atcomsystems.ca/forum Forums TDM Business Telephone Systems Inter-Tel Telephones & Systems 8602 IP softphone

Does anyone have any experience with this softphone? Is it compatible with the Axxess system? Can I use any other softphones with an Axxess v9.004 system? We have a 16-port IPRC card installed. I know I need the endpoint licenses, but is there anything else I need to enable off-site IP telephony to the Axxess? I'd prefer to try the softphone instead of an 8662 since the user travels frequently.

So many questions, so little knowledge...
Mike

We'll need some more information. At what point does it not work? In what environment does it fail (your internal network or using the internet)? Do you have the proper license? Endpoints use a Type A license while softphone uses a Type B license. PM me and I'll send you the IP manual.

I belieive you have to be on 9.0 or greater to use the 8602. As dfeschute said it will have to be licensed appropriately as well. Once you have the right version/license it works great. You will need to do the normal network engineering work to ensure decent VoIP performance; a difficult task using the public Internet. If you have a decent connection back to the IPRC card (low packet loss, low latency, low jitter) it will perform well. 9.0/8602 supports near and far end NAT so I would recommend that you put your IPRC card behind your firewall and simply permit the required TCP/UDP ports through to the NAT IP that you plan to use. Get yourself a decent USB headset and you are ready to rock.

I suppose I should clarify. We don't currently have this implemented. I was looking for input regarding what requirements there were and what was possible. We have ordered the class B license and the software so we'll see how well it works when it's up and running.

Our vendor said we needed to be on 10.0 for it to work, but I was under the impression that version wasn't released yet. What is the most recent version of the Axxess system?

Mike

We're at 9.1XXX. I've been told that the only major difference between 9 and 10 is the increase of allowed nodes. I'm surprised they didn't try to push you into the 5000 or 7000.

10.XXX has been released for a couple months. You must be at ver 9.1XX to use the 8602 softfone...

10.XXX has been released for a couple months. You must be at ver 9.1XX to use the 8602 softfone...

Can anyone tell me how to configure our firewall to enable the softphone to connect remotely? I've tried setting up a policy to allow TCP port 5566 and UDP port 5567 through NAT to our IPRC and it isn't connecting. Is there something else I'm missing?

Have you tried connecting in the office using the internal IP?
I believe you also need to direct 5004-5069 UDP to your IPRC.
I believe 9.1x and above handles NAT much better.

I have tested it on the internal network and it works great! We've upgraded to 10.001. I just tried opening the ports you suggested but still can't connect. I'm not getting any DENY messages in my firewall log from the public IP of the client. I CAN connect if I establish a VPN connection first, but I'm hoping to get this to work through the firewall without requiring a VPN connection. Any more ideas?

Thanks,
Mike

I'd try eliminating everything at the other end too. Try connecting the phone directly to the internet (bypassing the router.)

5566 TCP (ITP Call Control)
5567 UDP (ITP Call Control)
6004-6247 (RTP & RTCP)
Axxess/IPRCs of that era supports near and far end NAT, if you are permitting those ports through you should be in good shape.
Make sure that you configure the device in the DB configured to Auto or NAT. Also make sure that you have the public IP defined in the 8602 setup.

I opened those ports and made sure to check the settings you suggested and everything is set up as you stated. Also, I am testing this from a laptop connected to Verizon's wireless network via a 1XRTT card so there is no router on the client side. I would think it might be Verizon blocking ports on their wireless network, but since it works through the VPN is that still a possibility?

Again, this works fine if I establish a VPN connection from the client first, but not if I just try to port-forward through the firewall. Any other ideas? I'm at a loss.

Thanks,
Mike

I've been told by our firewall vendor that it does not support SIP traffic, so it appears that is the problem.

Does anyone know of another device we could implement that would accept the SIP traffic and bypass the firewall? Would we just need a second firewall to do this?

Mike

The 8602 does not use SIP, it uses ITP (InterTel Protocol) for VoiP so that is not the cause of your issue. If you can connect through the VPN, that indicates that something in your NAT is not configured properly if you have the 8602 configured for both the native and NAT IP of the IPRC card that you are connecting to AND you have that endpoint flagged for AUTO or NAT in the Axxess DB.(System/DevicesandFeatureCodes/Endpoints/[Ext]/IP Settings/NAT Address Type
What kind of firewall do you have? You should be able to see your ACL matches to determine if your NAT and your ACLs are configured properly.

We have a WatchGuard Firebox X700. I do have the NAT type configured properly in the the Axxess DB (Auto). The 8602 has both IP addresses configured properly, as well. I am certain there is something misconfigured in the firewall but since I've created a NAT policy specifically for the ports you defined I can't figure out what else to check. Here is my policy:

allow from any-external to (NAT IP)->(private IP)
ports:
5566 TCP
5567 UDP
5004-5069 TCP
6004-6247 TCP, UDP

Am I missing something?

Mike

Those are definitely the right ports, have you tried to reboot the firewall since you made the change? Some firewalls need to have their Xlate tables reset.

Ports 5004-5069 are UDP only. Ports 6004-6247 are not used on an Axxess.

Make sure your Watchguard is using the latest firmware as Watchguard has had issues in the past not supporting NAT per RFC specifications.

If the softfone works internally and works remotely via VPN, are you changing the IP address to test w/ NAT? Normally you wouldn't use an external IP address to connect via VPN.

Another thing you can do to test your NAT programming is telnet to the NAT'ed IPRC address on port 5566. If you immediately get a bunch of nonsense characters on the top of the telnet window, your NAT translation for that port is correct. Example in telnet window: "open 64.65.128.9 5566".

9.0 and higher firmware on axxess uses that port range.

I think I may have found the problem. While browsing through System Prog I found that the NAT IP Address assigned to the IPRC card is 255.255.255.255 - I assume I need to change this to our public IP address. Is that correct?

That will definitely cause it not to work

Well, that didn't fix it. I have a call in to our vendor to see if they can help figure this out. What a pain.

And here's another problem... now when we connect the 8602 via the VPN and make any sort of voice call, either IC or outgoing, we get a system alarm for insufficient bandwidth for that extension. Any ideas why that would be hapening now when it previously didn't happen?

That alarm is generated whenever network performance drops below a certain level.
The Average In Time Frame Percentage Threshold and Average In Time Frame Timer fields indicate when network characteristics inhibit voice connections. When the average number of In Time frames falls below the Average In Time Frame Percentage Threshold, and the average number of In Time frames stays below that threshold for the time given by the Average In Time Frame Timer (in seconds), the system displays a warning about insufficient bandwidth.

I too am experiencing problems with my 8602 softphone on a Inter-Tel 5000 system. It works fine inside the network but when I NAT the ports on the firewall listed above I can make and receive calls but have no Audio. I even tried pointing ports 1-65000 to the local address and it still did not work.