You do this by adding a traversal client zone on the VCS client (
Configuration > Zones > Zones
) and
configuring it with the details of the traversal server. See
Configuring traversal client zones [p.144]
for more
information. You can create more than one traversal client zone if you want to connect to multiple traversal
servers.
Note that:
n
In most cases, you will use a VCS Control as a firewall traversal client. However, a VCS Expressway can
also act as a firewall traversal client.
n
The firewall traversal server used by the VCS client must be a VCS Expressway.
VCS as a firewall traversal server
The VCS Expressway has all the functionality of a VCS Control (including being able to act as a firewall
traversal client). However, its main feature is that it can act as a firewall traversal server for other Cisco
systems and any traversal-enabled endpoints that are registered directly to it. It can also provide TURN relay
services to ICE-enabled endpoints.
Configuring traversal server zones
For the VCS Expressway to act as a firewall traversal server for Cisco systems, you must create a traversal
server zone on the VCS Expressway (
Configuration > Zones > Zones
) and configure it with the details of
the traversal client. See
Configuring traversal server zones [p.146]
for more information.
You must create a separate traversal server zone for every system that is its traversal client.
Configuring other traversal server features
n
For the VCS Expressway to act as a firewall traversal server for traversal-enabled endpoints (such as
Cisco MXP endpoints and any other endpoints that support the ITU H.460.18 and H.460.19 standards), no
additional configuration is required. See
Configuring Expressway and traversal endpoint communications
[p.62]
for more information.
n
To enable TURN relay services and find out more about ICE, see
About ICE and TURN services [p.63]
.
n
To reconfigure the default ports used by the VCS Expressway, see
Configuring ports for firewall traversal
[p.58]
.
Firewall traversal and Advanced Networking
The Advanced Networking option key enables the LAN 2 interface on the VCS Expressway (the option is not
available on a VCS Control). The LAN 2 interface is used in situations where the VCS Expressway is located
in a DMZ that consists of two separate networks - an inner DMZ and an outer DMZ - and your network is
configured to prevent direct communication between the two.
With the LAN 2 interface enabled, you can configure the VCS with two separate IP addresses, one for each
network in the DMZ. Your VCS then acts as a proxy server between the two networks, allowing calls to pass
between the internal and outer firewalls that make up your DMZ.
When Advanced Networking is enabled, all ports configured on the VCS, including those relating to firewall
traversal, apply to both IP addresses; you cannot configure ports separately for each IP address.
Cisco VCS Administrator Guide (X8.1.1)
Page 56 of 507
Firewall traversal
About firewall traversal
