovery broadcasts will not pass the firewall so the Enzo IP address (displayed on the Enzo Display when MirrorOp
is activated) will have to be entered on the MirrorOp Sender from the Enterprise network.
Enzo applications like document viewers and web browsers can’t reach content on the Enterprise network.
Scenario 2: Isolated Guest Network
This configuration is appropriate when the guest network is logically isolated from the enterprise network via an Access Control
List that does not permit traffic between the networks. It allows Enzo applications, like document viewers and web browsers, access
to content on the Enterprise network and allows guests to present via MirrorOp. MirrorOp discovery will not forward past the router
so guests will be unaware of any MirrorOp devices unless they see the Enzo screen and manually enter the information. Employees
will be able to automatically discover Enzo Mirror Op devices on the same subnet.
Configuration
An Access Control List (ACL) between the Enterprise network and the Guest network will need to be set up by the network
administrator using Enzo’s IP address and the port list from Appendix, Ports and Protocols, MirrorOp at the end of this
documents.
Scenario 3: Isolated Guest Network
This configuration is appropriate when all access to the enterprise network by guests is prohibited by policy. Guests can directly
access Enzo and employees will initiate all traffic between the Enterprise and the Guest Networks.
FIG. 79
Enzo on Fire-walled Guest Network
FIG. 80
Isolated Guest Network Scenario 1
FIG. 81
Isolated Guest Network Scenario 2
