Components of Expressway Media Traversal

Proxy

Default component used for media traversal

Back-to-back user agent(B2BUA)

B2BUA is an application invoked by the Proxy that fully terminates a call leg and establishes a new call leg. The call legs are then bridged together and count as different calls. When using Media encryption policy other than “Auto” B2BUA gets invoked.

B2BUA are of different kinds
• 1.B2BUA for MRA and Business-to-Business
• 2.B2BUA for SIP to H.323 Interworking
• 3.B2BUA for MS Interop

B2BUA engagement for Media: “Encrypt on behalf of”

Assent

Protocol is used for multiplexed media on Traversal server zones(Expressway E only)

Expressway-C sits on the inside (trusted side) of the enterprise network and serves the role of providing a secure, trusted, and standards-based way of connecting to Expressway-E. It acts as a traversal client to all devices behind it. This solves the problem for devices using a large number of media ports by multiplexing all of the media to a very small number of ports opened for outbound communications. It provides an authenticated and trusted connection from inside the enterprise to outside by sending a keep-alive for the traversal zone from Expressway-C to Expressway-E. Additionally, it provides a single point of contact for all Internet communications, thus minimizing the security risk.

Real-time and near real-time communication protocols such as SIP, H.323, and XMPP do not address the need to communicate with devices that might be behind a firewall. Typical communications using these protocols include the device IP address in the signaling and media, which becomes the payload of the TCP and UDP packets, respectively. When these devices are on the same internally routable network, they can successfully communicate directly with each other. The signaling IP address carried in the payload of the TCP packet is routable back to the initiating device, and vice versa. However, when the initiating device is on a different network behind a public or network edge firewall, two problems are encountered. The first problem is that the receiving device, after decoding the packet, will respond to the internal IP address carried in the payload. This IP address is typically a non-routable RFC 1918 address and will never reach the return destination. The second problem encountered is that, even if the return IP address is routable, the media (which is RTP/UDP) is blocked by the external firewall. This applies to both business-to-business and mobile and remote access communications.

Expressway-E sits at the network edge in the DMZ. It serves the role of solving both the signaling and media routing problems for SIP, H323, and XMPP, while maintaining standards interoperability. It changes the appropriate headers and IP addresses to process the media and signaling on behalf of the endpoints, devices, and application servers that are inside the network.

Traversal Media Port Range

Assent Traversal Media Ports