Solutions for SIP Trunking The SIP trunking enabler Solutions for SIP Trunking

Benefits of Ingate SIP Trunking Products for Service Providers Support for all SIP PBX’s in the market Expansion of Service Provider market of opportunity Service Provider Demarcation Point Clear point of demarcation towards customer Resolution of NAT traversal issues Security and Control Easy expansion to support Unified Communications Ingate Element Management System Efficient provisioning and monitoring

SIP Trunking and Beyond Core Functionality: NAT/Firewall traversal Interoperability between PBX and Service Provider Networks Quality of Service (QoS)` Security Service Provider Demarcation Point An Ingate solution can also enable: Connecting remote users to the PBX Secure interoffice connection WiFi mobile phone communication Multimedia communication

Benefits of SIP Trunking Monthly cost savings Single network for all communications Lower cost of Moves, Adds and Changes Disaster Recovery / Business Continuity User provisioning First step in achieving Unified Communications Voice, Video, IM, Presence, etc. Remote workers WiFi mobile phone communication SIP is the future of Telecommunications

The Ingate Products Enabling General NAT/firewall Traversal for SIP Complete Firewalls Add-on to Existing Firewalls DMZ Existing Firewall SIParator® Firewall & NAT/PAT SIP Proxy SIP Back to Back User Agent SIP Registrar

The Ingate Family 1 500 Calls* 650 Calls* 300 Calls* 150 Calls* Firewall® 1900 or SIParator® 90 Firewall® 1650 or SIParator® 65 1 500 Calls* 2 600 Mbit/s 230 000 Packets/s Possible to SW upgrade Firewall® 1550 or SIParator®55 650 Calls* 385 Mbit/s 125 000 Packets/s Firewall® 1500 or SIParator®50 300 Calls* 380 Mbit/s 75000 Packets/s Firewall® 1190 or SIParator® 19 Both the Ingate Firewall and SIParator line of products comes in different hardware platforms. It is the same software on each of them, the only different is the capacity in concurrent calls and hardware related things like number and type of interfaces and redundant power supplies that comes in the top model. Ingate’s smallest model can handle up to 40 concurrent calls while the top model can handle 1 500 simultaneous calls. If SRTP is terminated or decoded in the Ingate the capacity will decrease with 50-60%. <Next> The medium model can be software upgraded from a capacity of 150 concurrent calls to 300 and 650 calls. 150 Calls* 330 Mbit/s 28500 Packets/s 50 Calls* 50 Mbit/s 4500 Packets/s *) Calls = Concurrent RTP Sessions = SIP Trunks

Confirmed Interoperability IP-PBXs 3Com Aastra Digium / Asterisk Avaya Cisco Call Manager Ericsson MX-One Fonality Innovaphone Interactive Intelligence Iwatsu Microsoft Mitel NEC / Sphere Nortel Objectworld SER Shoretel Siemens SIP-Gear Swyx More in pipeline.... 360 Networks Airespring AT&T BandTel Bandwidth.com Broadvox Cbeyond Cellip Cordia Corporation Excel Switching Gamma Global Crossing IP-Only Juma Networks Service providers Ingate SIParator® -or- Ingate Firewall Level 3 Netlogic Nexvortex Nuvox O1 Paetec Primus RNK Telecom TDC Tele2 Toplink VoEX VoIP Unlimited Voxbone More in pipeline..... SIP Trunk Compliant with As Ingate have interoped with many IP-PBX vendors like <Repeat the one in the list> we will also guarantee interoperability for the Service Provider. The Service Provider only have to ensure interop with Ingate and then a number of different IP-PBXs will automatically be supported. <Next slide> Carrier Equipment Acme Packet Broadsoft NexPoint Sonus Sylantro See: www.siptrunk.org

The Live IP Communication Problem of the Decennium A common Network and common Protocols changed our lives: SMTP gave us global email! HTTP gave us the WEB! SIP is the Internet standard for Live IP Communication: The next step of Internet usage! Find each other and do something in real time. Telephony being just one application. IMS (SIP based) Internet email web However, SIP does not traverse the common NATs and firewalls* separating the LANs from the Internet . * Live IP Communication Requires: Locate the person Set up a session Open real time media streams FW FW FW FW LAN LAN

The Ingate SIP Architecture Firewall & NAT Router Dynamic NAT & Firewall Engine SIP Proxy SIP Proxy Server, capable of routing to/from various address spaces (NAT) The routing SIP Proxy Server controls the media through the NAT & Firewall User Location SIP Registrar for user location information

Extensive SIP Feature Set Security Far-End NAT Traversal and STUN SIP Trunking Tool Set Sol. for Remote Workers Encryption Termination / Transcoding Authentication SIP Filtering Flexible Control IP-Centrex Backup OEM Toolset SIP-ALG-only Firewalls can only do this much SIP Proxy, ALG, B2BUA, Registrar Near-End Traversal Firewall & NAT SIP Proxy, ALG, B2BUA, Registrar QoS, Taffic Mgmt ENUM Support IP-PBX Compatibility Service Provider Compatibility SIP Trunking

IP-PBX Trunk Must Meet Service Provider Trunk PSTN SIP Trunking Provider Network GW SIP System Why may Ingate be required to connect a PBX? NAT/Firewall Traversal – Must NAT to same address space! Basic SIP and Network Interoperability - E.g. Authentication, Registrations, UDP/TLS/TCP, Dynamic IP address, etc. SIP Repair - E.g. Call Transfer, Fragmented packets, Bugs, etc. Features - E.g. Remote Users, Administration (remote and local) Security - E.g. Will LAN be opened? Is the PBX designed to be public? SIP Trunk 1) 2) 3) 4) 5) 2) 3) 4) 5) 2) 3) 4) 5) VoIP & Data LAN IP- PBX PBX Type 1 Modern IP-PBXs are of this type. Media goes directly between phone and SIP Trunk.  SIP Trunk Interface   Signaling: Media: Data LAN only PBX with system phones PBX Type 1.5 VoIP & Data LAN PBX Type 2 IP- PBX Few PBXs are of this type. Asterisk with firewall (IPtables /NETfilter) can be compiled and configured this way, but requires a lot.

NAT/Firewall Traversal Problem when SIP Trunking over the Internet SIP Trunking Provider Public Internet PSTN GW SIP System SIP Trunking does not pass a SIP unaware NAT/firewall! …and the firewall cannot be opened enough to make it work because of NAT. Firewall IP-PBX Data LAN

With a SIP Trunk over the Internet, it is not really an option to just connect it to a VoIP LAN. SIP Trunking Provider Public Internet PSTN GW SIP System SIP Trunk Over the Internet Severe Security Warning! No one wants the whole Voice LAN exposed to the Internet. Any extra firewall here needs to be SIP aware or widely open. Firewall IP-PBX In enterprises where the VoIP LAN is logically separated from data LAN, it is possible to directly connect to a managed SIP Trunking service over a separate pipe (Nobody would even consider connecting such VoIP LAN directly to a SIP Trunking Service Provider offering his service on open Internet!). There are however security issues in addition to the restrictions in features a separate VoIP LAN introduces… (no PC softphones, no multimedia handsets, etc.) Data LAN VoIP LAN Who will issue a public white IP addresses to every Phone? No Soft or Multimedia Clients! ?? UC?

Ingate Firewall® Creating a Common Data and VoIP LAN for SIP-Trunking over the Internet SIP Trunking Provider Public Internet PSTN GW SIP System Remote Users Data & VoIP LAN with QoS SIP Trunk over Internet Ingate Firewall® Firewall Demarcation point and bringing SIP communication to the LAN IP PBX Data LAN Soft Clients and Multimedia Terminals

Ingate SIParator® Used with Existing Firewall for SIP Trunking Service over Internet SIP Trunking Provider Public Internet PSTN GW SIP System Remote Users Data & VoIP LAN SIP Trunk over Internet Ingate SIParator® Firewall Demarcation point and bringing SIP communication to the LAN IP-PBX Data LAN Soft Clients and Multimedia Terminals

SIP Trunking Provider Network Managed SIP Trunk Connected to Separate Enterprise VoIP LAN in Operator’s Space SIP Trunking Provider Network Public Internet GW PSTN SIP System No Remote Users! Provider: Security Warning! Managed SIP Trunk Firewall Enterprise: Security Warning! IP-PBX In enterprises where the VoIP LAN is logically separated from data LAN, it is possible to directly connect to a managed SIP Trunking service over a separate pipe (Nobody would even consider connecting such VoIP LAN directly to a SIP Trunking Service Provider offering his service on open Internet!). There are however security issues in addition to the restrictions in features a separate VoIP LAN introduces… (no remote users, no PC softphones, no multimedia handsets, etc.) Data LAN VoIP LAN Will Service Provider issue IP addresses to every Phone? No Soft or Multimedia Clients! ?? UC?

SIP Trunking Provider Network Managed SIP Trunking with SBC Adapting SIP to NAT:ed Space of the Enterprise LAN SIP Trunking Provider Network Public Internet GW PSTN SIP System No Remote Users! Enterprise: Do we dare let the Service Provider have full access to our LAN? Managed SIP Trunk Firewall IP-PBX If the SIP Trunking service provider has a Session Border Controller (SBC), he can enable the VoIP service in the same address space as the enterprise data LAN, and connect his service over a managed separate pipe to create an enterprise Data and VoIP LAN. Will the customer however dare let the Service Provider have a direct access to his LAN? Consider that there are LANs of other customers connected to the same SBC… Other customers VoIP& Data LAN

SIP Trunking Provider Network Ingate SIParator® Used with Existing Firewall for Managed SIP Trunking Service SIP Trunking Provider Network Public Internet GW PSTN SIP System Remote Users Managed SIP Trunk Firewall Ingate SIParator® IP-PBX Demarcation point and SIP communication via both WAN pipes. Data & VoIP LAN Soft Clients and Multimedia Terminals

SIP Trunking Provider Network Ingate Firewall® Creating a Common Data and VoIP LAN for Managed SIP Trunking Service SIP Trunking Provider Network Public Internet GW PSTN SIP System Remote Users Managed SIP Trunk Ingate Firewall® IP-PBX Demarcation point and SIP communication via both WAN pipes. Data & VoIP LAN Soft Clients and Multimedia Terminals

SIP Trunking Provider Network SIP Trunking Over on a Dedicated Access, with a Central SBC doing Far End NAT Traversal through NAT/FW SIP Trunking Provider Network GW Public Internet PSTN SIP System No Remote Users! Far end NAT traversal through NAT/FW by keep alive packets etc. from Operator SBC. Dedicated access for QoS. Does not work with all NATs & Firewalls. No PBX SIP normalization. Firewall Customer NAT/FW IP-PBX VoIP& Data LAN

SIP Trunking Provider Network Ingate SIParator® Used with Existing Firewall for Managed SIP Trunking Service SIP Trunking Provider Network Public Internet GW PSTN SIP System Remote Users No far end NAT traversal workaround required. Managed SIP Trunk Firewall Ingate SIParator® IP-PBX Demarcation point and SIP communication via both WAN pipes. Data & VoIP LAN

SIP Trunking Provider Network Ingate Firewall® Creating a Common Data and VoIP LAN for Managed SIP Trunking Service SIP Trunking Provider Network Public Internet GW PSTN SIP System Remote Users No far end NAT traversal workaround required. Managed SIP Trunk Ingate Firewall® IP-PBX Demarcation point and SIP communication via both WAN pipes. Data & VoIP LAN

SIP Trunking Provider Network SIP Trunking Over a Dedicated or Internet Access, with a Central SBC doing Far End NAT Traversal through CPE NAT SIP Trunking Provider Network GW Public Internet PSTN SIP System No Remote Users! Far end NAT traversal through CPE router by keep alive packets etc. from Operator SBC. Dedicated access for QoS. Does not work with all NATs & Firewalls. No PBX SIP normalization. Firewall ADSL NAT Router IP-PBX VoIP& Data LAN

SIP Trunking Provider Network SIP Trunking Over on an Internet Access, using an Ingate/Intertex CPE (Firewall/SIParator) with ADSL SIP Trunking Provider Network GW Public Internet PSTN SIP System Remote Users No far end NAT traversal workaround required. Separate Internet data access is optional. Combined Data & VoIP Service with QoS possible. ADSL FW with E-SBC ADSL 2+ Annex A/B/M Built in E-SBC with SIP NAT/Firewall Traversal, QoS and SIP normalization. Firewall IP-PBX VoIP & Data LAN

Two Ways to Provide a SIP Trunk Over a Managed Line Over the Public Internet PSTN Public Internet SIP Trunking Provider Network GW SIP System Data & VoIP LAN IP- PBX SIP Trunk over Internet Firewall PSTN SIP Trunking Provider Network GW Public Internet SIP System Managed SIP Trunk Firewall Offering SIP trunking over a “managed pipe” has become very popular, especially among ITSP’s also supplying the Internet access. SIP trunking over Internet is more economical but relies upon sufficient bandwidth being available between the Firewall and the SIP Trunking Service Provider. IP- PBX Data & VoIP LAN

SIP Trunking plug-and-play Step 1 – Address provisioning A. Connect Your Ingate according to the picture B. Type MAC address and IP address of the Ingate unit. D. Press Next and the tool will automatically provide an IP address to the Ingate. C. Select a password. No password is set default. The following two pages show the configuration of the Ingate while installing a SIP trunk. The Ingate Startup Tool with preconfigurations is being used. E. When done the SIP Trunking tool can be launched. Status information

SIP Trunking plug-and-play Step 2 – Trunking configuration A. Select ITSP from drop down menu and provide necessary account information C. Select SIParator type (only available for SIParators). D. DNS servers to use. Optional E. Optional to add and remove prefixes. B. Select IP PBX brand & IP address on your internal network. F. Configure external inter-face using DHCP or static IP Preconfigurations for a number of ITSP’s and IP-PBX’s are stored in the Startup Tool. In this example Bandtel and ShoreTel are shown. The whole configuration of the Ingate and installation of the SIP trunk should therefore not require much more more than 15 minutes! G. Configure netmask for the internal network H. When done, the tool will generate a configuration based on your input and you will automatically be redirected to the Ingate and only need to apply the configuration and you are done!

Please contact me at any time: Steve Johnson President Mail & SIP: steve@ingate.com Mobile: 1-603-557-7918 Direct: 1-603-883-6569