cc/td/doc/product/access/sc/rel7/soln/wv_rel1
hometocprevnextglossaryfeedbacksearchhelp
PDF

Table of Contents

Provisioning the Gatekeeper Core
Introduction
The Gatekeeper Core and Its Components
Understanding Configuration Basics
Establishing Core Components

Provisioning the Gatekeeper Core


Introduction

This chapter presents the following major topics:

—Discusses the basic components of the gatekeeper core, namely gateways, gatekeepers, and directory gatekeepers

—Illustrates how to configure core components in a wholesale VoIP service provider network

—Provides links to online references for how to install Cisco hardware

The Gatekeeper Core and Its Components

The infrastructure of a traditional gatekeeper core functional area consists of gateways (GWs) and gatekeepers (GKs). In a typical service provider network, a number of GWs are deployed at POPs throughout the service provider's coverage area. A GK is used to group these GWs into logical zones of control and perform all call routing between the zones.

However, larger H.323 VoIP networks may consist of multiple GKs, which segment the network into numerous local zones. In this case, GKs must communicate with each other in order to route calls between GWs located in different zones. To simplify the administration of dial plans for these multi-GK networks, Cisco introduces the concept of a directory gatekeeper (DGK), which is responsible for routing calls between local GKs.

With respect to the dial plan, each component within the H.323 network is responsible for a portion of the entire VoIP dial plan. GWs are responsible for making edge routing decisions between the PSTN and the H.323 network, while GKs and DGKs handle the core call routing logic between devices within the H.323 network. The configuration requirements for each of these network components are detailed in this chapter.

For example, when presented with a call, GWs determine whether a call should be sent out to the PSTN or into the H.323 VoIP network. If a call is sent into the H.323 VoIP network, then the GW asks the GK to select the best endpoint to receive the call. From its routing table, the GK may find that this endpoint is a device within its own local zone of control, in which case the GK simply supplies the IP address of the terminating endpoint. Alternatively, it may determine that the endpoint resides under the control of another remote GK. In this case, the GK forwards the location request (LRQ) either to the remote GK directly, or through a DGK. The remote GK ultimately responds with the address of the terminating endpoint. Figure 2-1 shows the relationship of the components that constitute the gatekeeper core, with VoIP-enabled GWs providing access to the PSTN.


Figure 2-1   Components of the Gatekeeper Core


Table 2-1 summarizes the functions of the components of the gatekeeper core.

Table 2-1   Compoents of Gatekeeper Core and Their Functions

Component Function

Directory Gatekeeper (DGK)

Performs call routing search at highest level
(example: country code)

Distributes country codes among other DGKs

Forwards LRQ to partner DGK if call does not terminate in local SP DGK

Gatekeeper (GK)

Performs call routing search at intermediate level
(example: NPA-NXX)

Distributes NPA among other GKs

Provides GW resource management (examples: RAI, gw-priority)

Provides zone maintenance

Gateway (GW)

Acts as interface between PSTN and IP network

Normalizes numbers from PSTN before they enter IP network

Normalizes numbers from IP network before they enter PSTN

Contains the dial peer configuration

Registers to a GK

For an example of these components in a large-scale H.323 VoIP network, see A Large-Scale H.323 VoIP Network.

A Large-Scale H.323 VoIP Network

Figure 2-2 illustrates the relationship of GWs, GKs, and DGKs in a large-scale H.323 VoIP network.


Figure 2-2   Relationship of Gateways, Gatekeepers, and Directory Gatekeepers


The communication between GWs and GKs is based on standard H.323v2 registration, admission, and status (RAS) messages. GWs query GKs for routes by means of RAS admission request/confirm (ARQ/ACF) messages. Cisco GKs and DGKs also communicate with each other by means of RAS location request/confirm (LRQ/LCF) messages. Figure 2-3 illustrates an example RAS message sequence when phone A calls phone B. For additional information about H.323v2 RAS messaging, refer to Cisco H.323 Version 2 Phase 2, at the following URL:

http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121newft/121t/121t1/h323v2p2.htm


Figure 2-3   Example of RAS Messaging when Phone A Calls Phone B


Dial Plans and Number Normalization

This section discusses the basic principles underlying dial plans, which require configuring POTS and VoIP dial peers, and the related number-translation process known as "number normalization."

Overview of the Dial Plan

The dial plan is the method by which individual blocks of telephone numbers (technically, E.164 addresses) are assigned to physical facilities, or circuits. For large-scale service provider networks, dial plans consist of the following:

POTS dial peers define the phone numbers or prefixes of attached telephony devices, and the VoIP dial peers define the IP address of the remote device (H.323 GW, GK, or endpoint) that is connected to remote phone numbers. POTS dial peers will always point to a voice port on the router, while the destination of a VoIP dial peer will always be the IP address of a device that can terminate the VoIP call.

Distributing the H.323 Dial Plan

Good dial-plan architecture relies on effectively distributing the dial plan logic among the GW and GK components. Isolating H.323 devices to a specific portion of the dial plan reduces the complexity of the configuration, so each component can focus on accomplishing specific tasks. Generally, local POP-specific details are handled at the local GW, whereas higher-level routing decisions are passed along to the GKs and DGKs. A well-designed network consists of keeping the majority of the dial plan logic at the GK and DGK devices.

General Design Methodology

It is important to apply some basic design principles when designing a large-scale service provider dial plan.

1. Keep the design hierarchical.

Strive to keep the majority of dial plan logic (for routing decisions and failover) at the highest component level. The DGK would generally be considered the "highest" device. With a hierarchical design, the addition and deletion of zones becomes more manageable. For example, the scaling of the overall network is much easier when configuration changes must be made to only a single DGK and a single zone GK—rather than to all the zone GKs.

2. Keep provisioning simple.

Keep the dial plan on the GWs and GKs as simple and symmetrical as possible. On the GWs, try to keep consistent dial plans, using translation rules to manipulate the local digit dialing patterns. These number patterns can be "normalized" into a standard format or pattern before the digits enter the VoIP core. By putting digits into a standard format, you simplify GK zone prefix provisioning and make GW dial peer management easier.

This methodology helps to reduce dial peer configurations on the outgoing POTS interface. If the GK can be provisioned to direct only calls of a certain area code to a particular GW, then you would not need to provision all the individual GWs with their respective area codes. Instead you may be able to generalize the GW configurations. By normalizing the number, you also reduce the length of zone prefix searches—and reduce the time to search for a zone prefix match. For example, if you have the digit pattern 0118943xxxx, you can send the number as only 8943xxxx, and have the gatekeeper search on 89 instead of on 01189.

3. Reduce postdial delay.

Consider the effects of postdial delay in the network. GW/GK zone design, translation rules, and sequential LRQs all can increase postdial delay. Strive to use these tools efficiently in order to reduce postdial delay.

4. Design for availability and fault tolerance.

Consider overall network availability and call success rate. Using a Cisco alternate gatekeeper, sequential LRQs, and Hot Standby Routing Protocol (HSRP) helps to provide redundancy and fault tolerance in the H.323 network.

Establishing a Dial Plan

Designing a quality dial plan is essential to increasing network efficiency and maintainability. This section introduces a series of topics related to establishing a dial plan:

These are discussed below.

POTS and VoIP Dial Peers

Consider two VoIP-enabled access GWs, one originating and one terminating, that transport a PSTN-to-VoIP call through the IP cloud. Figure 2-4, using the example of the EMEA PSTN, illustrates this basic direct inward dial (DID) scenario.


Caution   Cisco recommends that you make routing or dialing transparent to the user. For example, where possible avoid secondary dial tones from secondary switches. Enabling direct-inward-dial suppresses secondary dial tone, and therefore DID must be enabled when a GW interfaces to a PSTN switch. The switch normally provides dial tone, but does not send dial tone to the GW when DID is enabled. This issue is discussed in Configuring Voice over IP, at the following URL:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121cgcr/multi_c/mcprt1/mcdvoip.htm


Figure 2-4   Basic DID Scenario


When DID is used on a POTS dial peer, the number that is dialed (DNIS, the number that accesses the PRI trunk of the GW) automatically becomes the destination-pattern number for the IP direction. On the originating GW, there is a POTS dial peer with a destination pattern that matches the DNIS. The dial peer for this example looks like the following:

dial-peer voice 100 pots
direct-inward-dial
port 0:D

The POTS dial-peer (100), which matches the port that the call came in on, has DID configured. The direct-inward-dial statement in the dial peer tells the GW to look for a number in a VoIP dial peer that matches the DNIS. It finds it in the following:

dial-peer voice 101 voip
destination-pattern 5710913
session target ipv4:10.11.253.8    <---terminating GW

So a call is made across the IP network to 10.11.253.8 and a match is found in that terminating GW:

dial-peer voice 571 pots
destination-pattern 5710913
port 0:D
prefix 5274094

This dial peer matches on the dialed number and changes that number to 5274094 with the prefix command. The end result is that the user dials one number, gets connected, and never knows that the number reached is totally different from the number dialed.

Number Translation or Normalization

GW dial plan configurations are focused on local PSTN access information at the edge of the H.323 network. This includes defining which E.164 prefixes are supported by the PSTN connections of the GW. In large-scale SP-type designs, the GW may also be relied on to perform "digit manipulation," where the GW takes a calling or called number and strips or adds (prefixes) digits before sending the number to its destination. The process of formatting the calling or called number to a predefined pattern is called "number normalization."

Figure 2-5 illustrates the process of translating a PSTN number for use in a VoIP network. The GW is connected to the PSTN and VoIP cloud, and uses Cisco IOS translation rules to accomplish digit manipulation. Translation rules can be applied on the GW's physical port, or in a VoIP dial peer. For example, number manipulation can be configured on the incoming POTS port, the outgoing voip dial peer, or both, to format a 7, 10, 11 or x-digit pattern into a fixed 10-digit pattern. The result is a number that has been normalized when it enters the VoIP cloud.


Note   Fore more information about translation rules, see Dial Plan Basics at the following URL:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121newft/121t/121t1/dt0390s7.htm


Figure 2-5   Number Translation from PSTN to VoIP Network


The translation rule above matches digit patterns that begin with [0011-0019] and translates this 4-digit pattern to [1-9], while preserving the remaining digits included in the digit pattern. This effectively strips the 011, a common international access code, and sends the remaining digits to the VoIP GK for call routing.

Translation rules can be used to manipulate both ANI and DNIS numbers. The parameters destination-pattern, answer-address, incoming-called-number, and numbering-type can all be configured to match a call's ANI (Automatic Number Identification) number, that of the originating party, or its DNIS (Dialed Number Identification Service) number, that of the destination party.


Tip To test a translation rule, use the command test translation rule <rule number> <number to translate>, as in the following example:

US-GW2# test translation-rule 1 011861044445555
4d03h: The replace number 861044445555
US-GW2# test translation-rule 1 00011861044445555
4d03h: number 00011861044445555 can't match any translation rules

Note   For background and syntax on translation rules, refer to Dial Peer Enhancements at the following URL:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121newft/121t/121t1/dt0390s7.htm

Technology Prefixes

Also known as a "tech prefix" or a GW's supported prefix, the technology prefix is an arbitrary, administrator-defined prefix that is used to define a GW type. Analog GWs, which frequently use FXS signaling, do not require the use of a tech prefix, as the E.164 address is registered to the GK. However, digital GWs, which use T1/E1 signaling, require the use of a tech prefix.

For example, you might assign, on an H.320 GW, the prefix 1# to indicate 1-channel calls, and the prefix 2# to indicate 2-channel calls. Alternatively, you might use 1# to indicate voice GWs, 2# to indicate H.320 GWs, 3# to indicate GWs fronting voicemail servers, and so on. So, a call to "1#4085551212" would mean "Use a voice GW to reach 4085551212."

Each GW must be configured to register its tech prefix with its GK. The user interface varies depending on the vendor, but on Cisco voice GWs it is configured by means of the command h323-gateway voip tech-prefix. To facilitate administrative manageability, it is recommended that you use the same tech prefix to represent the same type of GW through all zones in your network.

The caller must prepend the tech prefix to the called number to indicate the type of GW to be used for hopoff. If the call originates through a Cisco voice GW, configuring the matching dial peer with the tech prefix to be prepended does this. If the call originates with an H.323 endpoint, the administrator will have told the user what tech prefix to use for the hopoff GW to the called number.


Caution   If a call is not supplied with a tech prefix, you must configure a default tech prefix. Otherwise, the call will fail.

The remote VoIP GWs will still have some dial peers to match digits, but instead of the dial peers pointing to all other VoIP GW, they will use H.323 RAS to register with the GK, and then query the GK for dial plan details. The GK will have all of the zones, zone prefixes, and tech prefixes defined, and will return the information necessary to complete the VoIP call to the originating VoIP GW.

Prefix Search in DGKs and Local Zones

GKs are configured to administer their local country zones and city/area codes (for example, 8610*) to their specific GWs. A DGK is used to handle call routing on the country code alone. Where necessary, GWs can use translation rules to normalize DNIS or ANI numbers before they are propagated to the GK and DGK. For details, see Configuring Translation Rules on the Gateways.

Understanding Configuration Basics

This section discusses the following fundamental activities:

Building the Gatekeeper Core

In the following example, a service provider wants to offer voice services with a presence in North America, Asia, and EMEA (Europe, Middle East, and Africa). We will design and configure a GW, GK, and DGK H.323 network that will consist of the following:

The following are key design goals:

Figure 2-6 is a simplified view of our example wholesale network, whereas Figure 2-7 shows the detailed topology.


Note   See also Figure 1-1, to review the basic aggregation model and all of its potential components.


Figure 2-6   Example Wholesale Network with Coverage in China, the U.S., and France


Required Steps

Building the core fundamentals consists of the following, as discussed below:

Building a Zone

For the GW:

    a. Configuring TDM connections to the PSTN (physical connections and POTS dial peers)

    b. Configuring the GW to register to the GK

    c. Configuring the VoIP dial peers

    d. Configuring number normalization

For the GK:

    a. Configuring the GK zone name

    b. Configuring the E.164 prefix assignments

    c. Verifying the configuration

Connecting to Another Zone

    a. Configuring the DGK zone name

    b. Configuring the master zone-prefix table

    c. Verifying the configuration

Connecting to Another Administrative Domain
Additional, but Important, Considerations

In addition, the following activities are also essential to the proper functioning of the core network.

Detailed Network Topology

Figure 2-7 illustrates a detailed topology of our example network. Although it is not illustrated here, calls can originate and terminate on GWs through analog interfaces (FXS, FXO, and E&M), as well as on digital interfaces, such as T1/E1 and PRI.


Figure 2-7   Detailed Network Topology


Configuring Gateways and a Gatekeeper in a Single Zone

First we will focus on building a single GK zone. US-GW1 and US-GW2 are GWs in the North American (NA) zone, specifically in the San Francisco POP, and act (collectively) as the GW between the PSTN and the VoIP network. Both GWs register to the zone GK, forming a zone called NA-GK.

Figure 2-8 illustrates the components of zone NA-GK. Figure 2-7 illustrates the overall network topology.


Figure 2-8   Building a Single GK Zone


Configuring Gateway Interfaces to the PSTN

A look at the configuration file for the two GWs, US-GW1 and US-GW2, illustrates the establishment of T1 facilities. The establishment of E1 facilities is similar. We begin with US-GW1, then proceed to US-GW2. In this example we use Cisco AS5300 GWs.


Note   For detailed information about T1 and E1 provisioning, refer to the following URLs:

http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121cgcr/dialts_c/dtsprt3/dcdchant.htm

http://www.cisco.com/univercd/cc/td/doc/product/software/ios120/12cgcr/dial_r/drprt1/drchant.htm

http://www.cisco.com/univercd/cc/td/doc/product/software/ios120/12cgcr/dial_c/dcchant.htm

http://www.cisco.com/univercd/cc/td/doc/product/access/acs_serv/5300/sw_conf/ios_121/5300r2.htm


Step 1   Do the following on US-GW1.

    a. Establish T1 PRI signaling parameters for US-GW1. In this example, framing is ESF, linecode is B8ZS, and timing is being provided by the GW itself. The parameter pri-group allocates 24 DS0 channels.

controller T1 0
framing esf
clock source line primary
linecode b8zs
pri-group timeslots 1-24

    b. Establish the physical interface that the PRI facility from US-GW1 will use. The 0 in Serial0:23 creates a relationship with the PRI facility that controller t1 0 established above. 23 indicates that channels 0 through 23 are used. Here the switch type is defined.

interface Serial0:23
no ip address
isdn switch-type primary-ni
isdn incoming-voice modem
no cdp enable

    c. Establish the voice ports for US-GW1. In this case, the signaling is PRI, and the D-channels must be defined. In this case, we have configured only the first T1 interface for D-channel signaling. The remaining three voice ports are the default settings.

voice-port 0:D
!
voice-port 1:1
!
voice-port 2:2
!
voice-port 3:3
!

Step 2   Do the following on US-GW2.

    a. Establish T1 CAS signaling parameters for US-GW2. Parameters are as for US-GW1. ds0-group 0 establishes a relationship between a T1 port and 24 DS0 channels (comprising a full T1). In this example, signaling has been defined as E&M, Feature Group B, multifunction tone, with the DNIS option (for DID). The ds0 busyout statement places all 24 time slots in the busyout state when they change state.

controller T1 0
framing esf
clock source line primary
linecode b8zs
ds0-group 0 timeslots 1-24 type e&m-fgb mf dnis
ds0 busyout 24

    b. Establish the physical interface that the T1 CAS facility from US-GW2 will use. See Step 1a above.

interface Serial0:23
no ip address
isdn switch-type primary-ni
isdn incoming-voice modem
no cdp enable

    c. Establish the voice ports for US-GW2. See Step 5. Because this GW uses CAS signaling, no D-channel is defined. Again, the remaining three voice ports are the default settings.

voice-port 0:0
!
voice-port 1:1
!
voice-port 2:2
!
voice-port 3:3

This concludes the basic establishment of facilities and dial peers. To have the GWs register with the GK, as well as to establish dial plans and translation rules, continue with the steps below, with US-GW1 as an example. See also Establishing a Dial Plan.



Configuring the GWs to Register with the GK

We begin with US-GW1, then proceed to US-GW2.


Step 1   Do the following on US-GW1.

    a. Establish the interface.

interface Ethernet0/0

    b. Assign an IP address to the interface.

ip address 172.19.49.166 255.255.255.192

    c. Enable H.232 functionality on this interface.

 h323-gateway voip interface

Caution   The above must be the first H.323 command you configure. If you do not do this, the other H.323 commands will not appear following a show run.

    d. Establish the identity of the GK to which the GW will register. NA-GK is the name of the GK zone, and 1719 is the well-known port for H.323 RAS registration.

h323-gateway voip id NA-GK ipaddr 172.19.49.168 1719

    e. Configure the GW's H.323 ID as US-GW1.

h323-gateway voip h323-id US-GW1

    f. Assign the tech prefix "1#" to the GW when it registers to the GK.

h323-gateway voip tech-prefix 1#

Note    For information about tech prefixes, see Technology Prefixes 2-7.

Step 2   On US-GW2, change the IP address and name of the GW and repeat Steps a through f, above.

Configuring Translation Rules on the Gateways

Now we configure the appropriate translation rules on both GWs. The rules will be the same on both GWs. Refer to Number Translation or Normalization. Table 2-2 summarizes the current dialing patterns for each of the GWs in our configuration example. The objective is to use number normalization to reduce the number of dial peers on each GW.


Note   For detailed information about translation rules, see Dial Peer Enhancements at the following URL:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121newft/121limit/121x/121xm/121xm_5/ftdpeer.htm

Table 2-2   Dialing Patterns, Codes, and Habits for Detailed Network Topology

Zone GW POP Dialing Pattern Code Dialing Habit Normalized Pattern

North
America

US-GW1

US

1.408.527.1000

Country: 1

Area: 408

Int'l access: 011

Local: In 408 area code, use 7-digit dialing

Long distance: Use 1 + area code + local number

International: outside North America, use 011 (access code) + country code + local city code + local number

country code + city code + local number

US-GW2

US

1.408.779.1000

Asia

CHINA-GW1

China POP

861011112222

Country: 86

City: 010

Int'l access: 00

Local: In 010 city code, use 8-digit dialing, beginning with 1-9

Long distance: Within China, use area code (dialed with 0x or 0xx) + local number

International: Outside North America, use 00 (access code) + country code + local city code + local number

EMEA

FRANCE-GW1

France POP

330311112222

Country: 33

City: 03

Int'l access: 00

Local: In 03 area code, use area code (0x) + 8-digit local number

Long distance: Within France, use area code (0x) + 8-digit local number

International: Outside North America, use 00 (access code) + country code + local city code + local number

 


Tip The translation rules should be configured to match the local dialing habits within the country in which the GW resides. (The "country code" is also known as the "international calling code.") Match the translation rule with the appropriate outgoing voip dial-peer.

Do the following on both US-GW1 and US-GW2.


Step 1   Write a translation rule that strips the international access code, which in this case is 011. This rule is translation rule 1, which applies to the VoIP dial peer.

translation-rule 1
Rule 0 ^0111.% 1
Rule 1 ^0112.% 2
Rule 2 ^0113.% 3
Rule 3 ^0114.% 4
Rule 4 ^0115.% 5
Rule 5 ^0116.% 6
Rule 6 ^0117.% 7
Rule 7 ^0118.% 8
Rule 8 ^0119.% 9

Step 2   Write a translation rule that adds the North America country code and local area code to the DNIS number. This is translation rule 2, which applies to the POTS dial peer.

translation-rule 2
Rule 0 ^2...... 14082
Rule 1 ^3...... 14083
Rule 2 ^4...... 14084
Rule 3 ^5...... 14085
Rule 4 ^6...... 14086
Rule 5 ^7...... 14087
Rule 6 ^8...... 14088
Rule 7 ^9...... 14089



Configuring Dial Peers on the Gateways

As the VoIP dial peers are the same on both GWs, do the following on both US-GW1 and US-GW2. However, different POTS dial peers are needed, to serve different area codes.


Step 1   Configure the VoIP dial peers on both GWs. Refer to the discussion in POTS and VoIP Dial Peers.

    a. Configure a VoIP dial peer for an international call that requires a country access code (here 011). See the note below for a discussion of the variable parameter T.

dial-peer voice 1 voip
destination-pattern 011T
translate-outgoing called 1 <----applies translation rule 1 to dial peer
session target ras

    b. Configure a VoIP dial peer for a local 7-digit number. The last two lines, respectively, invoke translation rule 1 on a match, and cause a RAS ARQ message to be sent to the GK.

dial-peer voice 4 voip
destination-pattern [2-9]......
translate-outgoing called 2 <----applies translation rule 2 to dial peer
session target ras

    c. Configure a VoIP dial peer for an intra-country (in our example, U.S. domestic) call (1-xxx-xxx-xxxx).

dial-peer voice 2 voip
destination-pattern 1T
session target ras

Step 2   Configure POTS dial peers on the GWs. These will vary by area code.

    a. Configure a POTS dial peer on US-GW1 for FXS (DID) calls.

voice-port 0:D
timeouts interdigit 3

Note    timeouts interdigit <seconds> is the interval allowed between each dialed digit ( . . . . ). This interval is also represented by T in the country access code above (destination-pattern 011T), to allow for a sufficient pause.

voice-port 0:D <---assigns voice port 0:D to the dial peer
!
!
!
dial-peer voice 1408 pots
destination-pattern 1408.......
no digit-strip <----forces matched digits in destination pattern not to be stripped

Note    The default setting strips matched digits.

direct-inward-dial <----recognizes the DNIS number from the PSTN
port 0:D
!
gateway

    b. Configure a POTS dial peer on US-GW2, noting the different area code. Refer to the step above.

voice-port 0:D
!
!
!
dial-peer voice 1415 pots
destination-pattern 1415.......
no digit strip
!
!
direct-inward-dial
port 0:D
!
gateway



Summary of a Gateway Configuration

Now look at key elements of the configuration for US-GW2.

Current configuration:
!
version 12.1
!
hostname US-GW2
!
!
!
translation-rule 1
Rule 0 ^0111.% 1
Rule 1 ^0112.% 2
Rule 2 ^0113.% 3
Rule 3 ^0114.% 4
Rule 4 ^0115.% 5
Rule 5 ^0116.% 6
Rule 6 ^0117.% 7
Rule 7 ^0118.% 8
Rule 8 ^0119.% 9
!
translation-rule 4
Rule 0 ^2...... 14082
Rule 1 ^3...... 14083
Rule 2 ^4...... 14084
Rule 3 ^5...... 14085
Rule 4 ^6...... 14086
Rule 5 ^7...... 14087
Rule 6 ^8...... 14088
Rule 7 ^9...... 14089
!
!
!
interface Ethernet0/0
ip address 172.19.49.167 255.255.255.192
h323-gateway voip interface
h323-gateway voip id NA-GK ipaddr 172.19.49.168 1719 priority 1
h323-gateway voip id NA-ALTGK ipaddr 172.19.49.169 1719 priority 2
h323-gateway voip h323-id US-GW2
!
ip classless
ip route 0.0.0.0 0.0.0.0 172.19.49.129
no ip http server
!
!
voice-port 0:D
!
voice-port 0:D
!
dial-peer cor custom
!
!
!
dial-peer voice 1 voip
destination-pattern 011T
translate-outgoing called 1
session target ras
!
dial-peer voice 2 voip
destination-pattern 1T
session target ras
!
dial-peer voice 1415 pots
destination-pattern 1415.......
port 0:D
!
dial-peer voice 4 voip
destination-pattern [2-9]......
translate-outgoing called 4
session target ras
!
gateway
!



Configuring the Gatekeeper

Follow the steps below to configure the GK. See Building a Single GK Zone.


Step 1   Establish the GK hostname and IP address.

hostname NA-GK
!
interface Ethernet0/0
ip address 172.19.49.168 255.255.255.192
!

Step 2   Configure the router to be a GK and create a zone prefix table.

    a. Establish the identity of the router as a GK.

gatekeeper

    b. Establish a zone name (NA-GK), a domain (netman.com), and an IP address.

zone local NA-GK netman.com 172.19.49.168

    c. Create a zone prefix table for the zone served by US-GW1. This defines NA-GK as the zone for administering the 1408* prefixes. (1408* numbers reside in the GWs belonging to the NA-GK zone.)

zone prefix NA-GK 1408* gw-priority 10 US-GW1

    d. Do the same as in the preceding step, except for the zone served by US-GW2.

zone prefix NA-GK 1415* gw-priority 10 US-GW2

    e. Assign a default technology prefix. (Optional. See Technology Prefixes.)

gw-type-prefix 1#* default-technology

    f. Allow LRQs to be forwarded to other GKs.

lrq forward-queries

    g. Activate the interface.

no shutdown

Step 3   Verify that the GWs register to the GK.

sh gate end

When the registration is successful, something like the following appears. The GWs appear as endpoints. The other parameters are self-explanatory.

GATEKEEPER ENDPOINT REGISTRATION
================================
CallSignalAddr Port RASSignalAddr Port Zone Name Type F
--------------- ----- --------------- ----- --------- ---- --
172.19.49.166 1720 172.19.49.166 54715 NA-GK VOIP-GW
H323-ID: US-GW1
172.19.49.167 1720 172.19.49.167 56615 NA-GK VOIP-GW
H323-ID: US-GW2
Total number of active registrations = 2

Note   Endpoint registration is checked only on the initial RRQ. It is not checked on keep-alive RRQs.

Step 4   Now build a new zone. Refer to Figure 2-9.

We will configure a second zone, AS-GK, located in China. For simplicity, this will consist of one GW at the China POP, and an associated zone GK.


Figure 2-9   Building a New GK Zone




Reviewing the Configurations

The following are example abbreviated configuration files for the gateway CHINA-GW1 and the gatekeeper AS-GK.


Step 1   First look at the GW, noting the following essentials.

CHINA-GW1# sh run
Building configuration...
!
hostname CHINA-GW1
!
!
!
translation-rule 2
Rule 0 ^01.% 8601
Rule 1 ^02.% 8602
Rule 2 ^03.% 8603
Rule 3 ^04.% 8604
Rule 4 ^05.% 8605
Rule 5 ^06.% 8606
Rule 6 ^07.% 8607
Rule 7 ^08.% 8608
Rule 8 ^09.% 8609
!
translation-rule 1
Rule 0 ^0011.% 1
Rule 1 ^0012.% 2
Rule 2 ^0013.% 3
Rule 3 ^0014.% 4
Rule 4 ^0015.% 5
Rule 5 ^0016.% 6
Rule 6 ^0017.% 7
Rule 7 ^0018.% 8
Rule 8 ^0019.% 9
!
!
!
interface Ethernet0/0
ip address 172.19.49.170 255.255.255.192
h323-gateway voip interface
h323-gateway voip id AS-GK ipaddr 172.19.49.172 1719
h323-gateway voip h323-id CHINA-GW1
h323-gateway voip tech-prefix 1#
!
interface Ethernet0/1
no ip address
shutdown
!
ip classless
ip route 0.0.0.0 0.0.0.0 172.19.49.129
no ip http server
!
voice-port 0:D
timeouts interdigit 3
!
voice-port 0:D
!
!
!
dial-peer voice 8610 pots
destination-pattern 861011112222
port 1/0/0
!
dial-peer voice 1 voip
destination-pattern 001T
translate-outgoing called 1
session target ras
!
dial-peer voice 2 voip
destination-pattern 86T
session target ras
!
dial-peer voice 3 voip
destination-pattern 0[1-9]T
translate-outgoing called 2
session target ras
!
gateway

Step 2   Now look at the GK.

AS-GK#sh run
Building configuration...
Current configuration:
!
version 12.1
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname AS-GK
!
enable password pme123
!
!
!
interface Ethernet0/0
ip address 172.19.49.172 255.255.255.192
!
interface Ethernet0/1
no ip address
shutdown
!
ip classless
ip route 0.0.0.0 0.0.0.0 172.19.49.129
no ip http server
!
!
!
gatekeeper
zone local AS-GK netman.com 172.19.49.172
zone remote DGK netman.com 172.19.49.190 1719
zone remote ALTDGK netman.com 172.19.49.180 1719
zone prefix AS-GK 8610* gw-priority 10 CHINA-GW1
zone prefix DGK *
zone prefix ALTDGK *
no shutdown



Adding a Directory Gatekeeper to the Zones

The following steps add a DGK to the zones that have been established. The directory gatekeeper named DGK will be added to the network to provide call routing between the zone GKs. This DGK will contain the master zone prefix table, relieving the individual GKs of having to maintain the most current information. Figure 2-10 illustrates the relationship of DGK to zones NA-GK and AS-GK.


Figure 2-10   Adding a DGK for Zones NA-GK and AS-GK



Note   Consider the following performance relationship between the DGK and the GKs it supports. On the average, the DGK requires one-quarter of the CPU processing capacity needed by the local zone GKs. So if the CPU load on the GK is 40%, then you only need 10% CPU allocation on the DGK. Cisco IOS software has a limit of 5 recursive LRQs; an LRQ is limited to 5 hops. Local zones and LRQ forwarding zones can be mixed.

Follow the steps below to add a DGK.


Step 1   Add the DGK, assigning a name, interface, and IP address (in our example, "DGK" and FastEthernet 0/0 172.19.49.178 255.255.255.192). Refer to Figure 2-10.

hostname DGK
!
!
interface FastEthernet0/0
ip address 172.19.49.178 255.255.255.192
duplex auto
speed auto
!

Step 2   Configure the zone prefix table on the DGK. A local zone called DGK is established, and the remote zones NA-GK and AS-GK are configured. DNIS numbers that begin with 1 (the NA-GK country code) are handled by NA-GK. DNIS numbers that begin with 86 (the AS-GK country code) are handled by AS-GK. The appropriate zone prefixes are configured to forward LRQs to the respective GKs, as shown below. Again, 1719 is the well-known port for H.323 RAS registration (the GK UDP registration and status port).

gatekeeper
zone local DGK netman.com 172.19.49.190
zone remote NA-GK netman.com 172.19.49.168 1719
zone remote AS-GK netman.com 172.19.49.172 1719
zone prefix NA-GK 1*
lrq forward-queries
no shutdown
!
!
line con 0
transport input none
line aux 0
line vty 0 4
password pme123
login
!
end

Note    Because the DGK sits above the zone GKs, the DGK does not maintain the registration of GWs.



Using Traffic Management Features

If one or more GWs become unduly burdened by incoming calls, there are various ways to manage traffic. This section discusses two techniques:

Resource Availability Indicator

Problems can arise when traffic load causes GWs to reach their capacity. The Resource Availability Indicator (RAI) is an H.323 feature that informs the GK when no circuits (DS0s) or DSPs are available. RAI messages indicate both the availability and unavailability of a GW, depending on the threshold for each that the user can set. RAIs let the GK select the best available GW at the outset, increasing call-completion rates and lowering postdial delay. After the GK receives an RAI from an overburdened GW, it will not assign calls to that GW.

There are two load thresholds: A high value determines when the GW sends the GK an "unavailable" RAI, and the low value determines when the GW sends the GK an "available" RAI. The syntax is as follows:

resource threshold [all] [high %-value] [low %-value]

Note    The default values are 90 for both high and low.

So, to set a high threshold of 90 and a low threshold of 80, we enter the following:

gw1(config-gateway)# resource threshold high 90 low 80

To see the results, issue the command show gateway, as follows.

gw1# show gateway
Gateway gw1 is registered to Gatekeeper gk.mwest
H323 resource thresholding is Enabled and Active
H323 resource threshold values"
 DSP: Low threshold 80, High threshold 90
 DS0: Low threshold 80, High threshold 90

If only a single GW is within a zone, the GK will give that GW the call, in the hope that there are enough resources to terminate the call. Otherwise, the preferences will reroute the call at the ingress GW.

Call Admission Control

Call admission control (CAC) is another way to assign priority to GWs. The priority of the GW is configured on the GK to prioritize selection from among multiple GWs. The GK can select the most available GW at the outset, to increase call completion rates and lower postdial delay. The usage is as follows:

GK(config)# gatekeeper
GK(config-gk)# zone local west-gk cisco.com 10.1.1.1
GK(config-gk)# zone prefix west-gk 415666.... gw-pri 10 gw1
GK(config-gk)# zone prefix west-gk 415777.... gw-pri 10 gw2

Note     The default priority is 5.

The result is a master list, which you can see with show gatekeeper:

master list: gw1, gw2
408666 list: pri 10 gw1; pri 5 gw2
408777 list: pri 10 gw2; pri 5 gw1

Interconnecting to a New Administrative Domain

This section discusses how to interconnect to an new administrative domain, such as a new wholesale VoIP provider. The interconnection is between two DGKs, and the DGK of the new SP forwards LRQs to the previously established domain, and vice versa.

Figure 2-11 illustrates the addition of a DGK, AUS-DGK, and the South Pacific zone it maintains. The GK is AUS-GK. The POP is Australia POP, and the country code is 61. The new DGK sends LRQs to the virtual address of the paired DGKs to the right. For information about virtual addresses and enabling redundancy, see Providing Redundancy for Fault Tolerance.


Figure 2-11   Adding a DGK and the South Pacific Zone


The following is an abbreviated configuration that highlights the essentials of configuring a GW in the new DGK zone. Our new GW is AUS-GW1. For details, see Adding a Directory Gatekeeper to the Zones.

AUS-GW1#sh run
Building configuration...
Current configuration:
!
!
!
hostname AUS-GW1
!
interface Ethernet0/0
ip address 172.19.49.183 255.255.255.192 <----the address of our new GW, AUS-GW1
!
interface Ethernet0/1
no ip address
shutdown
!
ip classless
ip route 0.0.0.0 0.0.0.0 172.19.49.129
no ip http server
!
!
gatekeeper   <----the following lines are for AUS-GK
zone local NK-AUS-GK newkid.com 172.19.49.183
zone remote NK-DGK newkid.com 172.19.49.185 1719
zone prefix NK-AUS-GK 617* gw-priority 10 NK-AUS-GW1
zone prefix NK-DGK *
no shutdown
<---snip--->
gatekeeper      <----the following lines are for AUS-DGK
zone local NK-DGK newkid.com 172.19.49.185
zone remote NK-AUS-GK newkid.com 172.19.49.183 1719
zone remote DGK netman.com 172.19.49.190 1719
zone prefix NK-AUS-GK 617*
zone prefix DGK * <---- the route to "DGK" (maintained by the other SP)
lrq forward-queries
no shutdown

Note    The zone prefix "DGK *," above, represents zone prefix DGK 1 *, DGK 33 *, and DGK 86 *. See Table 2-4 on page 2-59.

Providing Redundancy for Fault Tolerance

There are three principle methods of providing fault tolerance in large H.323 networks:

Figure 2-12 (the same as Figure 2-6) illustrates a network that provides fault tolerance through HSRP at the DGK level, alternate GKs, and alternate DGKs.

In addition, redundant components contribute considerably in minimizing downtime during software upgrades. For a discussion of things to consider when upgrading Cisco IOS software and other software, see Providing Redundancy for Software Upgrades.


Figure 2-12   Providing Fault Tolerance through Redundancy


Fault tolerance and redundancy within H.323 networks is most important at the DGK level. Current and future versions of Cisco IOS allow DGK redundancy to be configured for alternate DGKs, and Cisco's HSRP (Hot Standby Routing Protocol) to be configured for DGKs.


Caution   Although both approaches can be used, Cisco recommends that only HSRP be used on DGKs, and that alternate GKs be used for zone GKs.

Using Alternate Gatekeepers for Fault Tolerance

In an alternative to the HSRP approach, using an alternate GK at the zone level provides redundancy. This enhancement allows a GW to use up to two alternate GKs as a backup in case a primary GK fails. More specifically, the GWs are configured to register to a primary and an alternate GK. If the primary GK fails, the alternate GK can then be used for call routing, and maintain call routing without call failure. Because Cisco GKs do not communicate registration states between each other, sequential LRQs must be configured on the GKs and DGKs to accommodate zone fragmentation. The configuration of the GKs is similar to that of the DGKs discussed in Method 3: Configuring an Alternate DGK.


Note   Cisco IOS release 12.1(2)T introduced sequential LRQs, whereby LRQs are transmitted sequentially —instead of in a unicast blast of LRQs. This is a significant advantage over HSRP, because backup GKs no longer must be colocated in the same geographical location.

Figure 2-13 illustrates a fault-tolerant architecture in an example network that uses alternate GKs.


Figure 2-13   Fault-Tolerant Architecture using Alternate GKs


GWs may be configured to register to a primary GK and an alternate GK if the primary GK fails. This implies that at any given time, a GW may be registered to either its primary or alternate GK. Since Cisco GKs do not communicate registration states between each other, sequential LRQs must be configured on the GKs and DGKs to accommodate zone fragmentation.

For example, a GK in the Western zone supports GWs in San Jose (408) and San Francisco (415). Under normal circumstances, when San Jose calls San Francisco, the route is resolved in the local primary GK. However, assume that San Jose fails over to the alternate GK while San Francisco remains on the primary GK. To continue to support regional call completion within the Western zone, the primary and alternate GKs must be provisioned to send local prefixes to each other if no local resources exist (for example, the terminating GW has failed over to the other GK). In this case, in order for San Francisco to complete calls to San Jose, the primary GK must know to send an LRQ for the San Jose prefix to the alternate GK. Similar provisioning is required on both primary and alternate GKs to support calls in both directions.

Provisioning is also required on the DGK to prevent zone fragmentation issues when calls are originated from other zones. For example, if San Francisco sends a call to New York, the DGK does not know with which GK (primary or alternate) the NY GW is registered. The DGK must be provisioned to send sequential LRQ requests to both primary and alternate terminating local GKs for all Eastern zone supported prefixes (messages 1a and 1b, which are addressed to both DGKs in the HSRP area). Similar provisioning is required for the Western zone prefixes to support calls in the other direction.

HSRP is used to provide fault tolerance for the DGK. However, HSRP failover detection may take some time during which no calls will be processed. To cover this case, local GKs may be configured to point to more than one DGK (an ALTDGK) for its wild-card route using sequential LRQs.

For example, the GK may point to an HSRP DGK pair as its primary option (message 1). If no response is received because HSRP failover has not been detected yet, the GK may initiate another LRQ (message 2) to an ALTDGK after a configurable timeout (100 to 1000 ms) to try to complete the call. During this time, calls will still be completed, although with additional postdial delay. The ALTDGK is configured in exactly the same way as the primary DGK HSRP pair (messages 2a and 2b).

Using HSRP on Directory Gatekeepers

Because the DGK maintains the majority of the call routing intelligence (such as zone prefix tables, tech prefix tables, E.164 registrations), the DGK should be fault tolerant. DGKs can be configured as HSRP pairs with a shared virtual IP address, so that when one DGK fails, the standby DGK assumes its role. Zone GKs need only to point to this virtual address.

A primary and secondary DGK functioning as a fault-tolerant pair must be addressed by a single virtual address. Figure 2-14 illustrates this assignment, with the virtual address 172.19.49.190 functioning as a single address (from the point of view of incoming traffic) for DGK1 and DGK2.


Figure 2-14   Assigning a Virtual Address to Paired DGKs in an HSRP Pair


An active and a standby DGK must be configured on the same subnet, and therefore must be colocated. HSRP uses a priority scheme to determine which HSRP-configured router is to be the default active router. To configure a router as the active router, you assign it a priority that is higher than the priority of the other HSRP-configured routers. The default priority is 100, so if you configure just one router to have a higher priority, that router will be the default active router.


Caution   Cisco recommends that you use the HSRP redundancy method at the DGK level, not at the zone GK level. This is because HSRP does not support reregistration from one HSRP DGK to the adjacent HSRP DGK.

HSRP works by exchanging multicast messages that advertise priority among HSRP-configured routers. When the active router fails to send a "hello" (heartbeat) message within a configurable period of time, the standby router with the highest priority becomes the active router. An HSRP GK sends these "hello" messages every 3 seconds by default.

For more information about HSRP, refer to the following URL:

http://www.cisco.com/univercd/cc/td/doc/cisintwk/ics/cs009.htm

The standby timers interface configuration command sets the interval in seconds between hello messages (1 through 255 sec) and sets the duration in seconds that a router waits before it declares the active router to be down (1 through 255 sec). The defaults are 3 and 10 seconds, respectively. If you decide to modify the default values, you must configure each router to use the same hello time and hold time. For example, on an interface xxx, we could change the default values as follows:

int xxx
standby 1 timers 5 15

where 5 = hello interval and 15 = the time the active router can be down before this state is declared.

The command does not appear until the value is changed. For more information, see the topic "Configuring HSRP" at the following URL:

http://www/univercd/cc/td/doc/product/software/ios121/121cgcr/ip_c/ipcprt1/1cdip.htm

Using an Alternate Directory Gatekeeper for Fault Tolerance

HSRP failover detection may take some time, during which no calls will be processed. To cover this case, local GKs can be configured to point to an additional, or alternate, DGK. This alternate DGK can be used to back up an HSRP DGK pair, by using the sequential LRQ feature available on the zone GKs. For instance, if a zone GK sends an LRQ to a primary DGK, and fails to receive an LCF in return, another sequential LRQ can be sent from the zone GK to this alternate DGK. During this time, calls will still be completed, although with additional postdial delay. The alternate DGK will then provide the normal DGK prefix lookup and call routing in the network, until the primary DGK is able to function again. The alternate DGK is configured just like the primary DGK in the HSRP DGK pair. We apply this design in the example configuration shown in Method 3: Configuring an Alternate DGK.


Caution   Cisco recommends that you use a combination of alternate GK, HSRP DGK, and alternate DGK to provide fault tolerance and redundancy in large H.323 networks.

Providing Redundancy for Software Upgrades

Although it is up to the service provider to determine the service availability required by its customers, it remains good practice to ensure that voice traffic is not interrupted. In many cases, "five nines" (99.999%) availability may be required. In addition to providing redundancy to cover outages of equipment or communications channels, it is necessary to provide redundancy to support traffic during upgrades of the Cisco IOS software.


Caution   It is the responsibility of the service provider to engineer the network in such a way as to provide the required service availability for their customers.

Upgrading All Routers

To ensure that software upgrades do not affect service availability, Cisco recommends that you provide redundancy for all components of the GK core. Note the following considerations:

To upgrade software at the GW level, follow the steps below.

1. Ensure that the new Cisco IOS image is available on the TFTP server.

2. Download the new Cisco IOS files from a TFTP server to available flash memory on the selected routers. beforehand. To minimize service unavailability, it is recommended that you upgrade only one router at a time.

3. Select a maintenance window that ensures the least disruption of traffic. Do the following during the maintenance window.

    a. Redirect traffic from the routers whose software is to be upgraded.

    b. If you have GWs that support SS7 links, you must take those links out of service (OOS) on the Cisco SC2200 that supports those links. (This involves editing the file config.mml of the SC. See Step 4 of Define APCs, Linksets, SS7 Routes, and NAS Paths.)

    c. Reboot the routers to move the new image from flash memory to RAM. This activates the IOS upgrade.


Note    Rebooting can take up to 5 minutes.

Upgrading at the Billing Component Level

It is essential that billing information not be lost. In addition to providing redundancy to cover outages of equipment or communications channels, it is necessary to provide redundancy to maintain billing data during upgrades of software to support billing applications. Components to consider include AAA/RADIUS servers, OSP servers, and other servers providing third-party billing and settlement applications.

Upgrading at the Network Management Level

It is generally not necessary to provide redundancy at the network management level, because these applications can go out of service during a maintenance window with minimal impact on traffic. However, it is the responsibility of the service provider to consider any possible effects such outages may have, and provide redundancy if necessary.

Configuring Fault Tolerance: Three Methods

The following configuration scenarios provide examples that illustrate the methods discussed above:

See Figure 2-7 for the relationships and address of the components discussed in these configurations.

Method 1: Configuring Alternate GKs

Use this method, which uses the priority statement, to configure GWs to register to a primary and secondary (alternate) GK in the absence of HSRP.


Step 1   Configure the GWs to register to an alternate GK pair. See Using Alternate Gatekeepers for Fault Tolerance. The following is for a single GW.

The configuration registers each GW in a zone with two GKs, one primary and one secondary. Default priority = 127 (127 is lowest priority, 1 is the highest priority). 1719 is the well-known port for H.323 RAS messaging.

interface Ethernet 0/1
 ip address 172.18.193.59 255.255.255.0 <----the address of this GW
h323-gateway voip interface
h323-gateway voip id GK1 ipaddr 172.18.193.65 1719 priority 120
h323-gateway voip id GK1 ipaddr 172.18.193.66 1719
h323-gateway voip h323-id cisco2

In this case, we have configured 172.18.193.65 as the primary (priority = 120) and 172.18.193.66 as the secondary GK.

Step 2   Verify the configuration.

# show gate
Alternate Gatekeeper List
priority 120 id GK1 ipaddr 172.18.193.65 1719
priority 127 id GK2 ipaddr 172.18.193.66 1719

Method 2: Configuring an HSRP DGK Pair

Use this method to configure a primary and secondary (standby) DGK in an HSRP DGK pair.


Step 1   Add an HSRP pair of DGKs, primary and secondary. See Figure 2-14.

    a. Configure the primary DGK, DGK1. We will use a Fast Ethernet interface.

interface fa0/0
ip address 172.19.49.178 255.255.255.0
standby 1 priority 110
standby 1 ip 172.19.49.190 255.255.255.0

This is the actual IP address of DGK1. The next two lines declare, respectively, the standby priority for this DGK and the virtual IP address of the HSRP DGK pair.

Step 2   Declare the first DGK and create zone local and zone remote statements.

The key to establishing an HSRP pair is having identical zone statements on each DGK. Note the following configurations for DGK1 and DGK2, respectively. Use the gatekeeper command to establish the DGK identity of the router. The zone local statement assigns the virtual address shared by the HSRP pair.

gatekeeper
zone local DGK netman.com 172.19.49.190
zone remote NA-GK netman.com 172.19.49.168 1719
zone remote AS-GK netman.com 172.19.49.172 1719
zone remote E-GK netman.com 172.19.49.176 1719
zone remote NA-AGK netman.com 172.19.49.169 1719
zone prefix NA-GK 1*
zone prefix E-GK 33*
zone prefix AS-GK 86*
lrq forward-queries
no shutdown

    b. Configure the secondary DGK, DGK2.

interface fa 0/0
ip address 172.19.49.179 255.255.255.0
standby 1 priority 100
standby 1 ip 172.19.49.190 255.255.255.0

Note    Note the lower standby priority. All zone statements must be identical to those in the other member of the HSRP DGK pair.

gatekeeper
zone local DGK netman.com 172.19.49.190
zone remote NA-GK netman.com 172.19.49.168 1719
zone remote AS-GK netman.com 172.19.49.172 1719
zone remote E-GK netman.com 172.19.49.176 1719
zone remote NA-AGK netman.com 172.19.49.169 1719
zone prefix NA-GK 1*
zone prefix E-GK 33*
zone prefix AS-GK 86*
lrq forward-queries
no shutdown

Method 3: Configuring an Alternate DGK

Use this method to configure an alternate DGK in the absence of HSRP. The configuration, residing on each of the zone GKs, is identical to that of the primary DGK. The following illustrates a configuration on a duplicate DGK that shares the same routing table as the primary:

alternate DGK
!
gatekeeper
zone local DGK netman.com 172.19.49.190
zone remote NA-GK netman.com 172.19.49.168 1719
zone remote AS-GK netman.com 172.19.49.172 1719
zone remote E-GK netman.com 172.19.49.176 1719
zone remote NA-AGK netman.com 172.19.49.169 1719
zone prefix NA-GK 1*
zone prefix E-GK 33*
zone prefix AS-GK 86*
lrq forward-queries
no shutdown

The following illustrates how to configure on each of the zone GKs a zone remote statement that points to an alternate DGK if the primary DGK fails. See Figure 2-13, and Using an Alternate Directory Gatekeeper for Fault Tolerance.


Step 1   Add an alternate DGK and configure it.

gatekeeper
zone local E-GK netman.com 172.19.49.176
zone remote DGK netman.com 172.19.49.190 1719 <----points to primary DGK
zone remote ALTDGK netman.com 172.19.49.180 1719  <----points to alternate DGK
zone prefix E-GK 3303* gw-priority 10 FRANCE-GW1
zone prefix DGK *
zone prefix ALTDGK *
no shutdown



Providing Security

This section introduces the topic of H.235 security, and provides an example of configuring GWs, a GK, and an AAA/RADIUS server to provide security.

H.235 Security for Gateways and Gatekeepers

The RAS channel used for GW-to-GK signaling is not a secure channel. To ensure secure communication, Cisco H.235 access tokens allow GWs to include an authentication key in their RAS messages. This key is used by the GK, which passes it to a AAA/RADIUS server for verification of a user password and H.323 ID.

Cisco H.323 GWs support the use of CryptoTokens for authentication where the token can be included in the RRQ and ARQ messages. Figure 2-15 illustrates the generation and validation of a Cisco H.235 security token. This example illustrates "registration only" security. CHAP (Challenge Handshake Authentication Protocol) is the method used.


Note   CHAP is supported on lines using PPP encapsulation, to prevent unauthorized access. CHAP does not itself prevent unauthorized access, but merely identifies the remote end. The router or access server then determines whether that user is allowed access.


Figure 2-15   Generation and Validation of Cisco H.235 Security Token


Figure 2-16 illustrates a CHAP challenge for a GW named WestGW and a GK named WestGK.


Figure 2-16   A CHAP Challenge


The general sequence is as follows:

1. A user password is manually established on the GW.

2. A token is generated at the access GW. The token results from the hashing of the user password, an H.323 ID, and a timestamp.

3. The GW passes the token to the GW as part of an RRQ (Registration Request) message.

4. The GK passes the token to the AAA/RADIUS server for validation.

    a. If the password and H.323 ID match records on the AAA/RADIUS server, the token is validated.

    b. If the password and H.323 ID do not match the records, an RRJ (Request Reject) is returned and the GW is not allowed to register with the GK.

5. The validated token is passed back to the GK as an RCF (Registration Confirm) message.


Caution   The Cisco Wholesale Voice Solution supports Cisco H.235 security for registration only. For reasons of AAA latency, H.235 security is not supported on a per-call basis. When per-call security is required, Cisco recommends the use of access lists.

Configuring Gateways, a Gatekeeper, and an AAA/RADIUS Server for Security

The following examples illustrate security configurations for the following components:

Refer to Figure 2-15.

US-GW1
hostname US-GW1
!
interface Ethernet0/0
ip address 172.19.49.166 255.255.255.192
h323-gateway voip interface
h323-gateway voip id NA-GK ipaddr 172.19.49.168 1719 priority 1
h323-gateway voip h323-id US-GW1
h323-gateway voip tech-prefix 1#
!
gateway
security password lab level endpoint <--set password = lab (endpoint registration only)
US-GW2
hostname US-GW2
!
interface Ethernet0/0
ip address 172.19.49.167 255.255.255.192
h323-gateway voip interface
h323-gateway voip id NA-GK ipaddr 172.19.49.168 1719 priority 1
h323-gateway voip id NA-ALTGK ipaddr 172.19.49.169 1719 priority 2
h323-gateway voip h323-id US-GW2
h323-gateway voip tech-prefix 1#
!
gateway
NA-GK
hostname NA-GK
!
aaa new-model
aaa authentication login h323 group radius
aaa authorization exec h323 group radius
aaa accounting connection h323 start-stop group radius
!
interface Ethernet0/0
ip address 172.19.49.168 255.255.255.192
!
gatekeeper
zone local NA-GK netman.com 172.19.49.168
security token required-for registration <----causes GK to check for user ID and password
gw-type-prefix 1#* default-technology
lrq forward-queries
no shutdown
!
radius-server host 172.18.194.189 auth-port 1645 acct-port 1646 key lab
radius-server retransmit 3
radius-server key cisco
!
AAA/RADIUS Server

The configuration of the necessary files on the RADIUS host will vary according to the application. In some cases these correlate the H.323 IDs of GWs or GKs with a key, or password.


Note   In some CiscoSecure applications, you will need to establish GW and GK H.323 ID (h323-id) values in two separate files that reside on the AAA/RADIUS host: one for users (the GWs) and one for clients (the GKs). This information resides, respectively, in two RADIUS database files in the host machine's /etc directory: /etc/raddb/users, and /etc/raddb/clients.

For further details, see RADIUS Vendor-Specific Attributes Voice Implementation Guide Version 3.0 at the following URL:

http://www.cisco.com/univercd/cc/td/doc/product/access/acs_serv/vapp_dev/vsaig3.htm

Providing Network Timing through NTP

Establishing proper timing is essential not only for the proper operation of standard network functions, but also for the establishment of accurate stop and start intervals on call legs for billing and other accounting purposes.

The information below has been adapted from Task 1. Enabling the Network Time Protocol, at the following URL:

http://www.cisco.com/univercd/cc/td/doc/cisintwk/intsolns/as5xipmo/sysmgt.htm

For further information, including NTP time formats and links to useful sites, refer to Network Time Protocol (NTP) Usage Guidelines in Configuration Guide for AAA Billing Features in Cisco Voice-Enabled Routers and Access Servers, at the following URL:

http://www.cisco.com/warp/public/cc/so/cuso/sp/sms/acct/caaaf_cg.htm

The Network Time Protocol (NTP) provides a common time base for networked routers, servers, and other devices. A synchronized time enables you to correlate syslog and Cisco IOS debug output to specific events. For example, you can find call records for specific users within one millisecond.

Comparing logs from various networks is essential for the following tasks:

Without precise time synchronization between all the various logging, management, and AAA functions, time comparisons are not possible.

An NTP-enabled network usually gets its time from an authoritative time source, such as a Cisco router, radio clock, or an atomic clock attached to a timeserver. NTP then distributes this time across the network. NTP is extremely efficient; no more than one packet per minute is necessary to synchronize two machines to within a millisecond of one another. NTP runs over UDP, which in turn runs over IP.


Note   NTP services are enabled on all interfaces by default.

Configuring Additional NTP Features

There are a variety of optional NTP features you can configure. For details regarding the following options, refer to Performing Basic System Management at the following URL:

http://www.cisco.com/univercd/cc/td/doc/product/software/ios120/12cgcr/fun_c/fcprt3/fcgenral.htm#xtocid1345017

Use this feature to authenticate the associations with other systems for security purposes.

An NTP association can be a peer association (meaning that this system is willing to either synchronize to the other system or to allow the other system to synchronize to it), or it can be a server association (meaning that only this system will synchronize to the other system, and not the other way around). Use this feature to form an NTP association with another system.

The system can either send broadcast packets or listen to them on an interface-by-interface basis. You can also use this feature to configure the estimated round-trip delay for broadcast packets.

You can control NTP access by creating access groups and assigning a basic IP access list to it, and you can disable NTP services on a specific interface.

When the system sends an NTP packet, the source IP address is normally set to the address of the interface through which the NTP packet is sent. Use this feature to configure a specific interface from which the source IP address will be taken.

Even if a particular system is not synchronized to an outside time source, you can use this feature to be an authoritative NTP server.

On systems that have calendars, you can configure NTP to update the calender periodically.

Enabling NTP on a Router

The steps below are an example of how to enable NTP on a single Cisco AS5300


Step 1   Locate an authoritative clock source. For example, you can use a Cisco router or an atomic clock that is attached to a time server.


TimeSaver For testing purposes, you can use a Cisco router as the master timing source. Set the time, then assign master status to this router, as follows:

clock set 14:00:00 22 jun 2001
ntp master

However, this is not recommended in a production network.

Step 2   On the Cisco router, specify the primary NTP server's IP address and automatic calendar updates on other routers that will be slaves to the master clock:

!
clock set 14:00:00 30 june 2001
ntp update-calendar
ntp server 172.22.66.18 prefer

Step 3   Verify that the clock is synchronized to the NTP server. Inspect the status and time association. Clock sources are identified by their stratum levels. The following example shows a stratum level five clock.

5300-NAS# show ntp status
Clock is synchronized, stratum 5, reference is 172.22.66.18
nominal freq is 250.0000 Hz, actual freq is 250.0000 Hz, precision is 2**24
reference time is BB944312.4451C9E7 (23:11:30.266 PDT Wed Sep 22 1999)
clock offset is 0.5343 msec, root delay is 13.26 msec
root dispersion is 18.02 msec, peer dispersion is 0.09 msec
5300-NAS#

The following command identifies how often the NAS is polling and updating to the stratum clock. An asterisk (*) next to the NTP server's IP address indicates successful synchronization with the stratum clock.

5300-NAS# show ntp association
address ref clock st when poll reach delay offset disp
*~172.22.66.18 172.60.8.1 16 46 64 377 1.0 0.53 0.1
* master (synced), # master (unsynced), + selected, - candidate, ~ configured
5300-NAS#

For additional information, refer to Performing Basic System Management at the following URL:

http://www.cisco.com/univercd/cc/td/doc/product/software/ios120/12cgcr/fun_c/fcprt3/fcgenral.htm



Interconnecting to Other Service Providers

To increase traffic volume, subscriber bases, or revenue generation, partnerships can be made between both TDM-based and IP-based telephony carriers. By interconnecting with other VoIP carriers, not only can more attractive service offerings be provided, but coverage can also be increased with a minimum investment in capital and operations.

For TDM interconnections, Cisco supports a variety of interfaces and signaling variants to provide global connectivity. For solutions not requiring SS7 signaling, see "Provisioning Non-SS7-Based POPs." For solutions that require SS7 signaling, see "Provisioning SS7-Based POPs."

For IP interconnections, Cisco provides high-performance call routing through standards-based methods (such as OSP and H.323v2 LRQ), while flexibly accommodating networks that are not standards-based.

The wholesale service provider has the freedom to support any combination of interconnection methods simultaneously, so as not to limit business opportunities to a particular protocol. This is not the case with closed, proprietary systems.

This section discusses the following enhancements to interconnection:

OSP-Based Interconnection using a Clearinghouse

Where multiple partners are involved and AAA/RADIUS is not used, prepaid and postpaid card services may require the assistance of clearinghouse services for billing, settlement, and invoicing. These services can be based on Open Settlements Protocol (OSP). The use of OSP for secure settlement transactions involves a clearinghouse entity, or at least a dominant carrier in the interconnect relationship that administers the OSP server. The clearinghouse maintains the OSP servers.


Note   Where services are OSP based, the Cisco Wholesale Voice Solution supports call termination agreements through support for OSP in Cisco devices. For a high-level discussion of OSP, refer to Appendix A in the Cisco Wholesale Voice Solution Overview. For a detailed discussion of dial plans, billing/settlement, and security as these relate to OSP, see Template A3: TDM-to-IP-Based Interconnect with OSP in the Cisco Wholesale Voice Solution Overview.

In an OSP-based interconnect, all edge GWs must be registered with the OSP server, and rotary dial-peer failover must be provisioned to route calls through the OSP interconnect. To provide OSP-based call routing, the OSP servers hold the prefix call routing tables of all SPs that subscribe to the clearinghouse. The originating GW sends an ARQ (Authorization Request) to an OSP server, which responds with an ARP (Authorization Permit) that contains a list of possible IP addresses of the terminating GW, plus a security token. The token is included in the SETUP message, to provide security validation at the terminating GW. The SP would use the OSP method of call routing when carriers want a third party to provide the billing and settlement. Figure 2-17 illustrates an example call flow for RAS failover to an OSP server.


Figure 2-17   Example Call Flow for RAS Failover to an OSP Server



Note   For information on configuring an OSP server in the network, see Provisioning OSP Servers to the Gateway, page 3-12.

LRQ Forwarding Between Directory Gatekeepers (Limited Egress CSR)

As an added enhancement to simple carrier interconnect applications, the Cisco Wholesale Voice Solution has a limited ability to route a call to different destination carriers. This allows one service provider's DGK to send sequential LRQs (Location Requests) to other SPs' DGKs to route a call properly. The wholesaler has the same considerations as with simple carrier interconnect models, but with slightly increased call routing responsibilities.

The DGK can make limited egress carrier sensitive routing (CSR) decisions using the sequential LRQ feature. All simple, interconnect applications using DGK routing can apply this. For the most part, this consists of any TDM partners and DGK peering partners, but also includes any OSP partners where an OSP interconnection zone is used (as opposed to direct implementation on the wholesaler's GWs).

For example, the wholesaler may provision their DGKs to route certain destination-patterns to carrier A first. If carrier A is unavailable [as determined by an LRJ (Location Reject) or LRQ timeout], the wholesaler may try carrier B, then C, and so on. Figure 2-18 illustrates this application, sequential LRQ forwarding in support of limited egress CSR.


Figure 2-18   Limited Egress CSR Using Sequential LRQs


Sequential LRQ places the following restrictions on egress CSR:

The gatekeeper routes calls by means of DNIS. The wholesaler statically configures a list of possible egress carriers for destinations and they are tried in order. Routing decisions are not based on which carrier sourced the call. For example, if carrier A sourced the call, it does not determine that carrier A is the first carrier selected for termination.

Each destination carrier must be contained within its own zone. For ITSP carriers interconnecting through a DGK, this is fairly simple. Interconnecting ITSPs are seen as single remote zones to which the wholesaler DGK sends LRQ messages. For interconnecting TDM carriers, this implies that the GWs capable of sending calls to the carrier are grouped into their own hopoff zone managed by a GK, and that multiple carriers are never supported on a single GW.

Sequential LRQ selection order is statically configured. There is no provision for percentage-based routing, maximum minute cutoffs, and so on. Egress carriers are always chosen from a statically configured list of routes. If the DGK determines that an OSP interconnection zone handles a route, it is possible that the OSP server returns a terminating GW on the basis of advanced routing logic if so provisioned. For example, the OSP server may dynamically select a least-cost, terminating carrier according to criteria such as time of day or best voice quality. These options depend on the OSP server.

If OSP interconnections are supported directly from the POP GWs, sequential LRQs on the DGK may still be used to select an egress carrier through TDM or DGK peering interconnects if calls originate from any of the wholesaler POPs. If RAS fails to offer any routes, the GW may reoriginate the call through an OSP server to find termination through an IP interconnect.

For calls entering the wholesaler network from an OSP server, all POP GWs register with the OSP server. The OSP server may be provisioned with terminating carrier information and advanced routing logic rules to return the desired egress carrier GW.

Configuring a Limited CSR Application

Figure 2-19 illustrates an example network for which we will demonstrate the configuration of limited CSR. The DGK in the zone NETMAN sends LRQs sequentially to the new SP's DGKs, until the DGK zone that can route the call is found. The GK in that zone then sends an LCF confirming the route to the NETMAN GK.

We have added three new service providers in New Zealand (country code, or international calling code = 64) to our original network (see Figure 2-7): ITSP-A, ITSP-B, and ITSP-C. Now look at the required configuration, which resides on the NETMAN DGK, 172.19.49.190.

We have already established the following in the provisioning we have done so far:

gatekeeper
zone local DGK netman.com 172.19.49.190
zone remote NA-GK netman.com 172.19.49.168 1719
zone remote AS-GK netman.com 172.19.49.172 1719
zone remote E-GK netman.com 172.19.49.176 1719
zone remote NA-AGK netman.com 172.19.49.169 1719

The following new three lines establish remote zones for our three new SPs:

zone remote ITSPA-DGK itspa.com 206.1.1.1 1719
zone remote ITSPB-DGK itspb.com 207.1.1.1 1719
zone remote ITSPC-DGK itspc.com 208.1.1.1 1719

We have already established the following country code prefixes (see Table 2-2):

zone prefix NA-GK 1*
zone prefix E-GK 33*
zone prefix AS-GK 86*

Now we establish the new country code prefixes for the following DGKs, and add a zone remote statement that directs them to the NETMAN DGK:

zone prefix ITSPA-DGK 64*
zone prefix ITSPB-DGK 64*
zone prefix ITSPC-DGK 64*
zone remote NA-GK netman.com 172.19.49.168 1719
lrq forward-queries <----activates LRQ forwarding
no shutdown

Figure 2-19   Example Configuration of Limited CSR


Configuring Back-to-Back Gateways

The following introductory information is borrowed in part from the Cisco Wholesale Voice Solution Overview, which contains additional information related to various features of back-to-back GWs. Platforms considered for back-to-back configurations are the Cisco 3600 series, the Cisco AS5300, the AS5350, and the Cisco AS5400. The Cisco 3600 series is not used where SS7 signaling is required.

Design Objective

The back-to-back GW is a special component used for a variety of applications. GWs are deployed as a pair in a back-to-back TDM T1 CAS or E1 R2 trunk, single-stage dialing configuration. Depending on the application, back-to-back GWs may function as unidirectional or bidirectional call devices.

For example, in an IVR application, the back-to-back GW has a dedicated half that receives all calls while the other half is dedicated to originating calls. In contrast, for an OSP interconnect zone application, the back-to-back GW may process calls in both directions, although each GW is responsible for separate protocols. For unidirectional applications, to provide added clarity in discussing back-to-back GW pairs, we refer to the individual GWs in a pair as an ingress (inbound) VoIP GW and an egress (outbound) VoIP GW with respect to the call direction. For bidirectional applications, we generally refer to the GW by the protocol it supports.

Figure 2-20 illustrates the use of multiple back-to-back GWs within a wholesaler's network, to partition call billing among various ITSPs, an OSP clearinghouse, and a Clarent domain.

The GW pair allows wholesalers to insert themselves into the call-signaling path in IP-to-IP interconnect call topologies. This allows them to generate usage records by means of AAA, interconnect with Clarent-based and OSP-based environments, and front-end PC-to-phone applications for IP-based interconnect partners. In many ways, the back-to-back GW area functions just like a normal non-SS7 POP, with the implications discussed in the subsections that follow.

Signaling

Back-to-back GWs simply need to be configured with similar TDM signaling types. However, Cisco recommends that you use ISDN PRI signaling. Although one DS0 is lost to signaling, the call setup time is faster with ISDN (generally less than 2 seconds) than it is for T1 CAS signaling (up to 4 or 5 seconds). Use T1 or PRI crossover cables to provide the physical connection between each router.


Note   The GWs in each back-to-back pair are cabled directly to each other (through T1 connections) by means of an RJ-45-to-RJ-45 T1 crossover cable.

Transit Gateways

A transit GW is a back-to-back GW that acts as a proxy between an OSP clearinghouse or Clarent GK and the H.323 GK VoIP network. Transit GWs are used to enable routing by the OSP or Clarent entities without disrupting the existing H.323 network. For example, in an OSP scenario, only OSP-based calls go through the back-to-back transit GW, eliminating the need for additional OSP overhead on other GWs. The same applies in principle in a Clarent scenario.

Voice Quality/Bearer Issues

Voice quality suffers especially in the case of tandem compression. The use of back-to-back gateways adds both postdial delay and latency for all calls. There is even greater impact if more than one back-to-back GW zone is traversed. Fax relay may also suffer.


Figure 2-20   Relationship of the Back-to-Back GW to Wholesaler and Carriers



Caution   Modem passthrough is highly unreliable, and as a result is not supported in scenarios that employ back-to-back GWs.


Caution   Where two back-to-back GWs (that is, four routers) are used in the path of a VoIP call, the end-to-end delay can approach 250 ms, with undesirable effects on QoS. In addition, in fax calls the tones transmitted across two back-to-back GWs are not received correctly at the terminating GW, because three encode/decode sequences are involved. Consequently, Cisco recommends that no more than one back-to-back GW be used in an end-to-end call.

Configuration Examples

The following example scenarios are discussed in this section:

Back-to-Back Gateway in an IP-to-IP Topology

We begin with a back-to-back GW in a fundamental IP-to-IP interconnect scenario, as illustrated in Figure 2-21.


Figure 2-21   Back-to-Back GW in an IP-to-IP Topology


On the ingress side of wholesaler B's network, wholesaler A terminates calls beginning with country code 61. On the egress side of wholesaler B's network, wholesaler C terminates calls beginning with 1408. (I and E in wholesaler B's network represent ingress and egress, respectively.)

The call flow is as follows:

1. Customer at 611011112222 calls 14085551111.

2. GWA is configured to forward all 1408* numbers to GWI (ingress side of back-to-back GW).

3. GWI terminates the call on the POTS side.

4. GWI reoriginates the call to GWE (egress side of the back-to-back GW).

5. GWE sends an ARQ to GKE, the GK supporting GWE, to identify the terminating GW, GWC.

The following configuration examples look at the configurations on GWI and GWE, as well as that on GWA, the originating GW.


Note   Only those steps of interest to the back-to-back configuration are shown.

Ingress Back-to-Back GW: GWI
hostname GWI
!
!

Step 1   Establish the PSTN switch type. This will depend on the network to which you are interfacing, and must be the same for both the ingress and egress GW.

isdn switch-type primary-ni
isdn voice-call-failure 0
!

Step 2   Configure the T1 controller for PRI. This is the controller that will be connected to the second GW of the pair, GWE.

controller T1 0
framing esf
clock source line primary
linecode b8zs
pri-group timeslots 1-24
!
interface Serial0:23
no ip address
isdn switch-type primary-ni
isdn protocol-emulate network
isdn incoming-voice modem <---selects the DSP for voice
fair-queue 64 256 0
no cdp enable
!
controller T1 3
framing esf
clock source line secondary 1
linecode b8zs
ds0-group 1 timeslots 1-24 type e&m-fgb dtmf dnis <---establishes DS0 group and signaling
!
interface Ethernet0
no ip address
shutdown
!
interface FastEthernet0
ip address 172.19.49.76 255.255.255.128 <---the address of this GW
duplex auto
speed auto
h323-gateway voip interface
h323-gateway voip id gk-lab.cisco.com ipaddr 172.19.49.5 1719 <---ID/address of GK
h323-gateway voip h323-id GWI.cisco.com <---H.323 ID of this GW, GWI
!
ip classless
ip route 0.0.0.0 0.0.0.0 172.19.49.1
no ip http server
!
voice-port 0:D
!
voice-port 3:1

Step 3   Configure the POTS dial peer to terminate 1408 calls. Because we want to preserve the entire ANI string, we use the command no digit-strip.

!
dial-peer voice 1 pots
destination-pattern 1408.......
no digit-strip
port 0:D
!
!
dial-peer voice 1408 pots
destination-pattern 1408.......
port 0:D
prefix 1408
!

Step 4   Establish the router as a GW, an essential step.

gateway
!



Egress Back-to-Back GW: GWE
hostname GWE
!
isdn switch-type primary-ni
isdn voice-call-failure 0
!

Step 1   Configure the T1 controller for PRI. This is the controller that will be connected to the first GW in the back-to-back pair, GWI.

controller T1 0
framing esf
clock source line primary
linecode b8zs
pri-group timeslots 1-24
!
interface Serial0:23
no ip address
isdn switch-type primary-ni
isdn incoming-voice modem
fair-queue 64 256 0
no cdp enable
!
interface FastEthernet0
ip address 172.19.49.77 255.255.255.128 <---the address of this GW
duplex auto
speed auto
h323-gateway voip interface
h323-gateway voip id gk-lab.cisco.com ipaddr 172.19.49.5 1719 <---ID/address of GK
h323-gateway voip h323-id GWE.cisco.com <---H.323 ID of this GW, GWE
h323-gateway voip tech-prefix 1#
!
ip classless
ip route 0.0.0.0 0.0.0.0 172.19.49.1
no ip http server
!
voice-port 0:D
!
dial-peer voice 2 voip
destination-pattern 1408.......
session target ras
!

Step 2   Configure the POTS dial peer for incoming calls from 61*. Again, because we do not want to send dial tone, we use the command direct-inward-dial.

dial-peer voice 61 pots
incoming called-number 61..........
direct-inward-dial
!
gateway
!



Originating GW: GWA
hostname GWA
!
interface FastEthernet0
ip address 172.19.49.77 255.255.255.128
duplex auto
speed auto
h323-gateway voip interface
h323-gateway voip id gk-lab.cisco.com ipaddr 172.19.49.5 1719 <---ID/address of GK
h323-gateway voip h323-id GWA.cisco.com <---H.323 ID of this GW, GWA
h323-gateway voip tech-prefix 1#

Note    For a discussion of tech prefixes, see Technology Prefixes 2-7.

!
ip classless
ip route 0.0.0.0 0.0.0.0 172.19.49.1
no ip http server
!
voice-port 0:D
!
voice-port 3:1
!
dial-peer voice 1 pots
destination pattern 61...........  <---here is the destination pattern
port 0:D
!

Note    The first GW in the pair is configured as the session target for all calls to 1408*. Using the explicit IP address simplifies the dial plan.

dial-peer voice 2 voip
destination-pattern 1408.......
session target ipv4:172.19.49.76 <---IP address of GWI
!
!
gateway
!



Back-to-Back Gateway in an OSP Transit Zone

Now we look at a back-to-back GW in an OSP transit zone, as illustrated in Figure 2-22. (See Transit Gateways.)


Figure 2-22   Back-to-Back GW in an OSP Transit Zone


This scenario illustrates how two GWs in a back-to-back configuration can be used to create a transit zone to interconnect OSP-based networks. The ingress GW (GWI) is configured to register with the Cisco GK and acts as the demarcation point into the Cisco H.323 RAS network. The egress GW (GWE) is configured to register with the OSP server. The configuration of GWE is provided below. The configuration for GWI is not included, because it is configured as in Back-to-Back Gateway in an IP-to-IP Topology.

Billing CDRs for GWI are generated and reported to a RADIUS/AAA server (not shown). Billing for GWE is handled through usage indication messages sent directly to the OPS server.

The call flow is as follows:

1. Customer at 611011112222 calls 14085551111.

2. GWA is configured to forward all 1408* numbers to GWI (ingress side of back-to-back GW).

3. GWI terminates the call on the POTS side.

4. GWI reoriginates the call to GWE (egress side of the back-to-back GW).

5. GWE sends an OSP Authorization Request to the OSP server, to identify the terminating GW, GWC.

Egress GW: GWE

The following annotated configuration excerpt provides for GWE to register with the OSP server.

!
crypto ca identity OSP_clear   <---OSP_clear is the identity of the OSP server
enrollment url http://147.14.25.169:80/81    <---the protocol is HTTP; OSP server's address
crl optional
crypto ca certificate chain OSP_clear
certificate 54   <---the crypto certificate follows
30820206 3082016F A0030201 02020154 300D0609 2A864886 F70D0101 04050030
2D310B30 09060355 04061302 5553310E 300C0603 55040A13 05436973 636F310E
300C0603 55040313 056F7370 2D31301E 170D3031 30333032 32323439 30305A17
0D303230 33303232 32343930 305A303E 310B3009 06035504 06130255 53310E30
0C060355 040A1305 43697363 6F311F30 1D06092A 864886F7 0D010902 16107931
2E666965 6C646C61 62732E63 6F6D305C 300D0609 2A864886 F70D0101 01050003
4B003048 024100C3 82B4EAFD 1668C22C F1FF2609 35A63273 3D6BFC4E AE190BC3
49DC990C 6DF497F4 1799FFB9 7BD519A9 DAC8870A 2F86CDDA DB05E861 2494FD46
B8FB763B F026F102 03010001 A3693067 30090603 551D1304 02300030 0B060355
1D0F0404 030205E0 304D0603 551D1F04 46304430 42A040A0 3E863C6C 6461703A
2F2F6F73 702D312F 434E3D6F 73702D31 2C4F3D43 6973636F 2C433D55 533F6365
72746966 69636174 65526576 6F636174 696F6E4C 69737430 0D06092A 864886F7
0D010104 05000381 81003B8E 0E1809A3 76403529 FC02A523 EC8E0AFD 4A702EDB
A9CCBBB8 5CB12984 B69D8A21 3E67A122 BDD86122 7131FE55 21CA2C94 3FA689C5
52D29D31 542BB8B8 0BABD2D7 0AA054A3 5FE8A287 1DDE6504 B5D2A5FE C879BDFF
1DE9294C 6FDC9F3C 5E35126E 200D9F19 F03589A8 F810FD17 221AC2E0 848E8BEA
A03247A2 7EBA7185 289A
quit
certificate ca 01
30820258 308201C1 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
2D310B30 09060355 04061302 5553310E 300C0603 55040A13 05436973 636F310E
300C0603 55040313 056F7370 2D31301E 170D3030 30393330 30313432 33375A17
0D313030 39333030 31343233 375A302D 310B3009 06035504 06130255 53310E30
0C060355 040A1305 43697363 6F310E30 0C060355 04031305 6F73702D 3130819F
300D0609 2A864886 F70D0101 01050003 818D0030 81890281 8100E009 863B2A53
B21B7F23 D8F31F70 B2E1DF69 6FA0E7C3 851BCD08 78EEA950 BBD32EDF 21B42259
7F5F31D0 B7C4EB29 A0D964C9 C0B1010E 26C202CB CE7B3E5D 8D932DD6 83EB0C32
3AD1CAF6 1FC31BB6 8DFB2851 E2568956 9BF2AA49 F61FC3FF 29A2351E BC095B87
022F4DDE FAB7A554 96C3A77C E42713EE 6CFBDE54 2CF8639C AC410203 010001A3
81873081 84301D06 03551D0E 04160414 B44E41DE 7B1A3C7E 4C3E7171 74471C72
6DAB4A57 30550603 551D2304 4E304C80 14B44E41 DE7B1A3C 7E4C3E71 7174471C
726DAB4A 57A131A4 2F302D31 0B300906 03550406 13025553 310E300C 06035504
0A130543 6973636F 310E300C 06035504 0313056F 73702D31 82010030 0C060355
1D130405 30030101 FF300D06 092A8648 86F70D01 01040500 03818100 6A43ED0F
0F9B5FBE 48DB09EE 3A6880FA 586D90F5 A848BB16 80257812 8FB7324B 6F74E3DC
BC04D29E 8621B667 DBA6EB21 62603E6B FA827425 8AF1553D 6B720F25 C11334E2
C19080AA 9F2BD742 AC01C892 471F8499 A6CE971C 59BDC184 41027F0C 878BAB36
3B29D82B 99CA360B F6D33BCA DC756927 8FE59029 70016F52 77036408
quit
!
dial-peer voice 1408 voip
destination-pattern 1408.
session target settlement:0   <----the "settlement" matching settlement 0
!
settlement 0
type osp
url http://147.14.25.169    <---address of OSP server
encryption des-cbc-sha
no shutdown



Back-to-Back Gateway in a Clarent Transit Zone

This is similar to our previous example, except that now a Clarent GK and associated Clarent Command Center replace the OSP server. See Figure 2-23.


Figure 2-23   Back-to-Back GW in a Clarent Transit Zone


This scenario describes how a back-to-back GW can be used to create a transit zone when interconnecting with Clarent-based networks. The ingress GW (GWI) is configured to register with the Cisco GK and acts as the demarcation point into the Cisco H.323 RAS network. The second B2B GW (GWE) is configured to register with the Clarent GK, which supports H.323 on one side and Clarent proprietary protocol on the other. The configuration of the egress GW, GWE, is provided below. The configuration for GWI is not included, because it is configured as in Back-to-Back Gateway in an IP-to-IP Topology.

GWE will look essentially like another GW to the Clarent Command Center, and CDRs will be generated through the same GK Routed Call Signaling (GKRCS) methods that Clarent supports.

The call flow is as follows:

1. Customer at 611011112222 calls 14085551111.

2. GWA is configured to forward all 1408* numbers to GWI (ingress side of back-to-back GW).

3. GWI terminates the call on the POTS side.

4. GWI reoriginates the call to GWE (egress side of the back-to-back GW).

5. GWE sends an ARQ to the Clarent GK, to identify the terminating GW, GWC.

Egress GW: GWE

The following annotated configuration excerpt provides for GWE to register with the Clarent GK.

hostname GWE
!
isdn switch-type primary-ni
isdn voice-call-failure 0
!

Step 1   Configure the T1 controller for PRI. This is the controller that will be connected to the ingress GW, GWI.

controller T1 0
framing esf
clock source line primary
linecode b8zs
pri-group timeslots 1-24
!
interface Serial0:23
no ip address
isdn switch-type primary-ni
isdn incoming-voice modem
fair-queue 64 256 0
no cdp enable
!
interface FastEthernet0
ip address 172.19.49.77 255.255.255.128
duplex auto
speed auto
h323-gateway voip interface
h323-gateway voip id gk-lab.cisco.com ipaddr 172.19.49.5 1719
h323-gateway voip h323-id GWE.cisco.com
h323-gateway voip tech-prefix 1#
!
ip classless
ip route 0.0.0.0 0.0.0.0 172.19.49.1
no ip http server
!

Step 2   Use a translation rule such as the one below to translate the 1408 * to a national number type, which is the Clarent default.

translation-rule 1
rule 1 ^1408....... 1408 ANY national
!
voice-port 0:D
!
dial-peer voice 2 voip
destination-pattern 1408.......
session target ras
translate outgoing-called 1
!

Step 3   Configure the POTS dial peer for incoming calls from 61. Because we do not want send dial tone, we use the command direct-inward-dial.

dial-peer voice 61 pots
incoming called-number 61
direct-inward-dial
!
gateway
!



Multiple Back-to-Back Gateways

Finally, we consider the case of multiple back-to-back GWs. Where traffic requirements are high, these provide more than one TDM interface worth of simultaneous calls. Figure 2-24 illustrates this topology. The basic issues to consider are the following:

1. Configure the ingress and egress GWs in the back-to-back pair as in Back-to-Back Gateway in an IP-to-IP Topology.

2. Use dial peers to groom the traffic you want assigned to each back-to-back GW.


Figure 2-24   Multiple Back-to-Back GWs


Establishing Core Components

This section discusses the following installation and provisioning topics:


TimeSaver Because it depends on many components, the Cisco Wholesale Voice Solution depends upon many documents. As noted in Related Documents, you can access these documents directly from the electronic version of this guide by clicking on the URL. The following sequence will help you navigate to where these documents reside on Cisco's public website, http://www.cisco.com/univercd/home/home.htm.

Before proceeding, however, you may find it useful to size your network, as discussed in the section below.

Determining Numbers of Components

Sizing your network, or determining the number of components of a certain type to serve a given architecture, is not an exact science. However, there are general guidelines that provide good first-order estimates. The following discussion will help you estimate approximate numbers for the following relationships:

Number of POPs Required

POPs are locally defined entities that serve both common prefixes as well as distinct geographical serving areas. It is the responsibility of the service provider to determine the number and location of POPs that will partition the wholesale network to accommodate anticipated traffic.

Number of GWs Required per POP

Consider the following in designing the service provider POP:

The BHCA supported per platform depends on the following factors:

However, the majority of these factors are beyond the scope of the following discussion.

First consider the maximum number of BHCA a given POP must support during the busiest time of day. The general formula is as follows:

POP BHCA = Max POP CPS * 60 * 60

where POP BHCA is the peak traffic the entire POP must support, Max POP CPS is the maximum anticipated calls per second for the entire POP, and 60 * 60 is the number of seconds per minute times the number of minutes per hour. A good working number for Max POP CPS at peak calling periods is 5, which we use in our examples.

Next consider the BHCA per DS0. The general formula is as follows:

DS0 BHCA = (60/HT)

where DS0 BHCA is the maximum number of DS0s per hour supported, 60 is the number of minutes per hour, and HT is hold time.

Thus, for an HT of 3, we obtain a DS0 BHCA of 20.

Now we need to know the BHCA for a given GW, the GW BHCA. However, the maximum number of DS0s per GW depends not only on the GW but also on the signaling type. Table 2-3 presents sizing parameters for the four common signaling types, for a Cisco AS5300. That router supports a typical maximum call rate of 2 CPS, a maximum of 92 T1 DS0s, and a maximum of 120 E1 DS0s. Numbers in parentheses indicate both origination and termination.

Table 2-3   Sizing Parameters per Signaling Type, for a Cisco AS5300

Parameter T1 PRI T1 CAS E1 PRI E1/R2

GW BHCA

18401

1920

24002

2400

Number of GWs

544 (1088)

521 (1042)

417 (834)

417 (834)

Number of Zones

6 (12)

6 (12)

5 (10)

5 (10)

192 * 20 BHCA per DS0

2120 * 20 BHCA per DS0 (0.67 CPS)

If we assume a Max POP CPS of 5 in our example POP, we obtain a POP BHCA of 18,000. Now we need to know the number of GWs we need to support this call rate. The general formula is as follows:

Number of GWs = (POP BHCA)/(GW BHCA)

So, if we take an E1 example, we have a GW BHCA of 2400, resulting in

Number of GWs = (POP BHCA)/2400)

= 18,000/2400

= 7.5 GWs needed to support a BHCA of 18,000

= 8 GWs needed

(Fractional GWs are not practical.)


Note   However, at this point you may wish to reassess your traffic requirements in favor of saving a GW if possible.

Number of GKs Needed to Support the GWs

Now we proceed to estimating the number of GKs needed to support our GWs. With a Cisco 7200 GK, call success rates of 99% have been seen with 1000 registered endpoints (GWs) at 60 CPS (that is, 60 transactions with the GK per second during peak calling periods). We must ensure that this rate is not exceeded given the number of GWs being served by the GK and the CPS those GWs can handle. In other words, we are looking for a maximum GK CPS (Max GK CPS) that is below 60.


Note   For the Cisco 3660 as a GK, call success rates of 99% have been seen with 1000 endpoints at 40 CPS.

The following calculations are for a single POP. Here we must consider the maximum CPS for a GW, which we will call Max GW CPS. This figure varies according to platform, but here we will again assume a Max GW CPS of 2 for the Cisco AS5300. Max GK CPS is a function of the number of GWs. The general formula is as follows:

Max GK CPS = Number of GWs * Max GW CPS

For a single POP with the 8 GWs we derived previously, this is

Max GK CPS = 8 * Max GW CPS

= 8 * 2

= 16 CPS maximum to support a BHCA of 18,000

If we have three symmetrical POPs with 8 GWs each to service an SP network, can we service them with a single GK? Three POPs places a load on the GK of 3 * 16 = 48 Max GK CPS—clearly within our recommended limit of 60 Max GK CPS. With asymmetrical POPs, simply count the total number of GWs you need to serve by a single GK, and ensure that you do not exceed 60.


Note   Theoretically, you could therefore support up to 30 (2 * 30 = 60) Cisco AS5300 GWs with a single Cisco 7200 GK.

Number of DGKs Needed to Support the GKs

Finally, we need to determine how many DGKs we will need to support our GKs. The key factor here is CPU load. The following rough guidelines have been established through testing:


Caution   Cisco recommends that you adhere to a GK/DGK ratio of 6:1. Also take into account that typical DGK deployments handle less than 100% of new calls, and that GK/DGK ratios will increase.

In a service provider network with three symmetrical POPs with 8 GWs each, we have a total of 3 GKs, clearly within the GK/DGK ratio of 6:1. However, the recommended 6:1 GK/DGK ratio is for 100% new calls. For a call load of 20% of that, we can have a 30:1 ratio of GKs to DGKs:

(1/0.2) * 6 = 30

Establishing Gateways

If your application does not require SS7 signaling, the GW provisioning discussed below is sufficient. If SS7 signaling is required, refer to "Provisioning SS7-Based POPs."

Selecting the Appropriate Gateway

Refer to Table 2-4 for the following discussion.

Table 2-4   Cisco VoIP Gateways, Interface Modules, and Supported Signaling Types

Platform Interface Modules Signaling Types

Cisco 3600 series GWs
(Cisco 3620, Cisco 3640, Cisco 3660)

NM-2V

  • Analog FXO WIC
  • Analog E&M WIC
  • BRI WIC

Analog FXO ground start, loop start, immediate start

Analog E&M types I through V

BRI (ETSI, NI-2)

NM-HDV-1 T1/E1

NM-HDV-2 T1/E1

T1/E1 WVIC

PRI (ETSI, NI-2)

T1 CAS (FGB1, FGD)

E1 R2

E1 R2—MF

Cisco AS5300,
Cisco AS5350

Quad T1

Quad E1

PRI (ETSI, NI-2)

T1 CAS—(FGB, FGD)

E1 R2

E1 R2—MF

Cisco SS7 Interconnect for Voice Gateways (Q.767, TR-113, China TUP)

Cisco AS5400

Octal T1/E1

CT1/CE1/PRI (ETSI, NI-2)

T1 CAS (FGB, FGD)

E1 R2

E1 R2—MF

DS3

Cisco SS7 Interconnect for Voice Gateways (Q.767, TR-113, China TUP)

1FG = feature group

Follow the steps below to establish GWs and interfaces appropriate to your network.


Note   For the latest information, always visit the website that supports your Cisco equipment.


Step 1   Determine the types of GWs you will use. Refer to the Platform column in Table 2-4.

    a. For Cisco 3620, 3640, and 3660 GWs, see Procedures for Cisco 3600 Series Gateways.

    b. For Cisco AS5300 series GWs, see Procedures for Cisco AS5300 Gateways.

    c. For Cisco AS5350 and Cisco AS5400 GWs, see Procedures for Cisco AS5350 and Cisco AS5400 Gateways.

Step 2   Determine the signaling types required for each interface you need to support. This will depend on your telephony service provider. Refer to the Signaling Types column in Table 2-4.

Step 3   Determine the types of interface cards required to support the required signaling. Refer to the Interface Modules column in Table 2-4.

Step 4   Install and provision the interface cards as needed, considering the following parameters:

    a. For Cisco 3620, Cisco 3640, and Cisco 3660 GWs, see Procedures for Cisco 3600 Series Gateways.

    b. For Cisco AS5300 series GWs, see Procedures for Cisco AS5300 Gateways.

    c. For Cisco AS5400 GWs, see Procedures for Cisco AS5350 and Cisco AS5400 Gateways.

Step 5   When you are done you will have established the necessary access GWs. Now refer to the following:

    a. To establish GKs, see Establishing Gatekeepers.

    b. To establish DGKs, see Establishing Directory Gatekeepers.

Procedures for Cisco 3600 Series Gateways

Follow the steps below to access the necessary documentation:

1. Refer to the following: Cisco 3600 Series Routers at

http://www.cisco.com/univercd/cc/td/doc/product/access/acs_mod/cis3600/index.htm

2. If you have not yet installed this equipment, begin with the following series of documents at the above URL:

Procedures for Cisco AS5300 Gateways

Follow the steps below to access the necessary documentation:

1. Refer to the following: Cisco AS5300 at

http://www.cisco.com/univercd/cc/td/doc/product/access/acs_serv/5300/index.htm

2. If you have not yet installed this equipment, begin with the following series of documents at the above URL:

Procedures for Cisco AS5350 and Cisco AS5400 Gateways

Follow the steps below to access the necessary documentation:

1. Refer to the following: Cisco AS5400 at

http://www.cisco.com/univercd/cc/td/doc/product/access/acs_serv/as5400/index.htm

2. If you have not yet installed this equipment, begin with the following series of documents at the above URL:

Establishing Gatekeepers

The Cisco Wholesale Voice Solution uses Cisco 3640, Cisco 3660, and Cisco 7200 routers as GKs.

Selecting the Appropriate Gatekeepers

Your selection of Cisco hardware to function as GKs will depend on the traffic needs of your network.

Procedures for Cisco 3600 Series (Cisco 3640, Cisco 3660) Gatekeepers

See Procedures for Cisco 3600 Series Gateways.

Procedures for Cisco 7200 Gatekeepers

Depending on which router you have selected (Cisco 7202, Cisco 7204, or Cisco 7206), follow the steps below to access the necessary documentation:

Cisco 7202

1. For the Cisco 7202, refer to the following:

Cisco 7202 at

http://www.cisco.com/univercd/cc/td/doc/product/core/7202/index.htm

2. If you have not yet installed this equipment, begin with the following document at the above URL:

Cisco 7202 Installation and Configuration Guide

Cisco 7204

1. For the Cisco 7204, refer to the following:

Cisco 7204 at

http://www.cisco.com/univercd/cc/td/doc/product/core/7204/index.htm

2. If you have not yet installed this equipment, begin with the following document at the above URL:

Cisco 7204 Installation and Configuration Guide

Cisco 7206

1. For the Cisco 7206, refer to the following:

Cisco 7206 at

http://www.cisco.com/univercd/cc/td/doc/product/core/7206/index.htm

2. If you have not yet installed this equipment, begin with the following document at the above URL:

Cisco 7206 Installation and Configuration Guide

Establishing Directory Gatekeepers

DGKs are an optional, not mandatory, component of the Cisco Wholesale Voice Solution. However, they are required in large-scale H.323 VoIP networks. The Cisco Wholesale Voice Solution uses Cisco 3640, Cisco 3660, and Cisco 7200 routers as DGKs. The Cisco 3620 is not appropriate for this purpose.

Selecting the Appropriate Directory Gatekeeper

Your selection of Cisco hardware to function as DGKs will depend on the traffic needs of your network.

Procedures for Cisco 3600 Series Directory Gatekeepers

See Procedures for Cisco 3600 Series Gateways.

Procedures for Cisco 7200 Directory Gatekeepers

See Procedures for Cisco 7200 Gatekeepers.


hometocprevnextglossaryfeedbacksearchhelp
Posted: Tue Jan 21 02:45:48 PST 2003
All contents are Copyright © 1992--2002 Cisco Systems, Inc. All rights reserved.
Important Notices and Privacy Statement.