Re: IP communicator registration with live IP address

ahjawad1693 · ‎11-25-2009

I have CME 2821, its on LAN with 192.168.0.x IP address, and i have a firewall (Cyberoam), I have NATTED the above address with live ip address so that roaming users can just use the Live ip address and get connected. I cannot do vpn since most of the users are roaming and there is not much requirement for them to log in to the network with VPN, One more problem in configuring vpn for roaming users is limitation of internet access at office, and most of the remote users are reluctant to login to the network. My question is
1) Can i use Live IP address in Preference>tftp server .
2) Is their any special configuration to done in order to achieve this ?
3) I have already tried NAT on the firewall from Live to local IP address, but i don't see any request coming from communicator on to CME.
Any suggestions will be appreciated.
Thank YOU

Mark Thrash · ‎12-02-2009

Sorry for the delay getting back with you. We have a feature for CUCM users who have an ASA firewall on the edge called "Phone Proxy", that allows the user to point their IP Communicator, or even a Cisco 79XX phone to the outside address of the ASA, and be connected to the CUCM cluster. Unfortunately, this feature is not currently supported for CUCME. The method you are using would send the RTP traffic across the Internet un-encrypted, are you sure you're okay with that? I can't say for sure why the scenario you are using is not working, a few things to check though might be:

1) verify the SCCP TCP ports are open through the firewall to the CME (another security risk for sure).

2) use a specific external address only for IP Communicators to use.

Good luck,

Mark

skilambi · ‎12-02-2009

I do have an application note that details Phone proxy support with CUCME. I thought it was available now as an option with CME 7.0.

Mark Thrash · ‎12-02-2009

Very cool - it appears I was looking at an old posting on Topic then. That being the case, Phone Proxy would the ideal solution and much more secure than the other alternative. Thanks for setting me straight.