Edge Architecture

Overall Architecture 

As you can see on the schema above the Edge Solution is to be put inside one’s company DMZ.

From the external world only the Edge Solution will be seen. Only HTTPS and TURN flows should be authorized from the external - see Network Flows for more details.

The Edge Solution is composed of three components:

a Web Proxy
a SIP Proxy
and a TURN Server

These components can be installed:

on 3 separate servers - see 3 Servers Installation
or on 1 server - see 1 Server Installation

Network Flows 

From the outside (WAN to DMZ)

From

To

Ports to open

Usage

Outside

Any

Web Proxy

DMZ_IP1

TCP/443

UC Application from External Users

Outside

Any

TURN Server

DMZ_IP3

UDP/3478
TCP/3478

STUN/TURN via UDP, TCP

Outside

Any

TURN Server

DMZ_IP3

UDP/30000-39999
TCP/30000-39999

RTP Flow between remote WebRTC client and TURN Server

Internally (DMZ to LAN)

From

To

Ports destination

Usage

Web Proxy

DMZ_IP1

XiVO CC

LAN_IP1

TCP/443

Proxified UC application from Edge towards CC/UC Server

TURN Server

DMZ_IP3

Mediaservers (inc. Main)

LAN_IP2, LAN_IP3

UDP/10000-20000

RTP flow between TURN Server and Asterisk(s)

SIP Proxy

DMZ_IP2

Mediaservers (inc. main)

LAN_IP2, LAN_IP3

UDP/5060

SIP flow between Asterisk(s) and SIP Proxy

Supplementary ports for Meetingroom (DMZ to LAN)

If you have a Meetingroom server in your installation you must also open these ports from the DMZ towards the LAN:

From

To

Ports to open

Usage

Web Proxy

DMZ_IP1

XiVO

LAN_IP2

TCP/443

Proxified Meetingroom API from Edge towards XiVO Server

TURN Server

DMZ_IP3

Meetingroom

LAN_IP4

UDP/10000

RTP flow between TURN Server and Meetingroom (when using TURN)

Internally (LAN to DMZ)

Here are the flow to open between the LAN towards the Edge servers (LAN to DMZ):

From	To	Ports to open	Usage
UC Clients `Any LAN`	Web Proxy `DMZ_IP1`	TCP/443	UC Application for Internal Users
UC Clients `Any LAN`	TURN Server `DMZ_IP3`	UDP/3478 TCP/3478	STUN/TURN requests between UC Clients and TURN Server
Mediaservers (inc. Main) `LAN_IP2`, `LAN_IP3`	SIP Proxy `DMZ_IP2`	UDP/5060	SIP flow between Asterisk(s) and SIP Proxy
Mediaservers (inc. Main) `LAN_IP2`, `LAN_IP3`	TURN Server `DMZ_IP3`	UDP/3478 TCP/3478	STUN/TURN requests between Mediaservers and TURN Server
Mediaservers (inc. Main) `LAN_IP2`, `LAN_IP3`	TURN Server `DMZ_IP3`	UDP/30000-39999 TCP/30000-39999	RTP flow between Asterisk(s) and TURN Server

Supplementary ports for Meetingroom (LAN to DMZ)

If you have a Meetingroom server in your installation you must also open these ports from the LAN towards the DMZ:

From

To

Ports to open

Usage

Meetingroom

LAN_IP4

TURN Server

DMZ_IP3

UDP/3478
TCP/3478

STUN/TURN requests between Meetingroom and TURN Server

Meetingroom

LAN_IP4

TURN Server

DMZ_IP3

UDP/30000-39999
TCP/30000-39999

RTP flow between Meetingroom and TURN Server

Inside DMZ 

From/To

To/From

Ports to open

Usage

Web Proxy

DMZ_IP1

SIP Proxy

DMZ_IP2

TCP/443

Websocket for SIP

This is probably unneeded (traffic between servers inside the DMZ should be in most of the cases unfiltered), but if it would be the case this flow must be authorized.