About Ice And Turn Services; About Ice; About Turn - Cisco TelePresence Administrator's Manual

About ICE and TURN services

About ICE

ICE (Interactive Connectivity Establishment) provides a mechanism for SIP client NAT traversal. ICE is not
a protocol, but a framework which pulls together a number of different techniques such as TURN and STUN.
It allows endpoints (clients) residing behind NAT devices to discover paths through which they can pass
media, verify peer-to-peer connectivity via each of these paths and then select the optimum media
connection path. The available paths typically depend on any inbound and outbound connection restrictions
that have been configured on the NAT device. Such behavior is described in
An example usage of ICE is two home workers communicating via the internet. If the two endpoints can
communicate via ICE the VCS Expressway may (depending on how the NAT devices are configured) only
need to take the signaling and not take the media (and is therefore a non-traversal call). If the initiating ICE
client attempts to call a non-ICE client, the call set-up process reverts to a conventional SIP call requiring
NAT traversal via media latching where the VCS also takes the media and thus requires a traversal license.
For more information about ICE, see

About TURN

TURN (Traversal Using Relays around NAT) services are relay extensions to the STUN network protocol
that enable a SIP or H.323 client to communicate via UDP or TCP from behind a NAT device. Currently the
VCS supports TURN over UDP only.
For more information about TURN see
protocol, see RFC 5389.
How TURN is used by an ICE client
Each ICE client requests the TURN server to allocate relays for the media components of the call. A relay is
required for each component in the media stream between each client.
After the relays are allocated, each ICE client has 3 potential connection paths (addresses) through which it
can send and receive media:
its host address which is behind the NAT device (and thus not reachable from endpoints on the other side
n
of the NAT)
its publicly-accessible address on the NAT device
n
a relay address on the TURN server
n
The endpoints then decide, by performing connectivity checks through ICE, how they are going to
communicate. Depending upon how the NAT devices are configured, the endpoints may be able to
communicate between their public-facing addresses on the NAT devices or they may have to relay the media
via the TURN server. If both endpoints are behind the same NAT device they can send media directly
between themselves using their internal host addresses.
After the media route has been selected the TURN relay allocations are released if the chosen connection
paths do not involve routing via the TURN server. Note that the signaling always goes via the VCS,
regardless of the final media communication path chosen by the endpoints.
Capabilities and limitations
Cisco VCS Administrator Guide (X7.2)
RFC 5245.
RFC 5766, and for detailed information about the base STUN
Firewall traversal
RFC 4787.
Page 242 of 498