Firewall Traversal And Authentication; Overview; Authentication And Ntp; D14049.04 - TANDBERG VCS Administrator's Manual

Grey Headline (continued)

Firewall Traversal and Authentication

In order to control which systems can use the
VCS Expressway as a traversal server, each
VCS Control or Gatekeeper that wishes to be
its client must first authenticate with it.
Upon receiving the initial connection
request from the traversal client, the VCS
Expressway asks the client to authenticate
itself by providing a username and password.
The VCS Expressway then looks up the
client's username and password in its own
authentication database. If a match is found,
the VCS Expressway will accept the request
from the client.
The settings used for authentication depend
on the combination of client and server being
used. These are detailed in the table opposite.
All VCS and Gatekeeper traversal
clients must authenticate with the VCS
Expressway, regardless of the VCS
Expressway's Authentication Mode setting.
However, endpoint clients are only required to
authenticate if the VCS Expressway's
Authentication Mode is On.

Authentication and NTP

All VCS and Gatekeeper traversal clients
must authenticate with the VCS Expressway.
The authentication process makes use of
timestamps and requires that each system
is using an accurate system time. The
system time on a VCS is provided by a remote
NTP server. Therefore, in order for firewall
traversal to work, all systems involved must be
configured with details of an NTP server.
Overview and
Introduction Getting Started
Status

D14049.04

JULY 2008
Client
VCS Control or VCS Expressway
•
The VCS client provides its Authentication Username
Authentication Password. These are set on the VCS client via
Configuration > Authentication > Configuration, in the
Registration Credentials section.
Endpoint
•
The endpoint client provides its Authentication ID
Password.
TANDBERG Gatekeeper (version 5.2 and earlier)
•
The Gatekeeper looks up its System Name
database and retrieves the password for that name. It then provides
this name and password.
TANDBERG Gatekeeper (version 6.0 and later)
•
The Gatekeeper provides its Authentication Username
Authentication Password. These are set on the Gatekeeper via
Gatekeeper Configuration > Authentication, in the
Credentials section.
VCS Control or VCS Expressway
•
If Authentication is On on the Border Controller, the VCS client provides
its Authentication Username and Authentication
are set on the VCS client via VCS Configuration > Authentication >
Configuration, in the External Registration Credentials
•
If the Border Controller is in Assent mode, the VCS client provides
its Authentication Username. This is set on the VCS client via
Configuration > Authentication > Configuration, in the
Registration Credentials section.
System VCS Zones and
Configuration Configuration Neighbors

Overview

Server
VCS Expressway
•
and The traversal server zone for the VCS client must be configured with the
VCS Client Authentication
External VCS Configuration > Zones > Edit
•
There must also be an entry in the VCS Expressway's authentication
database with the corresponding client username and password.
VCS Expressway
•
and Authentication There must be an entry in the VCS Expressway's authentication
database with the corresponding client username and password.
VCS Expressway
•
in its own authentication The traversal server zone for the Gatekeeper client must be configured
with the Gatekeeper's
Username
Configuration > Zones > Edit
•
There must be an entry in the VCS Expressway's authentication
database that has the Gatekeeper's System name as the username,
along with the corresponding password.
VCS Expressway
•
and The traversal server zone for the Gatekeeper client must be configured
with the Gatekeeper's
External Registration VCS Expressway via
Configuration
•
There must also be an entry in the VCS Expressway's authentication
database with the corresponding client username and password.
Border Controller
•
If Authentication is On on the Border Controller, there must be an entry
Password. These in the Border Controller's authentication database that matches the
VCS client's
section.
•
If the Border Controller is in Assent mode, the traversal zone
VCS configured on the Border Controller to represent the VCS client must
External use the VCS's
field. This is set on the Border Controller via
Account
Call Bandwidth
Processing Control
154
TANDBERG VIDEO COMMUNICATIONS SERVER
Username. This is set on the VCS Expressway via
Zone, in the Configuration
System Name in the Client Authentication
field. This is set on the VCS Expressway via
Zone, in the Configuration
Authentication Username. This is set on the
VCS Configuration > Zones > Edit
section
Authentication Username and Authentication
Authentication Username in the Assent
TraversalZone > Assent >
name.
Firewall
Applications Maintenance
Traversal
ADMINISTRATOR GUIDE
section.
VCS
section.
Zone, in the
Password.
Account name
Appendices