3 the external user calls the internal user by way of

Info icon This preview shows pages 37–39. Sign up to view the full content.

View Full Document Right Arrow Icon
3. The external user calls the internal user by way of the SIP signaling channel provided by the Access Edge service. As part of the call setup, the internal user is informed about the port on the A/V Edge service that the external user has available to exchange media. 4. The internal user contacts the A/V Edge service on its private IP address to be authenticated to receive media. The internal user is also allocated a port on the A/V Edge service public address (Lync Server 2010 uses 3478/UDP and 443/TCP) for use in the media session. After receiving the port, the internal user, again by way of the Access Edge service, answers the call and thus informs the external user of the port it has obtained on the A/V Edge service for media exchange. 5. The call setup is complete. Internal and external users begin to exchange media. In summary, to send media into the enterprise, the external user must be authenticated and have an authenticated internal user explicitly agree to exchange media streams. Lync Server 2010 uses TCP 50,000-59,999 outbound. Lync Server 2010 federating with Office Communications Server 2007 partners continues to use the port range of 50,000 – 59,999 UDP/TCP. Federation involving Lync Server 2010 partners or Office Communications Server 2007 R2 partners will use 3478/UDP and 443/TCP, and TCP 50,000-59,999 outbound. Security of end-to-end media The signaling channel used to negotiate a media session is protected using 128-bit TLS encryption with validation that the server certificate has a matching FQDN and trusted authority. This mechanism is very similar to the one that e-commerce sites use for online transactions. To enhance the security of the media itself, Lync Server 2010 implements the IETF’s SRTP protocol. The mechanism uses a 128-bit key exchange over the secure signaling channel, which the two endpoints then use to encrypt and decrypt the media stream using 128-bit Advanced Encryption Standard (AES) encryption. This ensures that even if an attacker can perform a man-in-the- middle attack of the media path, the attacker is not able to eavesdrop on the conversation or inject additional media packets. In the latter case, the client simply drops the packets. Web Conferencing Traffic Traversal Enabling Web conferencing with external users requires an Access Edge service to handle the SIP signaling that is necessary to set up and tear down a conference. It also requires a Web Conferencing Edge service to act as a proxy for the transfer of meeting content, such as slides, whiteboard, and questions and answers between internal and external users. In addition, an HTTP reverse proxy is needed to enable slide download and decryption. The call sequence is illustrated in the following figure. 33
Image of page 37

Info iconThis preview has intentionally blurred sections. Sign up to view the full version.

View Full Document Right Arrow Icon
Microsoft Lync Server 2010 Security Guide Call sequence to enable Web conferencing with outside users 1. An external user receives email containing an invitation to join a Web conference. The email contains a conference key and a URI linking to the conference. Both the key and the URI are unique for this particular meeting.
Image of page 38
Image of page 39
This is the end of the preview. Sign up to access the rest of the document.

{[ snackBarMessage ]}

What students are saying

  • Left Quote Icon

    As a current student on this bumpy collegiate pathway, I stumbled upon Course Hero, where I can find study resources for nearly all my courses, get online help from tutors 24/7, and even share my old projects, papers, and lecture notes with other students.

    Student Picture

    Kiran Temple University Fox School of Business ‘17, Course Hero Intern

  • Left Quote Icon

    I cannot even describe how much Course Hero helped me this summer. It’s truly become something I can always rely on and help me. In the end, I was not only able to survive summer classes, but I was able to thrive thanks to Course Hero.

    Student Picture

    Dana University of Pennsylvania ‘17, Course Hero Intern

  • Left Quote Icon

    The ability to access any university’s resources through Course Hero proved invaluable in my case. I was behind on Tulane coursework and actually used UCLA’s materials to help me move forward and get everything together on time.

    Student Picture

    Jill Tulane University ‘16, Course Hero Intern