publishing a callmanager to the internet

[m_tarawneh]

dears,

a customer want to publish one of his callmanager servers to the Internet... is there any documentation or recommendation regarding this? is it recommended or not? if yes what concerns should be considered?

regards,

[Justin Brenton]

I would suggest connecting via VPN to access the server. 

Why do the customer want to do this?

Regards,

Justin

[m_tarawneh]

the customer don't want to use the vpn, he want the users to access the callmanager via there mobile phones, having a vpn client on the mobile would make it difficult for some people and some peoples mobiles does not support the vpn client, i think if he put a subscriber on a dmz and publish it to the internet would be fine, but how to secure the server from being attacked? is there any recommendations?

[Justin Brenton]

Cisco Phone Proxy is a solution that could work for you. 

This would require that you have a Cisco ASA running IOS 8.x.

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/unified_comm_phoneproxy.html#wp1144845

http://angryciscoguy.com/jello/?p=100

HTH,

Justin

[m_tarawneh]

thanks.. this would be a good idea...

all what i need is a ASA running version 8, with UC proxy license, the license depends on the number of concurrent users right? nothing else needed from the CUCM side?

[Justin Brenton]

That's right, here's more info on the licensing for UC Proxy

http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6032/ps6094/ps6120/at_a_glance_c45-509624.pdf

On the CUCM side you will have additional configuration to support UC Proxy and it's protocols but shouldn't require additional licensing

http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/unified_comm.pdf

HTH,

Justin

[Gordon Ross]

Watch out: Phone Proxy is *very* expensive compared to VPN-type solutions. You've really got to hate having a VPN client on the device to want to go with phone proxy.

GTG