101.2.2 as 5300 Install and Config Method for Audiocodes M3K PRI GW

8/10/2019 101.2.2 as 5300 Install and Config Method for Audiocodes M3K PRI GW

1/130

Avaya Aura AS 5300

1

101.2.2 AS 5300 Install and Config Method forAudiocodes M3K PRI GW

Product Release: AS 5300 3.0Version: Version 1.6Document Release: ApprovedIssue Date: May 02, 2012Security Classification: Avaya Confidential

Copyright 2012 AvayaAll rights reserved.

AVAYA CONFIDENTIAL: The information contained in this document is the property of Avaya. Except as

specifically authorized in writing by Avaya, the holder of this document shall keep the information containedherein confidential and shall protect same in whole or in part from disclosure and dissemination to third partiesand use same for evaluation, operation, and maintenance purposes only.


2/130


3/130

May 02, 2012 2011 Avaya Inc. 3Avaya proprietary use pursuant to company instructions

101.2.2 AS 5300 Install and Config Method for Audiocodes M3K PRI GW Version 1.6

Table of Contents

General Introduction ............................................................................................... 11

Reference: Documentat ion ..................................................................................... 12

Required Software Tools ........................................................................................ 13

Customer Supplied Materials / Informat ion ........................................................... 14

Customer Supplied Network Informat ion .............................................................. 15

1 Installation and Conf igurat ion.......................................................................... 17

1.1 Introduction........................................................................................................... 17

1.2 How to Save Configuration or Board.INI File ........................................................ 181.2.1 Via Web Interface ............................ ........................... .......................... ............... 181.2.2

Via SSH Interface ............................ ........................... .......................... ............... 18

1.3 Physical Installation of the Mediant 3000 Gateway ............................................... 20

1.4

Assign IP Address and New Install Mediant 3000 HA ........................................... 201.4.1

Assign Private IP Address Using BootP .......................... ........................... .......... 21

1.4.2

Using HTTP to Assigning GW Global IP Address and Upgrade Firmware ............ 25

1.4.3

Using HTTP to Upload Initial Default Configuration to M3K GW ......................... . 27

1.5

Generate Certificate Signing Request (CSR) for the GW ...................................... 29

1.6 Install CA Issued Certificates on the GW .............................................................. 30

1.7 Install Call Progress Tone (CPT) File on the GW .................................................. 31

1.8 Setup RSA public key for PuTTY SSH access to GW ........................................... 32

1.9 Configure SNMPv3 Secure Communication ......................................................... 36

1.10 Adding a New File to the EMS Software Manager ................................................ 38

1.11 Adding the GW to EMS ........................................................................................ 39

1.12

Use GW with HTTPS Enabled on Hardened EMS ................................................ 41

1.13

Upgrade/Downgrade the GW Firmware Using EMS ............................................. 42

1.13.1

Upgrade of GW Firmware from 5.8 to 6.2.............. ........................... .................... 42

1.13.2

Downgrade of GW Firmware from 6.2 and 5.8 ......................... ........................... . 47

1.13.3 Major Upgrade/Downgrade of GW Firmware between 5.4 and 6.2 ....................... 47

1.14 Configure DS1 Trunks for TP-8410 Board ............................................................ 481.14.1 Frame: VoIP -> PSTN -> DS1 Trunks Trunk SIP Frame .......................... .......... 48

1.14.1.1

Tab: General Settings .............................. .......................... ................... 48

1.14.1.2

Tab: ISDN Settings ............................. ........................... ....................... 49

1.14.1.3

Tab: SIP Settings ............................ .......................... .......................... .. 51

1.15 Configure the Sonet/SDH Trunk for TP-6310 Boards ........................................... 521.15.1

Frame: VoIP -> PSTN -> Trunk .......................... .......................... ........................ 52

1.15.2

Frame: Fiber Group .............................. .......................... ........................... .......... 531.15.3

Frame: VoIP -> PSTN -> Trunks ............................. .......................... ................... 55

1.15.3.1

Tab: General Settings .............................. .......................... ................... 56

1.15.3.2

Tab: ISDN Settings ............................. ........................... ....................... 57

1.15.3.3 Tab: SIP Settings ............................ .......................... .......................... .. 60

1.16 Configure NFAS Primary, Backup, NFAS Trunks .............................................. 61

1.17 Removing NFAS Group ........................................................................................ 65


4/130


Version 1.6101.2.2 AS 5300 Install and Config Method for Audiocodes M3K PRI GW

1.18 Configuring GW Parameters ................................................................................. 661.18.1

Frame: System -> System Setting ................................ .............................. ......... 67

1.18.1.1

Tab: Application Settings ................................ ............................ .......... 67

1.18.2

Frame: System -> Management................................ ............................. .............. 68

1.18.2.1

Tab: CLI Terminals Provisioning ................................................ ........... 68

1.18.3

Frame: VoIP > Network .................................................. .......................... ........... 69

1.18.3.1

Tab: QoS Settings ................................ .............................. .................. 69

1.18.4

Frame: System -> System Setting ................................ .............................. ......... 70

1.18.4.1 Tab: Security Settings .............................. .......................... ................... 701.18.5

Frame: VoIP -> Media ......................................................................................... 72

1.18.5.1

Tab: SRTP Settings ............................ .......................... ........................ 72

1.18.6

Frame: VoIP -> TDM -> TDM Frame ........................... .......................... ............... 73

1.18.6.1

Tab: System Timing ............................ .......................... ........................ 73

1.18.7

Frame: VoIP -> Media -> Media Frame ........................... ........................... .......... 74

1.18.7.1

Tab: Bypass Settings .......................... .......................... ........................ 74

1.18.7.2

Tab: Fax Settings ................................................................................. 75

1.18.7.3

Tab: Modem Settings .......................... .......................... ........................ 76

1.18.7.4

Tab: RTP Settings ................................ .............................. .................. 77

1.18.8 Frame: VoIP -> SIP ->SIP Protocol Definition ...................................... ................ 791.18.8.1 Tab: General Info ............................ .......................... .......................... .. 791.18.8.2

Tab: Proxy Server ........................... .......................... .......................... .. 80

1.18.8.3

Tab: Registration ............................................ ........................... ........... 82

1.18.8.4

Tab: Coders.......................................................................................... 83

1.18.8.5

Tab: Sup Services .......................................... .......................... ............ 84

1.18.8.6

Tab: Authentication & Security ......................... ........................... .......... 85

1.18.9

Frame: VoIP ->SIP -> SIP Endpoints .......................... .......................... ............... 86

1.18.9.1

Tab: Phones ......................... ........................... .......................... ........... 86

1.18.10

Frame: VoIP -> SIP -> SIP Routing ............................. ........................... .............. 87

1.18.10.1

Tab: Routing Modes ................................ .......................... ................... 87

1.18.10.2

Tab: IP to Hunt ...................................... .......................... ..................... 88

1.18.11Frame: VoIP -> SIP -> SIP Manipulations ................................................. ........... 891.18.11.1Tab: Definitions..................................................................................... 891.18.11.2

Tab: Destination Telecom to IP ............................. .......................... ...... 90

1.18.12

Frame: VoIP ->SIP -> SIP Advanced Configuration ................................. ............ 911.18.12.1

Tab: General Features 1 (Part 1 of 2).................................... ................ 91

1.18.12.2


1.18.12.3


1.18.12.4


1.18.12.5


1.18.12.6

Tab: Transport Info .............................................. .......................... ....... 96

1.18.12.7

Tab: Tones and Progress .................. ........................... ........................ 97

1.18.12.8

Tab: Debug .......................................................................................... 98

1.18.12.9Tab: MLPP (Part 1 of 2) .......................... ........................... ................... 991.18.12.10

Tab: MLPP (Part 2 of 2)..................... .......................... .................. 100

1.18.12.11

Tab: SIP to ISDN Cause Mapping (for Hybrid Routing) .................. 101

2 Conf igure Mult ip le Network / VLAN Address ................................................ 102

2.1.1 Prerequisites ..................................................................................................... 1022.1.2

VLAN Network Information ....................................... ........................... .............. 102

2.1.2.1

Initial IP Addresses ............................. ........................... ..................... 102

2.1.2.2

Syslog Server ............................ ........................... .......................... .... 102

2.1.2.3

Verifying the Active Blade ............................ .......................... ............. 103

2.1.3

Configuring Static Routes ................................................... ........................... .... 104

2.1.4

Configuring Multiple VLAN Interfaces............................................... .................. 105


5/130



2.1.5

Modify GW IP in AS 5300 with GW VLAN Media & Control IP ............................ 106

2.1.6

Switching Back to Single Network Interface .............................................. ......... 107

3 Configure IPv6 Address .................................................................................. 108

3.1.1

Prerequisites ..................................................................................................... 108

3.1.2

IPv6 Address Assignment for Media ...................... .......................... .................. 108

3.1.3

Configure IPv6 for Media .......................... .......................... ........................... .... 109

4

GW Securi ty Hardening .................................................................................. 110

4.1 Prerequisite Steps .............................................................................................. 1104.1.1.1

VoIP -> Security > Tab: Firewall Settings ......................... ................. 111

4.1.1.2

System -> Management > Tab: CLI Terminals Provisioning .............. 112

4.1.1.3

System -> Management > Tab: Access Settings ............................... 113

4.1.1.4

System -> System Setting > Tab: Security Settings ........................... 114

4.1.1.5 System -> Management > Tab: Access Addresses ........................... 1154.1.2 Disabling RS-232 Serial Port ......................................... .......................... .......... 116

5 Appendix-A Configuring GW in AS 5300 ....................................................... 117

5.1

Adding GW to the AS 5300 Element Manager Console ...................................... 117

5.2 Creating Service Node for the GW in AS 5300 Provisioning Manager ................ 120

5.3 Creating Logical Entity for the GW ...................................................................... 121

5.4 Translation from AS5300 to M3K GW ................................................................. 123

5.5 Troubleshooting Configuration ............................................................................ 1245.5.1

AS5300 Translation Tool ...................................... .......................... ................... 124

6 Appendix-B Trouble Shoot and Recover GW ............................................... 125

6.1

Using BootP to Install New Firmware to M3K ..................................................... 125


6/130


Version 1.6101.2.2 AS 5300 Install and Config Method for Audiocodes M3K PRI GW

List of Tables

Table 1-1: GW Default Networking Parameters ........................... .......................... .......................... .. 20

Table 1-2: SNMPv3 MG Configuration .............................................................................................. 37Table 1-3: SNMPv3 GW Configuration .......................... .......................... ........................... ............... 40

Table 1-4: GW Firmware ............................. ........................... .......................... ........................... ...... 46Table 1-5: Trunk SIP Frame -> Tab: General Settings ......................... ........................... ................... 48

Table 1-6: Trunk SIP Frame -> Tab: ISDN Settings .............................. .......................... ................... 50

Table 1-7: Trunk SIP Frame -> Tab: SIP Settings ............................ .......................... ........................ 51

Table 1-8: Transmission Setting Frame -> Tab: General Info ............................ .......................... ...... 52

Table 1-9: Frame: Fiber Group -> Sonet/SDH Table Entry - Tab: Sonet/SDH General Info ................ 54

Table 1-10: Trunk SIP Frame -> Tab: General Settings ........................... .......................... ............... 56

Table 1-11: Trunk SIP Frame -> Tab: ISDN Settings ............................ .......................... ................... 59

Table 1-12: Trunk SIP Frame ->Tab: SIP Settings ........................... .......................... ........................ 60

Table 1-13: Trunk SIP Frame -> Tab: ISDN Settings ............................ .......................... ................... 62Table 1-14: Frame: Trunk Status - Tab: ISDN Settings ............................. ........................... .............. 63Table 1-15: Frame: Trunk Status - Tab: ISDN Settings ............................. ........................... .............. 64

Table 1-16: Frame: System - > System Setting -> Tab: Application Settings ............................ .......... 67

Table 1-17: Frame: System - > Management -> CLI Terminals Provisioning ............................ .......... 68Table 1-18: Frame: General Config -> Network -> Tab: QoS Settings .............................. .................. 69

Table 1-19: Frame: System > System Setting -> Tab: Security Settings............................... .............. 70

Table 1-20: Frame: VoIP- > Media -> Media Frame -> Tab: SRTP Settings .............................. ......... 72

Table 1-21: Frame: VoIP -> TDM -> TDM Frame -> Tab: System Timing ............................. .............. 73

Table 1-22: Frame: VoIP - > Media -> Media Frame -> Tab: Bypass Settings .......................... .......... 74

Table 1-23: Frame: VoIP -> Media -> Media Frame -> Tab: Fax Settings........................ ................... 75

Table 1-24: Frame: VoIP -> Media -> Media Frame -> Tab: Modem Settings ........................... .......... 76

Table 1-25: Frame: VoIP - > Media -> Media Frame -> Tab: RTP Settings. ....................................... 77Table 1-26: Frame: VoIP - > Media -> Media Frame -> Tab: RTP Settings. ....................................... 78Table 1-27: Frame: VoIP -> SIP -> SIP Protocol Definition -> Tab: General Info ................................ 79

Table 1-28: Frame: VoIP -> SIP -> SIP Protocol Definitions -> Tab: Proxy Server ............................. . 80

Table 1-29: Frame: VoIP -> SIP -> SIP Protocol Definitions - Tab: Registration ................................. 82

Table 1-30: Frame: VoIP -> SIP -> SIP Protocol Definitions - Tab: Coders Group 0 .......................... . 83

Table 1-31: Frame: VoIP ->SIP -> SIP Protocol Definitions -> Tab: Sup Services .............................. 84

Table 1-32: Frame: SIP > Protocol Definitions Tab: Authentication & Security ............ .................... 85

Table 1-33: Frame: VoIP -> SIP -> SIP Endpoints - Tab: Phones ..................... ........................... ...... 86

Table 1-34: Frame: VoIP -> SIP - > SIP Routing - Tab: Routing Modes ............................................. 87

Table 1-35: Frame: VoIP -> SIP -> SIP Routing - Tab: IP to Hunt .......................... ........................... . 88

Table 1-36: Frame: VoIP -> SIP -> SIP Manipulations - Tab: Definitions ......................... ................... 89

Table 1-37: Frame: VoIP -> SIP -> SIP Manipulations -> Tab: Destination Telecom to IP .................. 90Table 1-38: Frame: VoIP -> SIP -> SIP Advanced Configuration -> Tab: General Features 1............. 91

Table 1-39: Frame: VoIP -> SIP -> SIP Advanced Configuration -> Tab: General Features 1............. 92




Table 1-43: Frame: VoIP -> SIP -> SIP Advanced Configuration -> Tab: Transport Info ..................... 96

Table 1-44: Frame: VoIP -> SIP -> SIP Advanced Configuration -> Tab: Tone And Progress............. 97

Table 1-45: Frame: VoIP -> SIP -> SIP Advanced Configuration -> Tab: Debug ........................... ..... 98

Table 1-46: Frame: VoIP -> SIP -> SIP Advanced Configuration -> Tab: MLPP ............................ ..... 99

Table 1-47: Frame: VoIP -> SIP -> SIP Advanced Configuration -> Tab: MLPP ............................ ... 100

Table 1-48: Frame: VoIP ->SIP -> SIP Advanced Configuration -> Tab: SIP to ISDN Cause Mapping101Table 2-1: VLAN Example IP Addresses ................................................. .......................... .............. 105Table 4-1: Frame: VoIP -> Security > Tab: Firewall Settings ............................ .......................... .... 111

Table 4-2: Frame: System -> Management > Tab: CLI Terminals Provisioning .............................. 112


7/130



Table 4-3: Frame: System -> Management > Tab: Access Settings .......................... ..................... 113

Table 4-4: Frame: System -> System Setting -> Tab: Security Settings ...................................... ..... 114

Table 4-5: Frame: General Config > Info & Security Tab: Web Access Addresses ........................... 115


8/130


9/130

May 02, 2012 2011 Avaya Inc. 9 Avaya proprietary use pursuant to company instructions


List of Figures

Figure 1-1: ACSyslog Setup Syslog for collecting logs ......................... ........................... ................... 21Figure 1-2: BootP Preferences with Private IP Addresses .............................. .......................... .......... 22Figure 1-3 BootP Client Configuration with Private IP Addresses ........................... ........................... . 23

Figure 1-4: Multiple Interface Table page........................................................................................... 25Figure 1-5: Install Server and Trusted Root Cert and Private Key ................................. ..................... 30

Figure 1-6: Install Call Progress Tone File ......................... ........................... .......................... ........... 31

Figure 1-7: PuTTY Key Generator ............................. .......................... ........................... ................... 32

Figure 1-8: PuTTY Configuration .......................... .......................... ........................... ........................ 34

Figure 1-9: Add Files to EMS Software Manager ............................. ........................... ....................... 38

Figure 1-10: Right click Globe to Add a Region ................................................................................. 39

Figure 1-11: Right click on Region to Add MG .................................................. ........................... ...... 39

Figure 1-12 Enable HTTPS on EMS .......................... .......................... .......................... .................... 41

Figure 1-13: Select the correct firmware from Software Upgrade File Manager list ............................ . 45Figure 2-1: Diagnostics Screen ....................................................................................................... 103

Figure 2-2: Color-Coding Showing Active and Redundant Blades .......................... .......................... 104

Figure 2-3: Multiple Interface Table VLAN Settings .......................... .......................... ...................... 105

Figure 6-1: BootP Client Preferences ........................................ .......................... ............................ 126Figure 6-2: BootP Client Configuration ............................... .......................... ........................... ........ 127


10/130



Setup NotesInstallation Site Name:


11/130



General Introduction

This deployment guide describes the procedures for commissioning and securing the Audiocodes

Mediant 3000 (M3K) Gateway for use with Avaya Aura Application Server 5300 Solution.

Before starting the GW installation and commissioning procedures make sure you have performed orobtained the items listed below that are described in next few pages:

Audiocodes EMS has been Installed, Configured, and Hardened

All Referenced documents are available, see next page for list of documents.

Obtain Required Software Tools

Customer Supplied Materials

Customer Network Information

This document has following major sections. These must be followed in the order they aredocumented.

Installation and Configuration

Configure Multiple Network VLAN Interfaces

Configure IPv6 Addresses

GW Security Hardening

After completing each section following two steps should be performed.

Save the gateway configuration file (BOARD.INI file)

If possible, perform a basic call between the gateway and AS 5300 11xx IP Desk phone.


12/130



Reference: Documentation

Listed below are the Audiocodes supplied documents that are referenced in this document.

Document # Manual Name

LTRT-81911 MGCP-MEGACO Release Notes

LTRT-94709 Mediant 3000 SIP-MGCP-MEGACO Installation Manual

LTRT-89711 Mediant 3000 SIP User's Manual

LTRT-94013 Element Management System (EMS) Product Description

LTRT-91018 Element Management System (EMS) Users Manual

LTRT-94130 Element Management System (EMS) Server IOM Manual

Notes:

Contact AS 5300 support if you dont have full access to the Referenceddocument listed above.

Throughout this manual and unless otherwise specified, the term device orgateway or GW refers to the Audiocodes Mediant 3000 PRI Gateway.


13/130



Required Software Tools

Before starting the installation procedure, ensure the following software tools are available:

M3K GW load file to be installed (.cmp file)

M3K GW Call Progress Tone file (.dat file)

ACSyslog.exe tool installed on the PC used for configuration

BootP M3K address configuration tool installed on the PC used for configuration

Putty telnet tool installed on the PC used for configuration

PuttyGen key generator installed on the PC used for configuration

Wireshark packet capturing tool installed on the PC used for configuration


14/130



Customer Supplied Materials / Information

The following describes the equipments that must be prepared on site by the Customer before the

Mediant 3000 can be commissioned:

L2/L3 Switch or Routers with 1Gbps ports (4 are required for High Availability) Audiocodes Element Management System (EMS) server NTP Server for the Network Time Protocol PC Terminal Console (EMS Client) to configure the M3K Gateway (Note: Installation laptop

may also be used)

Mediant 3000 (M3K) chassis installed in a 19" Telco rack Screws and Washers to install M3K in the Telco rack (if not installed in Avaya provided

ARTS frame)

ESD wrist strap and banana plug or alligator clip Phillipsscrew driver

Successful installation and configuration of the M3K is also dependent on customer supplied networkinformation. This network information must be available at the start of this method. Depending on thecustomer application, there could be numerous M3K Gateways.

Customer Supplied Network Informationon the next page lists the information required forconfiguring a single M3K Gateway. Make copies of this section and complete with the requiredinformation for each M3K Gateway.


15/130



Customer Supplied Network Information

Parameter Value Comment

EMS IP Address IP address of the Primary EMS if more than one EMSinstalled.

NTP Server IP AddressRequired for TLS configuration

Syslog Server IP AddressRequired during installation, this can be the IP Addressof the Laptop/PC used to configure M3K

M3K Gateway TP Board Settings

M3K Global IP Address

(OAM network)Public IP for reaching the M3K from AS 5300

Slot 1 private IP Address(OAM network)

Private IP of Slot 1

Slot 3 private IP Address

(OAM network)Private IP of Slot 3

Subnet Mask Prefix

(OAM network)e.g. /24 = 255.255.255.0 , /16 = 255.255.0.0

Default Gateway IPAddress

Default GW Router IP

M3K Gateway VLAN IP Addresses

M3K Media&Control

IP AddressGW Media&Control IP address when VLAN configured

OAMP (VLAN ID)/

Network IP/ Prefixe.g., (4013) / 192.168.20.0 / 24

Media&Contro (VLAN ID)/

Network IP/Prefixe.g., (4012) / 192.168.30.0 / 24

M3K Gateway IPv6 Settings

Media IPv6 IP Addresse.g., 2001:19A8:A00:200::5

Media IPv6 Netmask

Prefixe.g., 64

Media IPv6 Default GWAddress e.g., 2001:19A8:A00:200::1


16/130



M3K Gateway General Settings

EMS MG RegionFor display only the folder name in EMS is containingall M3K gateways. If none given use M3K PRIGateways as the region name

EMS MG NameFor display only, the symbolic name is given to thisM3K. If none given use AC M3K Gw-1

SNMPv3 Security Name For display only, a name chosen for SNMPv3 security.If none given use AudiocodesM3K

SNMPv3 Auth KeyThis is a secret authentication key password used inSNMPv3. Customer must provide an alphanumericauthkey. If none given temporarily use RAPtor1234

SNMPv3 Privacy KeyThis is a secret privacy key password used inSNMPv3. Set to the same value as Auth key. If noneprovided temporarily use RAPtor1234

QoS Settings Diff Serv

Network Service Class DiffServ

48 48 (default) Replace with Customer provided value ifnecessary. Used for ICMP, ARP

Premium Service ClassMedia Diff Serv 46 46 (default) Replace with Customer provided value ifnecessary. Used for RTP/SRTP Media traffic

Network Service Class DiffControl Serv

40 40 (default) Replace with Customer provided value ifnecessary. Used for Call Control/SIP traffic

Gold Network ServiceClass Diff Serv

26 26 (default) Replace with Customer provided value ifnecessary. Used for streaming traffic

Bronze Service Class DiffServ

10 10 (default) Replace with Customer provided value ifnecessary. Used for OAMP (Web/SNMP

Qos Settings VLAN Priority

Network Service ClassPriority (VLAN)

7 7 (default) Replace with Customer provided value ifnecessary.

Premium Service ClassMedia Priority (VLAN) 6 6 (default) Replace with Customer provided value ifnecessary.

Gold Service Class Priority(VLAN)


Bronze Service ClassPriority (VLAN)


Premium Service ClassControl Priority (VLAN)


Qos Settings MLPP Precedence Calls

Diff Serv 40 40 (default) Used for MLPP Call SIP Control

RTP for Routine 46 46 (default) Used for media Routine

RTP for Priority 45 45 (default) Used for media PriorityRTP for Immediate 43 43 (default) Used for media Immediate

RTP for Flash 42 42 (default) Used for media Flash

RTP for Flash-Override 41 41 (default) Used for media Flash Override

RTP for Flash-Override-Override

4141 (default) Used for media Flash Override-Override


17/130



1 Installation and Configuration

1.1 Introduction

This document provides Avaya recommendation for the Element Management System (EMS)parameter values for configuring AudioCodes ' Mediant 3000 PRI gateway to properly Interop withAvaya Aura AS 5300 Solution. The parameters are organized in this document according to thefeatures being provisioned.

Mediant 3000, housing contains one (simplex mode) or two (HA mode) of the following blade types:

TP-6310 compactPCI (cPCI) blade, providing up to three T3 or 1+1 STM-1/OC-3interfaces, and two Gigabit Ethernet interfaces

TP-8410 cPCI blade, providing up to 63 E1/84 T1 interfaces and two Gigabit Ethernetinterfaces

In Simplex mode only one card is present and there is no active and standby capability. In HA modetwo cards are present where the GW provides active and standby capability. In HA mode if activecard goes down, the standby card takes over the GW functionality.

The M3K GW provides a built-in webserver for web accessing of the device for initial device setup. Itis recommended to use Audiocodes EMS server/client for routine configuration tasks to ensure theconsistency of the configuration, auxiliary, and cmp files used in the network. The Web access shouldonly be used for initial configuration and be disabled after the gateway has been properly configuredand running properly. But, never disable the buil t-in webserver itself.

It is assumed the person configuring the GW is familiar with EMS. Refer to EMS Users Manualtoget familiar with EMS Sec-3, Sec-4, Sec-5, and Sec-6.

Throughout this manual a parameter depicts the parameter as it appears in the EMS. For adescription of the EMS parameters refer to Mediant 3000 SIP User's Manual .

To Interop properly with AS 5300 only set the values shown in each section as specified. Allother parameters can remain set with the default values shown.

Note: Please consult with Avaya before changing any parameters that are no tspecified inthis document since the GW may not function properly with AS 5300. Configure onlythe parameters documented in this document.

Always Click on Apply on EMS windows to configure parameter values. Save onlysaves value on the EMS database, but not on the GW.

Always Reset the GW with Burn option selected after configuring or changing anyparameter.


18/130



1.2 How to Save Configuration or Board.INI File

Follow one of the two ways below to save the Board.ini file. Keep incremental files when saving theconfiguration. For example, name the file as Board1.ini, Board2.ini, etc.

Always, save the Board.ini file before starting any complex configuration or when all configurationsare complete and the device is operating properly.

1.2.1 Via Web Interface

a) Http to the MP/GW and login using user/password as Admin/Admin

b) In the middle click Device Actions and select Save Configuration File

c) Click the Save INI File button to save the Board.ini file in the local PC, name it Board1.ini,Board2.ini, etc.

1.2.2 Via SSH Interface

a) SSH to the GW and login using the Username = Admin and Password = Admin for brand newGW or the passphrase for public key for secure access

b) Start logging screen output of the SSH client being used (e.g., putty)

c) Type conf at the prompt

d) Type cf view and press return until all pages are done (see below example)

e) Type exit to logout from the SSH

f) Now save off the SSH client logfile and rename it Board1.ini, Board2.ini, etc.

login as: Admin

[email protected]'s password:

SIP/ SECurity/ PStn/ DebugRecording/ MGmt/ ControlProtocol/ CONFiguration/ IPNetworking/ TPApp/ BSP/

PING SHowconf

AutoUPDate SaveAndReset RestoreAllDefaults RestoreFactorySettings SetConfigParamDefault SetConfigParamGetConfigParam GetParameterDescription CHangeUserName CHangePassWord ConfigFile

cf view ration>cf view

;**************

;** Ini File **

;**************

;Board: TP 8410 HA

;Serial Number: 1104234

;Slot Number: 1

;Software Version: 6.20A.055.001

;DSP Software Version: 491096AE3 => 620.18

;Board IP Address: 135.60.86.184

;Board Subnet Mask: 255.255.255.224

;Board Default Gateway: 135.60.86.161

;Private IP Address: 135.60.86.181

;Redundant Private IP Address: 135.60.86.183

;Ram size: 512M Flash size: 32M

;Num of DSP Cores: 126 Num DSP Channels: 504

;Profile: NORTEL-IMS


19/130



;Key features:;Board Type: TrunkPack 8410 ;Security: IPSEC MediaEncryption StrongEncryption EncryptControlProtocol;E1Trunks=8 ;T1Trunks=8 ;PSTN Protocols: IUA=84 ;Coders: G723 G729 NETCODER GSM-FR G727 ;IP Media: VXMLVoicePromptAnnounc(H248.9) CALEA ;Channel Type: RTP ATM PCI DspCh=504 ;M3K HA ;Control Protocols: MGCPMEGACO H323 SIP ;Default features:;Coders: G711 G726;

-- More --


20/130



1.3 Physical Installation of the Mediant 3000 Gateway

Please follow the Mediant 3000 SIP-MGCP-MEGACO Installation ManualSection - 2 and Section 3 for the physical description and installation procedure for the gateway. After completing physicalinstallation of the GW follow the procedure described in this document for assigning the IP address.

1.4 Assign IP Address and New Install Mediant 3000 HA

The Mediant 3000 HA houses two TP-6310 or TP-8410 blades (Active and Redundant).These twoblades each have a private IP address (different from one another) for maintenance and initialconfiguration. BootP will be used to configure these private IP addresses. In addition to these privateIP addresses, the device has a "global" IP address used by the Active blade for communicating withthe IP network and to the AS 5300 proxy. This global IP address is configured with Web or EMSmanagement tools and is a valid IP address that is different than the two private IP addresses of theblades, but has to be in the same subnet. Customer network should provide all three of these IPaddresses.

To assign the private IP addresses and the global IP to the GW use the following methods:

1. Assign the private IP addresses using BootP and upgrade the firmware2. Use HTTP to assign the Global IP address

The default networking parameters for the GW are show in Table 1-1.

Table 1-1: GW Defaul t Network ing Parameters

Parameter Defaul t Value

Private IP Addresses Blade in Slot 1: 10.1.10.10

Blade in Slot 3: 10.1.10.11

Subnet Mask 255.255.0.0

Default Gateway IP Address 0.0.0.0

Note: On existing working gateway, when using Bootp application never re-ip and send anew firmware load at the same time. Separate the steps, i.e. re-ip the box first andthen upgrade the firmware load with new IP.


21/130



1.4.1 Assign Private IP Address Using BootP

Its recommended NOT to send the initial default configuration ini file usingBootP; this can lead to accidentally wiping out the existing configuration inthe GW. Upload the ini file to the GW using the web interface.

To assign private IP, fol low these steps:

1. Make sure Bootp is installed on the PC used for configuring the M3K.

2. Make sure ACSyslog.exe is installed on the PC used for configuring the M3K

3. Connect both laptop and M3K GW(primary interface port from the back of each card) to ports of anEthernet hub or non-tagged ports of the Ethernet switch as follows:

Use a standard Ethernet cable to connect the network interface on your PC to a port on a network hub.

Use a two standard Ethernet cable to connect primary interface (GbE-1) from both cards on the backof the GW to two other ports on the same hub/switch. Hub is preferred since all packets from GW canbe sniffed with Wireshark tool

4. For temporary use, change your laptop IP address to an IP address different from the two GW private IPsbut in the same network as the GW IP address. Change PCs subnet mask to GW subnet mask.

5. On the laptop, run theACSyslog.exeapplication used for configuring the GW. ClickOptions-> Settingsand setup the Log File, Logging Method, and Text Alignment fields as shown infigure below, then click Ok to save.

6. Now click the disk icon under File menu to start collecting syslog trace. The file created for collectingtrace will be shown at the bottom status bar of the ACSyslog application. After address assignment iscomplete, remember to click this icon to stop collecting syslog trace.

Figure 1-1: ACSyslog Setup Syslog for co llecting logs


22/130



7. Use a Phillips screw driver and loosen the two screws next to the two latches on each side of Slot 1 andSlot 3 cards on the front side of GW (the bottom card is counted as Slot 1)

8. Unseat both cards from Slot 1 and Slot 3. When unseating each card press on the red latch to unlock andsimultaneously turn outward the black latch firmly from both sides. Unseat just enough to disconnect it.Never take the card out completely from its slot.

9. On the PC, run the BootPapplication (supplied with the software package).

Figure 1-2: BootP Preferences with Private IP Addresses

10. Go to BootP application and select from menu Edit -> Preferences (see figure above)

i. Select check box ARP Manipulations Enabled, set Reply Type to Broadcast and ARP Type toDynamic

ii. Select check box Enabled under TFTP Server

iii. Make sure On Interface shows the IP address temporarily assigned to the LAN port of the PC/Laptopconnected to the Hub/Switch. Note: If a different IP is shown, temporarily disable the Wireless networkon the PC/Laptop.

iv. On the Directory field click the >> next to it and select the C:\BootPFiles folder.

v. Set Boot File Mask to *.cmpvi. Set INI File Mask to *.ini

vii. Set Timeout field to 50

viii. Set Maximum Retransmissions to 29

ix. Click OK to save Preferences.


23/130



11. Login to the M3K via Web by http://10.1.10.10, then click Configuration button on the left and selectSystem -> Syslog Settings. Set the Syslog Server IP Address

to your laptop IP address and setEnable Syslog = Enable.

12. From the BootP App Services menu, choose Clients; click the Edit Clients icon ; the Client

Configuration screen is displayed. Refer to figure below as a reference.

Figure 1-3 BootP Client Configuration with Private IP Addresses

13. Click theAdd New Client icon ; a client with blank parameters is displayed

14. In the Client MAC field, enter the MAC address of the M3K Slot 1gateway. The MAC address is printedon Slot 1 card on the front.

15. Verify that the check box to the right of the Client MAC field is selected. This enables the particular clientin the BootP tool (if the client is disabled, no replies are sent to BootP requests).

16. In the Client Name field, enter a descriptive name for this client so that it's easier to remember whichgateway the record refers to. For example, this name could refer to the location of the M3K gateway. e.g.,M3K-slot1-Lackland

17. In the IP field, enter the customer provided Slot 1 private IP address of that gateway. Use the normaldotted decimal format.

18. In the Subnet field, enter the customer provided Subnet mask for that gateway slot. Use the normaldotted decimal format.

19. In the Gateway field, enter the customer provided Default GW IP address.

20. In the TFTP Server IP make sure your PCs IP is displayed. Note: If its PC is a laptop with Wirelessnetwork, temporarily disable it, so only IP configured for LAN connection to the Hub/Switch is displayed.


24/130



21. ClickApplyto save this entry to the list of clients.

22. Now for the Slot 3card, create another entry based on the Slot 1 entry, by just changing the Client MAC,Client Name, and IP field, then Click Apply to save a new entry for the Slot 3 card.

23. Click on each entry one at a time and verify that the data of all fields are entered correctly.

24. Click OK; the Client Configuration screen closes. Keep the BootP application running.

25. Start Wireshark program and start capturing packets to see whats occurring on the network.

26. Now reseat the Slot 1 card (you should hear a click when fully reseated) and it should send a BootPrequest to the network and the PC running BootP sends the new private IP address to this card.

27. To confirm new IP address was assigned successfully, check the Wireshark captures to verify Slot 1 cardis using the new IP address.

28. If IP assign fails via BootP method (using firmware load 5.8 or 6.2), then do the following alternate methodto assign IP address, otherwise if bootp method was successful then skip this step and go to the next step.

Follow this alternate method for assigning IP address and upgrading firmware:

Use Putty to SSH to the M3K default IP (for new install) or existing private IP of Slot-1 withuser/password as Admin/Admin to access the CLI interface.

At the prompt CLI prompt type conf

Type gcp ipto list the current global IP and private IP of this card.

Type the exact scpcommand below to set the private IP address. Add space to separate each item.scp ip < default gw>

e.g., scp ip 10. 13. 77. 7 255. 255. 0. 0 10. 13. 0. 1sar to Save and Reset this card

29. Now un-seat the Slot 1 card.

30. Re-seat the Slot 3 card and repeat the same process of assigning and verifying the Slot 3 private IPaddress.

31. Un-seat the Slot 3 card.

32. Now the private IP assignment is complete.

33. Close Bootp after finish


25/130



1.4.2 Using HTTP to Assigning GW Global IP Address and Upgrade Firmware

Make sure the private IP address of each card have been successfullyassigned.

To Assign Global IP address using HTTP and Upgrade Firmware, follow these steps:

1. If you are continuing from previous section, then skip this first step. Otherwise, disconnect the GW fromthe network and reconnect the GW (primary interface from the back each card) and the PC used toconfigure the GW to a Netgear hub/switch as follows:

Use a standard Ethernet cable to connect the network interface on your PC to a port on a networkhub. Use a two standard Ethernet cable to connect primary interface (GbE-1) from both cards onthe back of the GW to two other ports on the same hub/switch. Hub is preferred since all packetsfrom GW can be sniffed with Wireshark tool.

2. For temporary use, change your PCs IP address to an IP address different from the two GW private IPs inthe same network as the GW IP address. Change PCs subnet mask to GW subnet mask, and Default GWIP to the same Default GW IP used by GW.

3. Access the GWEmbedded Web Server of Slot 1

4. HTTP to web interface with the private IP addressthat you assigned to the card in Slot 1

5. Go to Configuration -> VoIP -> Network -> IP Settingspage. See Figure 4 as reference. Enter 1andclick theAddbutton and define the parameters below.

Note: If interface line already exists, then modify the parms as below.

Application type = OAMP + Media + ControlInterface Mode = IPv4 ManualIP Address = GW global IP address in dotted decimal formatPrefix Length = In Prefix formatGateway = Default GW IPVLAN ID = 1 ( if network is already VLAN configured then set VLAN ID to the same network configuredVLAN ID and scroll down in the this Webpage and set VLAN mode = 1, then reset with burn option )Interface Name = O+M+C

Figure 1-4: Multip le Interface Table page


26/130



6. Now save the configuration and Reset the device by going to Maintenance (or Management) ->Maintenance-> Maintenance Actions. Ensure that Burn To Flash is set to Yes, and then click Reset.

7. If you were unable to reset, then http with new global IP and then reset the GW with burn option set to yes.

8. After M3K resets to verify that the GW went to HA mode successfully, this time access the GW with globalIP address i.e., http://global-IP-Addressand login with Admin/Admin as user/password.

9. Then Click Device Actions-> Save Configuration File and then Saveto save a copy of the BOARD.INIfile.

10. Upgrade the firmware via Web by doing http://Slot-1-Private-IP (Slot-3 IP when doing slot 3) with Loginuser/pwd as Admin/Admin. Click Maintenance (or Management)button, then under Software Updateclick the Software Upgrade Wizard. Follow the prompt to enter the firmware file (e.g.,TP8410_SIP_F6.20A.055.001.cmp ) in your PC, then click Next to all other screens, then click Reset onthe last screen. Allow 3-4 minutes for the GW to reset.

11. For fresh installation of a GW, perform the steps to upload the initial default configuration INI file to theM3K as stated in next section.


27/130



1.4.3 Using HTTP to Upload Initial Default Configuration to M3K GW

Use this procedure for a fresh installation of a GW only. For either

Upgrading or Downgrading a GW skip this step.

Toupload init ial default configuration INI file to M3K, follow these steps:

1. This step is for a fresh installation of a GW only. For either Upgrading or Downgrading a GW skipthis step. With Windows Notepadcreate a file called M3K-Parms.iniwith only following lines, exceptchange the 47.102.228.135IP address for SyslogServerIP parameter to your PCs IP address. Place thisM3K-Parms.iniin Windows Desktop folder.

Set Def aul t OnI ni Fi l eProcess = 0

Sysl ogSer ver I P = xxx.xxx.xxx.xxx

Enabl eSysl og = 1SSHServer Enabl e = 1Di sabl eRS232 = 0Act i vi t yLi st ToLog = ' af l ' , ' dr ' , ' f b' , ' swu' , ' ar d' , ' naa' , ' spc' , ' l l 'DenyAuthent i cat i onTi mer = 60Enabl eTPNCPSecur i t y = 1Aut hor i zedTPNCPServer s=1. 1. 1. 1WebAut hMode = 0

Tel netServer Enabl e = 0WEBPasswor dCont r ol Vi aSNMP = 1FORMAT Wel comeMessage_I ndex = Wel comeMessage_Text ;Wel comeMessage 0 = ****- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - **** ;Wel comeMessage 1 = **;Wel comeMessage 2 = "** I have r ead & consent t o ter ms" ;Wel comeMessage 3 = "** i n I S user agreement . " ;Wel comeMessage 4 = **;Wel comeMessage 5 = ****- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - **** ;

2. This step is for a fresh installation of a GW only. (When Upgrading or Downgrading a GW skip th isstep). Once, the GW is back up, verify you can login to this Slot 1 via web by doing http://Slot-1-Private-IP(Slot-3 IP when doing slot 3) with Login user/pwd as Admin/Admin. Verify the firmware load versiondisplayed matches to the load upgraded. Now using Maintenance (or Management) -> SoftwareUpgradeclick Load Auxiliary files to load the INI file that was created earlier called M3K-Parms.ini.

3. Now un-seat the Slot 1 card.

4. Re-seat the Slot 3 card and repeat the same process of upgrading the Slot 3 firmware to the latest version.

5. Un-seat the Slot 3 card.

6. Close the BootP application.

7. Re-seat the Slot 1 card, then wait 5 min until Slot 1 card is back up and you can login to it via Web.

8. Now re-seat the Slot 3 card.

9. Now the GW will reset and will be back up in 5-6 min. If both cards reset properly then System and Shelf LEDs on very left hand side should be Green.

10. Login via Web to Slot 1 Private address. Then Click Device Actions -> Save Configuration File andthen click Save INI File to save a copy of the BOARD.INI file.

11. Now the private IP assignment and update firmware are complete, tighten the screws next to the latches

syslog PC address


28/130



on both cards.

12. Now reconnect the M3K GW back to the network and the PC back to the network (change the PC IP asnecessary).


29/130



1.5 Generate Certif icate Signing Request (CSR) for the GW

This section describes how to create a Certificate Signing Request (CSR) and certificates for the GW.Since, private key cannot be extracted from the GW, use the AS 5300 certmgr tool to generate acustom CSR for the GW as described in the AS 5300 MOP document 105.1.3 AS 5300 SecurityHardening. Then use certmgr again to generate the pkcs12 certificate with the key.

1. Follow the AS 5300 Security Hardening MOP steps in Sec 8 Create Certificate Signing Requeststo generate a custom CSR for the GW.

2. Submit the CSR to CA i.e., DISA PKI group to issue signed certificates.

3. Obtain in pem formatsigned leaf certificate and CA root and intermediate root certificates fromCA.

4. Again follow AS 5300 Security Hardening MOP steps in Sec 10.1.1 to install the signed cert androot certs into AS 5300 certificate database.

5. Follow AS 5300 Security Hardening MOP steps in Sec 10.1.2 to generate a gwcert.p12 PKCS12file (make a note of the pass-phrase used in creating the PKCS12 file).

6. Use the following open SSL commands to extract the key out of the gwcert.p12 PKCS12 file.$ openssl pkcs12 -nocerts -in gwcert.p12 -out gwkey-with-passphrase.pem

7. Use the following open SSL command to remove the passphrase from GW key.$ openssl rsa -in gwkey-with-passphrase.pem -outgwkey.pem

8. Rename the signed leaf certificate obtained from CA to gwcer.pem

9. Use a text editor and combine the Intermediate Root cert (listed first) followed by CA root into asingle file. The certs should be separated with begin/end only. There should be no otherinformation in the file.e.g., Call this root_combo_ca21_ca2.pem

begin CA 21 root cert

end begin

CA 2 root cert end

10. Keep these three files (gwkey.pem, gwcer.pem, root_combo_ca21_ca2.pem) in a safe placeand proceed to next section to install these files in the GW.


30/130



1.6 Install CA Issued Certif icates on the GW

Upload the certs and key from previous step into the EMS using EMS Software Manager for safestorage. Do not use EMS to install the certificates into the GW.The actual certs and key will beloaded via Web. The cert files and keys should have .pem extension.

Trusted Root Cert This is the root certificate file (e.g., root_combo_ca21_ca2.pem)

Server Cert This is the GW certificate file (e.g., gwcer.pem)

Private Key This is the key file for the GW certificate (e.g., gwkey.pem)

Before uploading server certificate and the key file. Use open SSL command to ensure you have thecorrect key file that will work with the server cert. Output from both lines below should match.

$ openssl x509 -noout -modulus -in gwcer.pem | openssl md5$ openssl rsa -noout -modulus -in gwkey.pem | openssl md5

Upload the CA provided certs and the key using the Web Interface. All certfiles and keys must be in .pem format. Before installing, edit the .pemServer cert file and ensure it only has one Begin Certificate and End

Certificate marker, i.e., multiple certs in one .pem file for Server cert isnot supported. Trusted Root cert can have multiple certs in one .pem file

Follow the steps below to load the certificates and key using WEB interface:

1. To securely install the cert and private key, ensure GW and PC are disconnected from the mainnetwork and locally connected to a private LAN using a Netgear Hub/Switch.

2. Login via Web to Global IP Addressand click Full radio button, then navigate to Configuration-> System -> Certif icates.

3. On the right Browse to your local PC to the CA provided Servercert and click Send File.

4. On the right Browse to your local PC to the CA provided Trusted Rootcert and click Send File

5. On the right Browse to your local PC to the CA provided Private Keyand click Send File

6. Using the WEB interface Save Board.ini file, then reset the GW (with the Burn to Flash optionenabled). Wait 5-6 min. then ensure you can Login to the GW via Web to Global IP.

Figure 1-5: Install Server and Trusted Root Cert and Private Key


31/130



1.7 Install Call Progress Tone (CPT) File on the GW

Upload the CPT file into the EMS using EMS Software Manager for safe storage. Do not use EMS toinstall the CPT file.The CPT file will be loaded via Web.

CPT file usa_tones_12_noheld.dat

Upload the Call Progress Tone file using the Web Interface. CPT file has.dat extension.

Follow the steps below to load the CPT file using the WEB interface:

1. To securely install the CPT file, ensure GW and PC are disconnected from the main network and locallyconnected to a private LAN using a Netgear Hub/Switch.

2. Login via Web to Global IP addressand click Full radio button, then navigate to Management ->Software Update -> Load Auxiliary Files .

3. On the right scroll down until you see Call Progress Tones file field.

4. Click Browse to your local PC to the CPT file called usa_tones_12_noheld.dat

5. Click LoadFile. The web page should indicate file loaded successfully.

6. Using the WEB interface Save the Board.ini file then reset the GW (with the Burn to Flash optionenabled). Wait for 5-6 min. then ensure you can Login via Web to Global IP address.

Figure 1-6: Install Call Progress Tone File


32/130



1.8 Setup RSA public key for PuTTY SSH access to GW

To configure RSA public keys for Windows (using PuTTY SSHsoftware), take these steps:

1. Run the file puttygen.exe (if you dont have it, search Google to get a copy) the PuTTY Key

Generator program starts, displaying the main window.2. Under Keyon the menu bar, select the option SSH-2 RSA

3. Under Parameters group, in the field 'Number of bits in a generated key ', enter "1024 bits

4. Under the Act ions group, perform the following:

a. Click Generate button and move the mouse around the screen to have key generated until itfinished.

b. Enter a Private Key Passphrase (if none given by Customer use RAPtor4321) in Keypassphrasefield.

c. Re-enter the same Private Key Passphrase in Confirm passphrasefield

5. Under the 'Actions'group, save the new private key to a file (*.ppk) on your PC, by clicking Saveprivate key.

6. Under the 'Key'group, select and COPY the displayed public keyencoded text between "ssh-rsa"and "rsakey-.",as shown in the example below:

Figure 1-7: PuTTY Key Generator


33/130



7. Create a standalone INI file called SSH-Enable.ini containing the following 4 lines. The first line(SetDefaultOnIniFileProcess = 0) will prevent the loss of any existing configuration. ForSSHAdminKeythe value below is shown from the example above. Replace it with your generatedpublc key (copied from previous step).

SetDefaultOnIniFileProcess = 0

SSHAdminKey =AAAAB3NzaC1yc2EAAAABJQAAAIB7DAJQNe3rTUnJ5r2kYV+Vh9eaqNyfyYJ/8JDPuPUbiJqDa4/w/hFs9o5su8WxxFJz6bo3BwZDNwnZvORIMpTnC4uPWCEe9xnitxAceTXBtx5w6VNQuDBswYG8iqGJbrNx4dvvofesRNpQknBW0OZ8X16wCSXCeyR7oUO8339B2w==SSHServerEnable=1TelnetServerEnable = 0

Note: The key above due to word wrap is shown in multiple lines. In the SSH-Enable.ini file the keyshould be specified in a single line. Splitting the key into multiple lines will cause error.

See the partial Notepad screenshot below how the above key specified in a single line.

8. Save the above content and close the SSH-Enable.ini file.

9. Login to the GW via WEB to the Global IP address of the GW

10. Go to Device Actions -> Load Configuration File11. Click Browse to locate SSH-Enable.ini file

12. Click Send INI Fileto upload the file and Reset the GW with burn option enabled. Allow 5-6 minutesfor the GW to reset and switch to HA. When you Log back via Web ensure on the home page High

Avai lab ili ty status is Operational.

13. Run the file PuTTY.exe; the PuTTY Configuration program starts.

14. In the 'Category' expand Connection, then SSH, and then selectAuth ; the 'Options controllingSSH authentication'pane appears.


34/130



Figure 1-8: PuTTY Configuration

15. Under the 'Authentication parameters' group, click Browse and then locate the private key file thatyou created and saved in Step 5.

16. Connect to the GW with SSH

a. At the Login prompt, enter the user name Admin.

b. At the Passphrase prompt, enter the Key Passphrasecreated at Step 4.

c. As an example, when you login to the GW using Putty, you should see the followinginteraction:


35/130



l ogi n as: Admi n* * * * - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - * * * ***** I have read & consent t o terms** i n I S user agreement .*** * * * - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - * * * *Aut hent i cat i ng wi t h publ i c key " r sa- key- 20050804"Passphr ase f or key " r sa- key- 20050804":

SI P/ SECur i t y/ MGmt / DebugRecor di ng/ Cont r ol Prot ocol / CONFi gurat i on/I PNet worki ng/ TPApp/ BSP/PI NG SHow/ >

d. If you can login with SSH using the Public Key, then proceed to the next step. If you are unableto login, rerun the private and public key generation steps from Step 1.

17. Now we will configure the GW to always require entering the passphrase for SSH login. Create a INIfile (text file called SSHRequirekey.ini) containing the following lines and load the INI fileinto theGW by loging to the GW via Web and going to Device Actions -> Load Configuration File

SetDefaultOnIniFileProcess = 0SSHRequirePublicKey = 1

18. Using the WEB interface reset the GW (with the Burn to Flash option enabled). Wait for 5-6 min. toallow the GW to completely re-initialize.

19. Now verify you can SSH to the gateway and you can access the GW using the passphrase.

20. Login to the GW via Web and Save a copy of the Board.ini file.


36/130



1.9 Configure SNMPv3 Secure Communication

This section describes how to configure the GW to support SNMPv3 communications with the EMS. Itis important to remember the Authentication and Privacy keys created at Step 4, below. These keyswill be used when the GW is added to the EMSConfigure SNMPv3 parameters on the GW

1. Login via Web to the Global IP Address of the GW.

2. In the WEB interface, open the 'Management Settings' page (Configuration -> System -> Management->SNMP-> SNMP V3 Users)

3. To add an SNMP v3 user, in the 'Add Index' field, enter 0, and then click Add button. A new row

appears.

4. Configure SNMPv3 parameters as shown in the table in the next page.5. Click Apply


37/130



Table 1-2: SNMPv3 MG Configuration

Step Parameter Name AS 5300 Recommended Value

1 User Name Enter a User nameAudiocodesM3K

2 Authentication Protocol Select from dropdown SHA-1as the Authentication Protocol.

3 Privacy Protocol Select from dropdownAES-128as the Privacy Protocol.

4 Authentication Key Enter the Authentication Key passphrase from Customer providedinformation. If none given, enter RAPtor1234.Note: Do not enter encoded hex

5 Privacy Key Enter the Privacy Key identical to Authentication Key.

6 Group Read-write

Note: Write down the Authentication and Privacy key entered:

Authent ication Key :

Privacy Key:

Note: Make sure you record in a safe place the Authentication Key and Privacy Key that has

been entered. These keys will be needed to connect to the GW as described in thenext section. Without these keys you will not be able to setup secure communicationbetween EMS and the GW.


38/130



1.10 Adding a New File to the EMS Software Manager

The GW firmware (.cmp file) is available in a DvD .iso image that can be downloaded fromhttps://support.avaya.com/css/appmanager/css/support/Downloads/P0626#wlp_Downloads_Page

EMS Client has been installed on the PC used for configuration.To add new files to the EMS Software Manager:

1. Run EMS Client application on the PC and login to the EMS server.

2. In EMS, go to Tools-> Software Manager; click theAdd Fi leicon (indicated with a plus sign in theupper left corner of the Software Manager screen) or open the Actions menu and choose the option AddFile; the Add Files screen (shown in the figure below) opens.

3. Click the icon of a folder located adjacent to the CMP to be added, and in the dialog box that opens,navigate to the file (saved in your PC); click OK.

4. Set Select Productto MEDIANT 3000 8410 or MEDIANT 3000 6310 based on blade type

5. Set Select Protocolto SIP.

6. Click OKto complete adding file to EMS Software Manager

Figure 1-9: Add Files to EMS Software Manager


39/130



1.11 Adding the GW to EMS

Before proceeding ensure that EMS Server has been fullyinstalled and hardened.

EMS Client has been installed on the PC used for configuration.

Ensure that the EMS certs have been installed on the EMS Clientand on the EMS Server to securely configure the GW.

1. Run EMS Client application on the PC and login to the EMS server.

2. In the MG Tree, right click on the Globe and select Add Region

Figure 1-10: Right click Globe to Add a Region

3. Give a descriptive Region Name and Description.

4. Right click on the Region Name created in the previous step and click Add MG

Figure 1-11: Right click on Region to Add MG


40/130



5. Enter the MG Name, IP Address, which is the Global IP address of the M3K, and a Description.

6. On the window that appears above, select SNMPv3 radio button and set the SNMPv3 parameters to theexact values that were set in previous section (see table below)

7. Click OK to add the M3K to EMS. If successful, EMS will connect to the GW and create an entry under theRegion and display a large graphics on the Status pane of EMS representing the M3K GW. The darkshaded card labeled either 6310 or 8410 represents the active card and the light blue shaded card is thestandby card.

8. Once communication with the GW is restored, Reset the GW with Burn option selected.

Table 1-3: SNMPv3 GW Configu ration


1 Security Name Enter the same User name entered for this GW.

2 Security Protocol Select the authentication protocol that was entered for this GW.

3 Authentication Key Enter the Authentication Key that was entered for this GW.

4 Privacy Protocol Enter the Privacy Protocol that was entered for this GW.

5 Privacy Key Enter the Privacy Key that was entered for this GW.


41/130



1.12 Use GW with HTTPS Enabled on Hardened EMS

Once EMS is hardened, the EMS MG communications must be done via HTTPS.Right -click on MG-> Details of the GW on EMS and select the HTTPS Enabled checkbox.

Figure 1-12 Enable HTTPS on EMS

Note: If HTTPS Enabled is not selected on hardened EMS, then any software upgrade of GWfirmware will fail.


42/130



1.13 Upgrade/Downgrade the GW Firmware Using EMS

if a new firmware load is received, upgrade the firmwarefollowing the steps in this section.

If DoD certificate has been installed on the EMS Server, then

ensure it has been installed on the EMS Client PC, otherwiseUpgrade will fail.

Always Click on Apply on EMS windows to configure parameter values.Save only saves value on the EMS database, but not on the GW.

1.13.1 Upgrade of GW Firmware from 5.8 to 6.2

The following section describe how to upgrade an existing AS 5300 2.0 M3K GW from 5.8 firmware load to AS5300 3.0 M3K GW 6.2 firmware load. Do not follow this procedure for fresh installation and configurationof AS 5300 3.0 M3K GW with 6.2 firmware load. For fresh installation o f M3K, start at the beginning of thi sdocument.

Also, follow the procedure described in this section for minor upgrade/downgrade the GW firmware between6.2.x to 6.2.y versions

1. From EMS, load the latest GW load (.cmp file) via EMS Tools -> Software Manager (see details insection 1.10 Adding a New File to the EMS Software Manager)

2. Using SSH, save a copy of the Board.ini file before performing the upgrade by following section 1.2.2 ofthis document.

3. From EMS, enable Telnet and SSH

i. For 5.8 GW, navigate in EMS toNetwork Frame -> Applications Tab; set Server Enable to enableand SSHServer Enableto enable. Click Apply then Save.


43/130



ii. For 6.2 GW, navigate in EMS toSystem->Management->CLI Terminal Frame; set the Server Enableto Enable Secured and SSH Server Enableto Enable. Click Apply then Save.

4. Enable the RS-232 serial port in M3K using SSH

Use Putty to SSH to the M3K GW as the admin user

At the CLI prompt type conf

At the prompt type the exact scp command below to enable the serial portscpDisableRS232 0sar to Save and Reset this card


44/130



5. Enable syslog in EMS

i. For 5.8 GW, navigate in EMS to Info & Security Frame -> Diagnostic tab; set the Syslogenableto Enable and enter IPof the syslog server. Click Apply then Save.

ii. For 6.2 GW, navigate in EMS to System -> System Setting in Configuration pane ->Diagnostics; set Syslog enableto Enable and enter the IPof the syslog server. Click Apply thenSave.

6. On PC, start running theACSyslog.exetool on the syslog server and start capturing syslog to a file.

7. From the EMS, select the GW and click Software Upgradeto upgrade GW firmware.

Note: If HTTPS Enabled is not selected on hardened EMS, then anysoftware upgrade of M3K GW firmware will fail.


45/130



8. Choose the correct firmware load from the list provided.

Figure 1-13: Select the correct firmware from Software Upgrade File Manager list

9. On the Popup that appears after firmware load is selected, select System Reset Upgrade. Never selectHitlessUpgrade option (see figure below).

10. After Reset when GW is back on line, right click on the GW graphics, then select Configuration ->

Upload then click Yes to the pop-up window with Question on Upload configuration from unit todatabase will detach all profiles and master profile. This will force the EMS to sync up with all GWparameters (see figures below).


46/130



11. After GW Reset, use EMS to disable Telnet Access and enable SSH Require Key if using RSA public keyfor Putty SSH access to GW.

Navigate in EMS toSystem->Management->CLI Terminal Frame; set the Server Enableto Disable,SSH Server Enableto Enable and SSH Requi re Public Keyto Enable. Click Apply then Save.

12. From EMS, disable syslog by navigating to System -> System Setting in Configuration pane ->Diagnostics; set Syslog enableto Disable. Click Apply then Save.

13. Save a new copy of the Board.ini file via SSH interface by following section 1.2.2 of this document.

Table 1-4: GW Firmware

GW Firmware Filename AS 5300 Recommendation

TP8410_SIP_F6.20A.055.001.cmp Use this or later version for M3K with 8410 cards

TP6310_SIP_F6.20A.055.001.cmp Use this or later version for M3K with 6310 cards


47/130



1.13.2 Downgrade of GW Firmware from 6.2 and 5.8

The following section describe how to downgrade an existing AS 5300 3.0 M3K GW from 6.2 firmware load to AS5300 2.0 M3K GW 5.8 firmware load. Downgrading the GW firmware from 6.2 to 5.8 is very similar to Upgradingthe M3K.

1. Save a copy of the Board.INI file via SSH interface by following section 1.2.2 of this document. Name itBoard-6.2-Original.ini

2. In section 1.13.1, perform steps 3 thru 7.

3. In section 1.13.1 in step 8, use the 5.8 firmware load

TP8410_SIP_F5.80A.045.cmp (PRI interface M3K)or TP6310_SIP_F5.80A.045.cmp (optical interface M3K).

4. Complete Step 9 thru 13 in section 1.13.1.

5. Now if this is not a permanent rollback to 5.8, then EMS can still remain in 6.2. Otherwise, if EMS needs tobe rollback to 5.8, then follow LTRT-94118_EMS_Server_IOM_Manual_v5_8.pdf to install 5.8 EMS.

6. Now the downgrade of M3K is complete.

1.13.3 Major Upgrade/Downgrade of GW Firmware between 5.4 and 6.2

Upgrading the GW firmware from 5.4 directly to 6.2 is not supported, its recommended to upgrade the GWsequentially from firmware 5.4 to 5.8 first, than from 5.8 than to 6.2. For upgrading GW firmware from 5.4 to5.8, please refer to the AS 5300 R2.0 MOP 101.2.2 AS 5300 Install and Config Method for Audiocodes M3KPRI GW and Audiocodes EMS User Manual for details on the upgrade procedure from 5.4 to 5.8. Aftersuccessfully upgrading to firmware 5.8; then follow the procedure specified in section 1.13.1 Upgrading of GWFirmware from 5.8 to 6.2.

Downgrading the GW firmware from 6.2 directly to 5.4 is not supported, its recommended to downgradesequentially from firmware 6.2 to 5.8 first, then to 5.8 than to 5.4. For downgrading firmware from 6.2 to 5.8,

follow the procedure specified in section 1.13.2 Downgrading of GW Firmware from 6.2 to 5.8. Aftersuccessfully downgrading to firmware 5.8, then refer to the AS 5300 R2.0 MOP 101.2.2 AS 5300 Install andConfig Method for Audiocodes M3K PRI GW and Audiocodes EMS User Manual for details on the downgradeprocedure from 5.8 to 5.4.


48/130



1.14 Configure DS1 Trunks for TP-8410 Board

1.14.1 Frame: VoIP -> PSTN -> DS1 Trunks Trunk SIP Frame

Trunk parameters cannot be configured without locking the trunk.

Select the Trunk row to be configured. Right click on the selected Trunk row, and then selectMaintenance-> Lockto lock the trunk. Once the trunk is locked select the Trunk SIP FrameinConfiguration pane to configure its parameters.

1.14.1.1 Tab: General Settings

Navigate to Trunk SIP Frame -> Tab: General Settings.

Table 1-5: Trunk SIP Frame -> Tab: General Settings


1 Protocol Type T1_NI2ISDN

2 Clock Master acCLOCK_MASTER_OFF

3 Framing Method T1_FRAMING_ESF_CRC6

4 Line Code acB8ZS

5 Trace Level acNO_TRACE ( set acFULL_ISDN_TRACE to debug callp issues)


49/130



1.14.1.2 Tab: ISDN Settings

Navigate to Trunk SIP Frame -> Tab: ISDN Settings.


50/130



Table 1-6: Trunk SIP Frame -> Tab: ISDN Settings


1 Termination Side acUESR_TERMINATION_SIDE

2 Q931 Layer Response Behavior 0x0

3 Incoming Calls Behavior 0x00

4 Outgoing Calls Behavior 1024

5 General CC Behavior 0x40

6 Use T1 PRI Checked (Note: This results in General CCBehavior = 0x40)

7 IUA Interface ID -1

8 D-Channel Configuration PRIMARY

9 ISDN NFAS Interface ID 255

10 Group Number 0

11 Duplicate Q931 Buff Mode 0


51/130



1.14.1.3 Tab: SIP Settings

Navigate to Trunk SIP Frame -> Tab: SIP Settings.

Table 1-7: Trunk SIP Frame -> Tab: SIP Settings


1 Progress Indicator to ISDN NotSet

2 Play Ring Back Tone To Tel PreferIp

3 Local ISDN RB Source gateway

Note: Nothing to set in tab Line Settings and the tab CAS Settings.


52/130



1.15 Configure the Sonet/SDH Trunk for TP-6310 Boards

1.15.1 Frame: VoIP -> PSTN -> Trunk

In Configuration pane Navigate to Transmission Settings-> Tab: General Info

Table 1-8: Transmission Setting Frame -> Tab: General Info


1 Transmission Type opticalSonetSdh


53/130



1.15.2 Frame: Fiber Group

Navigate to Frame Fiber Group and the Sonet/SDH table is displayed as follows:

Double-click an entry in the Sonet/SDH table or select the entry and click Properties; the Sonet/SDHParameters Provisioning screen is displayed.

8/10/2019

Date post:	02-Jun-2018
Category:	Documents
Upload:	toan-vu-dinh
View:	250 times
Download:	2 times

101.2.2 as 5300 Install and Config Method for Audiocodes M3K PRI GW

Documents