Media Application Server security
127
A Multimedia Client sends an SIP PING to the Session Manager. As the
SIP PING message traverses the firewall and or NAT or NAPT, it causes
the pinhole timers to reset and allows the path from the Multimedia Client
to the Session Manager to remain open through the firewall and/or NAT or
NAPT. The client firewall timer can be set to a value between 30 seconds
and 5 minutes and should be set less than the value of the firewall and or
NAT or NAPT device timers.
When a Multimedia Client behind a firewall and, or NAT or NAPT initiates
or joins an IM Chat session an additional path through the firewall and,
or NAT or NAPT must be established. This additional path is used for
communication between a Multimedia Client and the Media Application
Server service. The Multimedia Client is able to establish and keep open
a path to the Media Application Server service because it receives the IP
address of the Media Application Server service from the Session Manager
during the IM Chat session setup.
A Multimedia Client continues to send out SIP PING messages to the
MAS Service in order to keep the pinhole open in the Firewall and, or NAT
or NAPT in the same way as it does with the Session Manager. The end
result is that two SIP PING messages are sent out periodically. One is
sent to the Session Manager and one is sent to Media Application Server
service. The duration between SIP PING messages is configured on each
Multimedia Client.
It is important to keep in mind that firewall and, or NAT or NAPT traversal
tables should be sized appropriately for the number of clients that are behind
the firewall or NAT or NAPT network device. It is possible that each client
need more than one entry in the table depending on the usage pattern.
Multimedia Clients behind a firewall send a SIP PING regardless of the state
of the firewall and, or NAT or NAPT. If a firewall or NAT/NAPT goes out of
service, for whatever reason, the IP address and port mapping stored by
the Session Manager and any Media Application Server service the client
was communicating with, will no longer be valid.
When the firewall and or NAT or NAPT are back in service, the SIP PING
message reach the Session Manager creating a new pinhole on router(s) in
its path. Upon receipt of the SIP PING the Session Manager send a 200
OK back to the client. This message contains the new address and port
combination observed from the SIP PING the Session Manager received.
The Multimedia Client examines every 200 OK message received in
response to a SIP PING. It evaluates the address information contained in
the message. If the IP address, and port pair that it receives does not match
the IP address and port pair observed in the previous 200 OK message
the client realizes that a NAT or NAPT binding was lost and reestablished.
At this point the Multimedia Client initiates a registration sequence. The
Nortel Media Application Server
Media Application Server Planning and Engineering
NN42020-201
01.04
Standard
4.0
27 July 2007
Copyright © 2007, Nortel Networks
.
