Bc Proxyswg 6.5.1.1 Ot

7/25/2019 Bc Proxyswg 6.5.1.1 Ot

http://slidepdf.com/reader/full/bc-proxyswg-6511-ot 1/66

Alcatel-Lucent Application Partner Program – Inter-working report - Edition 1 - page 1/66Copyright © 2013 Alcatel-Lucent, All rights reserved

Alcatel-Lucent Application Partner Program

Inter-Working Report

Partner: Blue Coat

Application type: Reverse Proxy

Application name: ProxySWG Virtual Appliance

Alcatel-Lucent Platform: OpenTouch™

The product and release listed have been tested with the Alcatel-Lucent Communication Platform and the release specifiedhereinafter. The tests concern only the inter-working between the AAPP member’s product and the Alcatel-Lucent

Communication Platform. The inter-working report is valid until the AAPP member’s product issues a new major release ofsuch product (incorporating new features or functionality), or until Alcatel-Lucent issues a new major release of such Alcatel-Lucent product (incorporating new features or functionalities), whichever first occurs.

ALCATEL-LUCENT MAKES NO REPRESENTATIONS, WARRANTIES OR CONDITIONS WITH RESPECT TO THE APPLICATIONPARTNER PRODUCT. WITHOUT LIMITING THE GENERALITY OF THE FOREGOING, ALCATEL-LUCENT HEREBY EXPRESSLYDISCLAIMS ANY AND ALL REPRESENTATIONS, WARRANTIES OR CONDITIONS OF ANY NATURE WHATSOEVER AS TO THE AAPP MEMBER’S PRODUCT INCLUDING WITHOUT LIMITATION THE IMPLIED WARRANTIES OF MERCHANTABILITY, NONINFRINGEMENT OR FITNESS FOR A PARTICULAR PURPOSE AND ALCATEL-LUCENT FURTHER SHALL HAVE NO LIABILITYTO AAPP MEMBER OR ANY OTHER PARTY ARISING FROM OR RELATED IN ANY MANNER TO THIS CERTIFICATE.

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



Certification overview

Date of certification November 2013

Alcatel-Lucent’s representativeFlorian ResidoriClaire Dechristé

AAPP member representative Jana Whitcomb

Alcatel-Lucent CommunicationPlatform

OpenTouch BE/MS

Alcatel-Lucent CommunicationPlatform Release OT 1.3 (1.3.000.042)

AAPP member application versionModel V100, v6.5.1.1SWG Edition

Application CategorySecurityGatewayCollaboration & UC

Author(s): Florian Residori, Claire DechristéReviewer(s): Lienhart Denis, Himmi Rachid

Revision History

Edition 1: creation of the document – November 2013

Test results

Passed

Refused Postponed

Passed with restrictions

Refer to the section 4 for a summary of the test results.

IWR validity extension

None

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



AAPP Member Contact Information

Contact name: Jana WhitcombTitle: Managing Director, Global Service Providers

Address:Zip Code:City:Country:

Phone: +1 206-799-2726Fax:

Mobile Phone:

Web site: www.bluecoat.comEmail address: [email protected]

mailto:[email protected]



7/25/2019 Bc Proxyswg 6.5.1.1 Ot



TABLE OF CONTENTS

1 INTRODUCTION ......................................................................................................................................... 6

1.1 GLOSSARY ............................................................ .............................................................. ........................ 7

2 VALIDITY OF THE INTERWORKING REPORT .......................................................... ........................ 8

3 LIMITS OF TECHNICAL SUPPORT ........................................................................................................ 9

3.1 C ASE OF ADDITIONAL THIRD PARTY APPLICATIONS ...................................................................................... 9

4 SUMMARY OF TEST RESULTS ............................................................................................................. 10

4.1 SUMMARY OF THE MAIN FEATURES TESTED................................................................................................. 10

4.2 SUMMARY OF PROBLEMS ........................................................................................................................... 11

4.3 SUMMARY OF LIMITATIONS ......................................................... ............................................................... 11

4.4 NOTES, REMARKS ..................................................................................................................................... 11

5 APPLICATION INFORMATION ......................................................... .................................................... 12

6 TEST ENVIRONMENT ............................................................................................................................. 14

6.1 TESTS PERFORMED ................................................................................................................................... 14

6.2 GENERAL ARCHITECTURE .......................................................................................................................... 15

6.3 H ARDWARE CONFIGURATION ................................................................. .................................................... 16

6.4 SOFTWARE CONFIGURATION ....................................................... ............................................................... 16

6.4.1 Alcatel-Lucent Communication Platform OT ....................................................... ...................... 16

6.4.2 Partner Application ........................................................ ............................................................... 16

7 TEST RESULT TEMPLATE ..................................................................................................................... 17

8 TEST RESULTS .......................................................................................................................................... 18

8.1 CLIENT INITIALIZATION AND AUTHENTICATION .......................................................................................... 18

8.2 OUTGOING CALLS ..................................................................................................................................... 19

8.3 INCOMING CALLS ...................................................................................................................................... 20

8.4 FEATURES DURING CONVERSATION ........................................................ .................................................... 21

8.5 WEB SERVICES ......................................................................................................................................... 23

8.6 M YTEAMWORK SERVICES (ONLY FOR M Y IC PC) ........................................................................................ 24

8.7 VIDEO ...................................................................................................................................................... 25

9 APPENDIX A: AAPP MEMBER’S APPLICATION DESCRIPTION .................................................. 27

9.1 SECURE WEB GATEWAY WITH THE FLEXIBILITY OF VIRTUALIZATION .............................. 27

10 APPENDIX B: CONFIGURATION REQUIREMENTS OF THE AAPP MEMBER ’S

APPLICATION .............................................................................................................................................. 29

10.1 IMPORTING A R OOT CA CERTIFICATE ..................................................................................................... 30

10.2 CREATING CERTIFICATE LIST .............................................................. .................................................... 32

10.3 CREATING A PROXY SG CERTIFICATE .............................................................. ......................................... 33

10.3.1 Creating ProxySG keyring ......................................................................................................... 33

10.3.2 Creating a Certificate Signing Request .............................................................. ...................... 34

10.3.3 Importing your certificate ......................................................................................................... 35

10.4 CREATING THE PROXY SERVICES ......................................................... .................................................... 36

10.5 CREATING THE FORWARDING HOSTS ...................................................................................................... 40

10.5.1 Host1: OT_443 ........................................................................................................................... 41

10.5.2 Host2: OT_8016 ......................................................................................................................... 42

10.6 CONFIGURING LDAP EXTERNAL AUTHENTICATION ................................................................................... 43

10.7 CREATING POLICY .................................................................................................................................. 47

10.7.1 Configuring the Forwarding Layer ........................................................................................... 48

10.7.2 Configuring a ‘Web Authentication Layer’ for client authentication by login -passwordwith LDAP directory ................................................................. ............................................................... 53

10.7.3 Configuring the Web Access Layer .......................................................................................... 54

10.7.4 Installing the Policy ................................................................ .................................................... 55

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



11 APPENDIX C: ALCATEL-LUCENT COMMUNICATION PLATFORM: CONFIGURATION

REQUIREMENTS.......................................................................................................................................... 56

11.1 OT REVERSE PROXY CONFIGURATION ...................................................................................................... 56

11.2 OT SBC CONFIGURATION ........................................................ ............................................................... 57

11.3 M Y IC PC SIP CLIENT CONFIGURATION ................................................................................................... 58

12 APPENDIX D: AAPP MEMBER’S ESCALATION PROCESS ........................................................... 60

13 APPENDIX E: AAPP PROGRAM .......................................................................................................... 61

13.1 ALCATEL-LUCENT APPLICATION P ARTNER PROGRAM (AAPP) ........................................................ ........... 61

13.2 ALCATEL-LUCENT.COM ............................................................. ............................................................... 62

14 APPENDIX F: AAPP ESCALATION PROCESS ............................................................ ...................... 63

14.1 INTRODUCTION ...................................................................................................................................... 63

14.2 ESCALATION IN CASE OF A VALID INTER -WORKING R EPORT .......................................................... ........... 64

14.3 ESCALATION IN ALL OTHER CASES ........................................................................................................... 65

14.4 TECHNICAL SUPPORT ACCESS .............................................................. .................................................... 66

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



1 Introduction

This document is the result of the certification tests performed between the AAPP member’sapplication and Alcatel-Lucent’s platform.

It certifies proper inter-working with the AAPP member’s application.

Information contained in this document is believed to be accurate and reliable at the time of printing.However, due to ongoing product improvements and revisions, Alcatel-Lucent cannot guaranteeaccuracy of printed material after the date of certification nor can it accept responsibility for errors oromissions. Updates to this document can be viewed on:

- the Technical Support page of the Enterprise Business Portal(https://businessportal.alcatel-lucent.com) in the Application Partner Interworking Reportscorner (restricted to Business Partners)

- the Application Partner portal (https://applicationpartner.alcatel-lucent.com) with freeaccess.

https://businessportal.alcatel-lucent.com/



https://applicationpartner.alcatel-lucent.com/





7/25/2019 Bc Proxyswg 6.5.1.1 Ot



1.1 Glossary

API Application Public Interface

AAA Authentication, Authorization and Accounting

CA Certificate Authority. It is part of a PKI. It issues and verifies digital certificates.

DMS Device Management Server

CSR Certificate Signing Request. This is file generated by a server to get signed by aCA which will deliver a signed certificate.

DN Distinguished Name

DNS Domain Name System. Server that translates FQDN into IP addresses.

EVS Event server

FQDN Fully Qualified Domain Name. A domain name that specifies its exact location inthe tree hierarchy of the Domain Name System (DNS). It specifies all domain levels,including the top-level domain, relative to the root domain. Ex: “myhost.mydomain.com”

IM Instant Messaging

MyIC My Instant Communicator

LDAP Lightweight Directory Access Protocol. This is a directory that can be used as anauthentication server.

OTES Opentouch Edge Server

PLMN Public Land Mobile Network

PKI Public Key Infrastructure. It provides digital certificates that can identify anindividual or an organization and directory services that can store and, when necessary,revoke the certificates.

RADIUS Remote Authentication Dial In User Service. This is an Authentication Server.

RP Reverse Proxy

SBC Session Border Controller

SSL – TLS Transport Layer Security (formerly Secure Socket Layer). It allowsclient/server applications to communicate across a network in a way designed to preventeavesdropping, tampering, and message forgery. TLS provides endpoint authentication andcommunications confidentiality over the Internet using cryptography.

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



2 Validity of the InterWorking Report

This InterWorking report specifies the products and releases which have been certified.

This inter-working report is valid unless specified until the AAPP member issues a new majorrelease of such product (incorporating new features or functionalities), or until Alcatel-Lucentissues a new major release of such Alcatel-Lucent product (incorporating new features orfunctionalities), whichever first occurs.

A new release is identified as following: a Major Release” is any x. enumerated release. Example Product 1.0 is a major product

release. a “Minor Release” is any x.y enumerated release. Example Product 1.1 is a minor product

release

The validity of the InterWorking report can be extended to upper major releases, if for example the

interface didn’t evolve, or to other products of the same family range. Please refer to the “IWRvalidity extension” chapter at the beginning of the report.

Note: The InterWorking report becomes automatically obsolete when the mentioned productreleases are end of life.

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



3 Limits of Technical support

Technical support will be provided only in case of a valid InterWorking Report (see chapter 2 “Validity of the InterWorking Report” ) and in the scope of the features which have been certified.That scope is defined by the InterWorking report via the tests cases which have been performed,the conditions and the perimeter of the testing as well as the observed limitations. All this beingdocumented in the IWR. The certification does not verify the functional achievement of the AAPPmember’s application as well as it does not cover load capacity checks, race conditions andgenerally speaking any real customer's site conditions.

Any possible issue will require first to be addressed and analyzed by the AAPP member before beingescalated to Alcatel-Lucent.

For any request outside the scope of this IWR, Alcatel-Lucent offers the “On Demand Diagnostic”service where assistance will be provided against payment.

For more details, please refer to Appendix F “AAPP Escalation Process”.

3.1 Case of additional Third party applications

In case at a customer site an additional third party application NOT provided by Alcatel-Lucent isincluded in the solution between the certified Alcatel-Lucent and AAPP member products such as aSession Border Controller or a firewall for example, Alcatel-Lucent will consider that situation as tothat where no IWR exists. Alcatel-Lucent will handle this situation accordingly (for more details,please refer to Appendix F “AAPP Escalation Process”).

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



4 Summary of test results

4.1 Summary of the main features testedNote: only the features, which interact with the ALU solution, are mentioned here.Both clients MyIC PC SIP and MyIC Mobile Android have been tested.

Feature N/A OKOKBut

NOK

Application initialization and authentication

Start and stop phase Authentication on RP using LDAP

Erreur ! Source du renvoi introuvable. Local callExternal call2nd outgoing call

Erreur ! Source du renvoi introuvable.

Local callErreur ! Source du renvoi introuvable.

External call2nd incoming call



Back and forth

Push/Get call (Transfer to another user’s device) Transfer

Web Services

Event notificationDirectory searchRouting profile modification

My teamwork services (only for MyIC PC)

IMWhiteboard

Video Calls

Video call MyIC PC SIP/MyIC Phone Video call MyIC PC SIP/ MyIC PC SIP

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



4.2 Summary of problems

OT problems:o None

Blue Coat problems:o None

4.3 Summary of limitations

OT limitations:o Caller’s picture is not displayed on remote worker side

Blue Coat limitations:

o None

4.4 Notes, remarks

It is possible to do the tests using encryption of signaling (SIP-TLS) and audio (SRTP). Usingencrypted or unencrypted signaling and media has no impact on reverse proxy.

Client authentication by certificate is not available on MyIC PC and MyIC Mobile Android.

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



5 Application information

Application commercial name: Blue Coat ProxySG

Application version: SGOS 6.5.1.1 SWG Edition

Interface type: HTTP, HTTPS, TELNET, MSN IM...

Brief application description:

Blue Coat ProxySG appliances offer a comprehensive foundation for the Blue Coat Secure WebGateway solution and advanced WAN Optimization feature sets. ProxySG appliances combine high-performance hardware with Blue Coat SGOS, a custom, object-based operating system that enablesflexible policy control over content, users, applications and protocols.Blue Coat ProxySG appliancesenable enterprise customers to:

Protect internal users and networks from spyware and other attacks. Accelerate application performance for files, email, Web, SSL, and rich media applications.

Figure 1 Global Principle

Blue Coat ProxySG Reverse Proxy Deployment Protect GP Servers/OS while providing access to Internal Enterprise Services

– Intranet Portal – Software Distribution

Secure Custom OS Fast end user Response Easily Manageable/Scalable Solution SSL Termination SSO

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



The following list details the Blue Coat ProxySG Reverse Proxy Deployment features that areused for the Alcatel-Lucent solution deployment:

– HTTPS Reverse Proxy service configured to associate a certificate with a public IP – Importing SSL keyrings and CA – Hostname or domain name based SSL certificates

– Proxy supports portal mode optimization

– HTTP basic and cookie based Authentication based on AD/LDAP or RADIUS – Powerful and flexible CPL policy

HTTP header rewriting Cookie sharing between the different FQDN

– SSL rule modification to ignore hostname mismatch – Support for “split brain” DNS architecture

The following diagram describes a typical redirection policy implemented on the Blue Coat ProxySGfor the Alcatel-Lucent solution.

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



6 Test environment

6.1 Tests performed

This document describes the tests of homeworker scenario using Blue Coat ProxySG and MyICPC SIP/ MyIC Mobile Android applications in the context of OT solution release 1.3.000.42

Blue Coat ProxySG has been virtualized on Vmware eSXI 5.1 environment.

MyIC clients use an internet connection on the WAN. Remote user is connected to the enterprisenetwork through the RP in HTTPS and to a SBC in SIP without media encryption.

OT users have several devices: at least a MyIC PC or Android and a MyICPhone desktop phone

(8082).

The way to configure OT server, MyIC PC/Android clients and Blue Coat ProxySG is described in the Appendix.

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



6.2 General Architecture

Figure 3 Test architecture

MyIC client sends web requests to OT server through Blue Coat reverse proxy which forwards therequests to the OT server located in the trusted zone.Users can be authenticated by the RP using LDAP authentication.

Blue Coat ProxySG Deployment:Public fqdn: https://opentouch2.aapp-etesting.com Public IP address: 83.206.62.68Internal fqdn: rp.etesting.labInternal IP address: 10.1.2.23Operating system: SGOS 6.5.1.1 SWG Edition

Alcatel-Lucent Communication Platform:IP address: 10.1.2.85fqdn: ice2.etesting.labDNS: 10.1.2.15

https://opentouch2.aapp-etesting.com/



7/25/2019 Bc Proxyswg 6.5.1.1 Ot



6.3 Hardware configuration

ProxySG Blue Coat SVGA series V100HP Proliant DL380p Gen8 hosting VMWare eSXI 5.1

Alcatel-Lucent OT:HP Proliant DL120 G6

6.4 Software configuration

6.4.1 Alcatel-Lucent Communication Platform OT

o OT version 1.3.000.042o MyIC PC SIP client version 5.2.009.002 o MyIC Mobile Android client version 4.3.2

6.4.2 Partner Application

ProxySG Platform:SGOS 6.5.1.1 SWG Edition, Release ID: 113853

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



7 Test Result Template

The results are presented as indicated in the example below:

TestCase

IdTest Case N/A OK NOK Comment

1

Test case 1 Action Expected result

2


The application waitsfor PBX timer orphone set hangs up

3


Relevant only if theCTI interface is adirect CSTA link

4


No indication, no errormessage

… …

Test Case Id: a feature testing may comprise multiple steps depending on its complexity. Each

step has to be completed successfully in order to conform to the test.Test Case: describes the test case with the detail of the main steps to be executed the and theexpected resultN/A: when checked, means the test case is not applicable in the scope of the applicationOK : when checked, means the test case performs as expectedNOK : when checked, means the test case has failed. In that case, describe in the field “Comment”the reason for the failure and the reference number of the issue either on Alcatel-Lucent side or on

Application Partner sideComment: to be filled in with any relevant comment. Mandatory in case a test has failed especiallythe reference number of the issue.

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



8 Test Results

In all following sections, the SIP client under test is an external user; It has been declared on thepublic side of the RP. For this remote user, MyIC PC SIP/Android has been configured to connectto OT via Blue Coat ProxySG reverse proxy.

8.1 Client initialization and authentication

These tests cover MyIC PC SIP clients initialization and authentication.

TestCase


1 Application initialization

A

MyIC PC SIP basic connection to the OTthrough reverse proxy

Check OT login/password verification

Go through MyIC application menus and verify thahtthe application is responding correctly.

Authentication viacertificate must bedisabled on the RP(not supported onMyIC PC and

Android)

B

MyIC basic connection to the OT through

reverse proxy using LDAP

Check credentials validation

2User logout/login

A

User logout/login without exiting theapplication.

Logout from MyIC client (without exiting theapplication)Check that user is disconnected

Log again MyIC userCheck that user reconnects correctly

3 Application exit

AStop MyIC client.

MyIC user is unregistered.

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



8.2 Outgoing calls

TestCaseId

Test Case N/A OK NOK Comment

1Internal outgoing call

A

Call from remote User A (MyIC PC/Android) toUser B

Check that the call is established

2 External outgoing call

A

External call from remote User A (MyICPC/Android) to user B

Check that the call is correctly established

3 Second outgoing call

A

Call from remote User A (MyIC PC/Android) toUser BCall from remote User A (MyIC PC/Android) toUser C

Check that the 2nd call is correctly established

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



8.3 Incoming calls

TestCaseId


1Internal incoming call

A

Internal call from User B to User A (MyIC PCSIP/Android)

Check that the call is correctly presented andestablished

2 External incoming call

A

External call from User B to User A (MyIC PCSIP/Android)

Check that the call is correctly presented and iscorrectly established

3 Second incoming call

A

Call from User B to User A (MyIC PCSIP/Android)Call from User C to User A (MyIC PCSIP/Android)

Check that the 2nd call is correctly presented and iscorrectly established

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



8.4 Features during conversation

TestCase

Id


1 Hold/Resume

A

Call from User A (MyIC PC SIP/Android) toUser B and establish the call.Put User B on hold.

Verify the music on hold is played

Verify you can resume the call by clicking on itagain.

2 Back and forth

A

Call from User A (MyIC PC SIP/Android) toUser B. Establish the call.Call from User A (MyIC PC SIP/Android) toUser CEstablish the call.

User B must be put on hold.

Check that you can retrieve User B.User C must be on hold.Check that you can retrieve User C.User B must be on hold.

3Transfer to another user’s device(Push call/Get call)

A

Internal call from User B to User A (MyIC PCSIP/Android), establish the communication,

then MyIC user transfers the call to another ofhis device (MyIC Phone deskphone forexample)

Check that the call is correctly presented to MyICPhone and can be correctly established

From MyIC PC SIP/Android, get the currentcall again.

Check that the call is correctly presented to MyICPC/Android and can be correctly established

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



TestCase


4 Transfer to another user

A

Call from User A (MyIC PC SIP/Android) toUser B. Establish the call.Call from User A (MyIC PC SIP/Android) toUser CEstablish the call.

Transfer User C to user B

5 User picture

A Internal call from User B to User A (MyIC PCSIP/Android)

Check that the caller’s picture is correctly presented

Caller’s picture is notdisplayed on remoteside

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



8.5 Web services

TestCaseId


1 Event notifications

A

Missed call event

From another user or station, call MyIC PCSIP/Android user but do not answer.

Check that the event logs show a missed call.

Check that it is propagated to other user’s devices.

B

Voice mail event

User B (MyIC Phone) calls User A (MyIC PCSIP/Android) and leaves a message.

User A can see a voice message in his events logs.Check that it is propagated to other user’s devices.

User A can listen to the voice message, and deleteit.The voice mail event must disappear.Check that it is propagated to other user’s devices.

2 Directory Search (dial by name)

A

User A (MyIC PC/Android) calls an OT userusing dial by name

Verify that dial by name feature is working.Check that the call can be established

3 Routing profile modification

A

On User A (MyIC PC/Android), change therouting profile of the remote user

Check that that the routing modification is working.Check that it is propagated to other user’s devices.

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



8.6 Myteamwork services (Only for MyIC PC)

Application sharing and file transfer will not be tested here as they do not use HTTP protocol.

Test

CaseId Test Case N/A OK NOK Comment

1 IM

ACheck IM is possible between remote workerand an internal user

2 Whiteboard

B

Check whiteboard session is possible

between remote worker and an internal user

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



8.7 Video

TestCase


1 Incoming call to a remote MyIC PC

A

Audio call from internal User A (MyIC PC SIP)to remote User B (MyIC PC SIP), add video.

Check that the call in audio and video is correctlypresented and established

B

Video call from internal User A (MyIC PC SIP)to remote User B (MyIC PC SIP).


C

Audio call from internal User A (MyIC Phone)to remote User B (MyIC PC SIP), add video.


D

Video call from internal User A (MyIC Phone)to remote User B (MyIC PC SIP).


E

Audio call from internal User A (OTC Ipad) toremote User B (MyIC PC SIP), add video.


Escalate an audio call

to a video call is notavailable in OTC Ipad

F

Video call from internal User A (OTC Ipad) toremote User B (MyIC PC SIP).


2 Outgoing call from a remote MyIC PC

A

Audio call from remote User A (MyIC PC SIP)to internal User B (MyIC PC SIP), add video.


B

Video call from remote User A (MyIC PC SIP)to internal User B (MyIC PC SIP).


C

Audio call from remote User A (MyIC PC SIP)to internal User B (MyIC Phone), add video.

Check that the call in audio and video is correctly

presented and established

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



TestCase


D

Video call from remote User A (MyIC PC SIP)to internal User B (MyIC Phone).


E

Audio call from remote User A (MyIC PC SIP)to internal User B (OTC Ipad), add video.


F

Video call from remote User A (MyIC PC SIP)to internal User B (OTC Ipad).


7/25/2019 Bc Proxyswg 6.5.1.1 Ot



9 Appendix A: AAPP member’s Applicationdescription

The Blue Coat ProxySG Proxy Edition of ProxySG appliances are part of Blue Coat’s ApplicationDelivery Network (ADN) infrastructure that provides complete application visibility, acceleration andsecurity. To support the Application Delivery Network, ProxySG delivers a scalable proxy platformarchitecture to secure Web communications and accelerate the delivery of business applications.ProxySG enables flexible policy controls over content, users, applications and protocols and is thechoice of more than 80% of the Fortune® Global 500.

The following picture illustrates some functionality of the ProxySG:

9.1 SECURE WEB GATEWAY WITH THE FLEXIBILITY OFVIRTUALIZATION

Blue Coat expands its unified security portfolio of enterprise appliances and cloud service to include

a virtual appliance for branch offices. The Blue Coat Secure Web Gateway Virtual Appliance (SWG

VA) combines the market-leading security capabilities of Blue Coat ProxySG with the flexibility of

virtualization to provide a cost-effective enterprise branch office solution. With the new Blue Coat

Secure Web Gateway Virtual Appliance, businesses can support Web security and other criticalremote office infrastructure on a common platform, reducing costs and IT resource requirements.

SWG Virtual Appliance extends the same depth of protection and control delivered by the Blue Coat

ProxySG appliances to small branch office locations with space limitations and limited IT resources.

The SWG VA is backed by the WebPulse Collaborative Defense of more than 75 million users which

delivers a Negative Day Defense through blocking of malnets. In addition, SWG VA offers all the

Blue Coat security capabilities enterprise customers expect, including a wide selection of user

authentication, granular and accurate web filtering with multi-dimensional categories and high-

performing inspection of SSL traffic. These combined capabilities deliver unbeatable efficiency to

help enterprises optimize IT resources and reduce physical footprint.

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



7/25/2019 Bc Proxyswg 6.5.1.1 Ot



10 Appendix B: Configuration requirements of the AAPP member’s application

To establish the HTTPS connection, the ProxySG sends its certificate to the client on behalf of theOT servers. The Root CA of etesting lab PKI has been used to sign Blue Coat ProxySG certificate.

The RP server also needs to have the Root Certificate that signed its own certificate. A largenumber of public PKI Root Certificate as Entrust or Verify sign are already loaded into the proxy butif you use your own PKI, you will need to import your root CA certificate.

Then, proxy services need to be created. They describe the kind of flows that are sent to theProxySG Reverse Proxy: the protocol and port and a number of other options.

Forwarding Hosts are the description of the backend servers to which flows are forwarded to: their

IP Address, the protocol and port used. In our cases, we need 2 Forwarding Hosts: OT_443 to callWeb Services and OT_8016 for the Event Server.

Once this is configured, policy can be created. There are three Layers for the policy:

Forwarding Layer: defines the mapping between the requests received by the ProxySG RPand those forwarded to the backend servers.

Web Authentication Layer: defines the authentication method used at the ProxySG RP.

Web Access Layer: defines filtering/firewall rules if needed

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



10.1 Importing a Root CA Certificate

Open CA Certificates from the Management Console -> Configuration -> SSL -> CA Certificates

Select the CA Certificates tab. Click on Import and choose the CA Certificate to import.

Enter the CA Name (for example “CA _etesting”) and the paste the certificate in the CA CertificatePEM field.

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



7/25/2019 Bc Proxyswg 6.5.1.1 Ot



10.2 Creating Certificate List

Create a certificate list containing trusted CA certificates. In our case, we will only use etesting rootCA.

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



10.3 Creating a ProxySG Certificate

10.3.1 Creating ProxySG keyring

Open Keyrings from the Management Console -> Configuration -> SSL -> Keyrings

Click on Create.

Choose a Keyring Name (for example “myKeyring”)

Click on OK

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



10.3.2 Creating a Certificate Signing Request

Select your keyring and click on Edit/View

Create a Certificate Signing Request for your domain with a Common Name set to*.mydomain.com.

Click on Close

Click on Apply

Reedit your Keyring.

Copy your CSR to text file and make it signed by your PKI (CA_etesting in our case).

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



10.3.3 Importing your certificate

Then, Click on Import and copy the signed Certificate.

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



10.4 Creating the Proxy Services

Open the Proxy Services from the Management Console -> Configuration -> Services -> ProxyServices.

Create a new service group named OT_SERVICES.

Create two services as follows:

Click on New

In Name: Choose “HTTPS _443”

In service group, you can select OT_SERVICES group

In Proxy Settings: select “HTTPS Reverse Proxy”

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



In keyring, choose “myKeyring”

In CA-Cert List, select “CA_etesting” ,

Do not check “Verify client” .

In Listeners, click on New

Add the IP address on which your Reverse Proxy is listening

Choose Port range: 443

And Action: Intercept

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



7/25/2019 Bc Proxyswg 6.5.1.1 Ot



Repeat this operation with HTTPS on port 8016

Once configured, services should appear in the Proxy Services as follows:

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



10.5 Creating the Forwarding Hosts

Create 2 Forwarding Hosts.

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



10.5.1 Host1: OT_443

Go to the Management Console -> Configuration -> Forwarding -> Forwarding Hosts.

Click on New

Choose an alias OT_443

For Type: select “Server”

For Host: enter the OT IP address

Check HTTPS and port 443

Click on OK

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



10.5.2 Host2: OT_8016

Go to the Management Console -> Configuration -> Forwarding -> Forwarding Hosts.

Click on New

Choose an alias OT_8016

For Type: select “Server”

Host: Enter the OT IP address

Check HTTPS port and port 8016

Click on OK

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



10.6 Configuring LDAP external authentication

Go to the Management Console -> Configuration -> Authentication -> LDAP

Go to LDAP Realms

Click on New

Choose a name like “LDAP_realm”.

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



For Primary server host: enter the name of your LDAP server.

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



Go to LDAP DN tab

Click on New

In Add Base DNs: type in something like: dc=etesting,dc=lab

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



Click on LDAP Search & Groups

Enter search user DN and password

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



10.7 Creating Policy

Go to the Management Console -> Configuration -> Policy -> Visual Policy Manager

Click on Launch

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



10.7.1 Configuring the Forwarding Layer

In the Forwarding Layer, one rule per kind of flow is created. It describes the action to be done bythe Reverse Proxy.

Policy>add forwarding layer:

Go to Forwarding Layer tab and create 2 forwarding rules:

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



10.7.1.1 Rule1: Forward to OT_443

Click on “Add rule”

Right-click on “Destination “

Select “Set”

Then “New” then select “server URL”

Name: OT_443

Check “Advanced Match”

Scheme: HTTPS

Host: enter the OT FQDN

Port: 443

Click on “OK”

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



Right-click on “Action”

Select “New “

Select Forwarding

Name: Forwarding_OT_443

Check “Forward To:”

And choose OT_443

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



10.7.1.2 Rule2: Forward to OT_8016

Click on “Add rule”

Right-click on “Destination “

Select “Set”

Then “New” then select “server URL”

Name: OT_8016

Check “Advanced Match”

Scheme: HTTPS

Host: enter the OT FQDN

Port: 8016

Click on “OK”

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



Right-click on “Action”

Select “New “

Select Forwarding

Name: Forwarding_OT_8016

Check “Forward To:”

And choose OT_443

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



10.7.2 Configuring a ‘Web Authentication Layer’ for client authentication by login-password with LDAP directory

Click on “Policy” in tool bar, right click on “Add Web Authentication Layer …” --> a new Tab isadded

Name it adequately e.g. “Authenticate_LDAP”

While still selected, Click on “Add rule”

Right-click in “Action” row, “Set…”

“New” , “Authenticate” object

For Realm: select ‘LDAP_realm”

For Mode: select “Origin Cookie” (mandatory for a use with MyIC PC)

Select “OK”

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



10.7.3 Configuring the Web Access Layer

Click on “Policy” in tool bar, right click on “Add SSL Access Layer …” --> a new Tab is added

Go to the SSL Access Layer tab

Click on “Add Rule”

Right-click on Destination.

Add all servers in a combined object

Click on OK.

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



10.7.4 Installing the Policy

Once the configuration is done, you must click on Install Policy

All the policies are installed at the same time.

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



11 Appendix C: Alcatel-Lucent CommunicationPlatform: configuration requirements

11.1 OT reverse proxy configuration

Declare the reverse proxy and the mapping between public and private URLs of servers.Select System services > Topology > Reverse proxy

OT is listening on 2 ports:- 443 for web services- 8016 for event management

• API: enter the public FQDN of the OpenTouch server• EVS: enter the public FQDN of the OpenTouch server followed by the 8016 port Number• ACS:

• If there is no OTES (OpenTouch Edge Server), enter the public FQDN of the OpenTouchserver• If there is an OTES, enter the Cluster Name/FQDN

• DMS (Device Management): enter the public FQDN of the OpenTouch server

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



11.2 OT SBC configuration

A SBC is needed for SIP signaling and audio management.

SBC declaration on user side (myic pc sip device) :

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



11.3 MyIC PC SIP client configuration

During the installation process, modify Reverse proxy entry with public URL of your reverse proxy.

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



Create a new profile “remote_worker”:

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



12 Appendix D: AAPP member’s escalationprocess

The URL to contact the Customer Service&Support is:http://www.bluecoat.com/support/contactsupport

How to Contact Customer Service&Support:

Americas Europe, Middle East, Africa Asia Pacific, Australia, NZ

OnlineSupport

BlueTouch Online: https://bto.bluecoat.com

TelephoneSupport

+1 408 220 2200, option #3+1 866 362 2628, option #1

+44 (0)1252 554 700 +6 03-2687-7501Japan: +81 335808390

Duty Manager Worldwide: +1 408-541-3700 (case escalation ) CustomerCare

[email protected] (BlueTouch Online account login, licensing, entitlement )

6:00AM – 5:00PM PST 8:00AM – 4:00PM GMT+1 8x5, Business Days +1 408 220 2200, option #2 +44 (0)1252 554 604 n/a +1 888-946 7769, option #2 n/a n/a

ProfessionalServices

+1 408 220-2200, option #1 [email protected]

+1 408 220-2200, option

TrainingServices

Contact Blue Coat Sales or Telephone: +1 408-220-2200, option #1

PurchaseSupport

Contact Blue Coat Sales (http://www.bluecoat.com/salesrep/search)Blue coat online Registration or contact Authorized Training Centers

RenewSupport

[email protected]@bluecoat.com

[email protected] [email protected]

K9 WebProtection

K9 Online Support or K9 Online Instant Support (Online 24x7)

http://www.bluecoat.com/support/contactsupport

https://bto.bluecoat.com/


http://www.bluecoat.com/support/supportpolicies/casehandling



http://www.bluecoat.com/salesrep/search


http://www.bluecoat.com/support/training/courseorder

http://www.bluecoat.com/support/training/atl



http://www.bluecoat.com/products/k9web

http://www.nohold.net/noHoldCust31/Prod_7/knowledgeportal/kpscripts/frames.asp?login=1



http://www.bluecoat.com/products/k9web


http://www.bluecoat.com/support/training/courseorder





http://www.bluecoat.com/support/contactsupport

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



13 Appendix E: AAPP program

13.1 Alcatel-Lucent Application Partner Program (AAPP)

The Application Partner Program is designed to support companies that develop communication

applications for the enterprise market, based on Alcatel-Lucent's product family.

The program provides tools and support for developing, verifying and promoting compliant third-

party applications that complement Alcatel-Lucent's product family. Alcatel-Lucent facilitates market

access for compliant applications.

The Alcatel-Lucent Application Partner Program (AAPP) has two main objectives:

Provide easy interfacing for Alcatel-Lucent communication products: Alcatel-Lucent's communication products for the enterprise market include infrastructureelements, platforms and software suites. To ensure easy integration, the AAPP provides a

full array of standards-based application programming interfaces and fully-documentedproprietary interfaces. Together, these enable third-party applications to benefit fully fromthe potential of Alcatel-Lucent products.

Test and verify a comprehensive range of third-party applications:to ensure proper inter-working, Alcatel-Lucent tests and verifies selected third-partyapplications that complement its portfolio. Successful candidates, which are labelled Alcatel-Lucent Compliant Application, come from every area of voice and data communications.

The Alcatel-Lucent Application Partner Program covers a wide array of third-partyapplications/products designed for voice-centric and data-centric networks in the enterprise market,

including terminals, communication applications, mobility, management, security, etc.

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



Web site

The Application Partner Portal is a website dedicated to the AAPP program and where theInterWorking Reports can be consulted. Its access is free athttp://applicationpartner.alcatel-lucent.com

13.2 Alcatel-Lucent.com You can access the Alcatel-Lucent website at this URL: http://www.Alcatel-Lucent.com/

http://applicationpartner.alcatel-lucent.com/


http://www.alcatel.com/





7/25/2019 Bc Proxyswg 6.5.1.1 Ot



14 Appendix F: AAPP Escalation process

14.1 Introduction

The purpose of this appendix is to define the escalation process to be applied by the Alcatel-LucentBusiness Partners when facing a problem with the solution certified in this document.

The principle is that Alcatel-Lucent Technical Support will be subject to the existence of a validInterWorking Report within the limits defined in the chapter “Limits of the Technical support”.

In case technical support is granted, Alcatel-Lucent and the Application Partner, are engaged asfollowing:

(*) The Application Partner Business Partner can be a Third-Party company or the Alcatel-Lucent Business Partner itself

7/25/2019 Bc Proxyswg 6.5.1.1 Ot



14.2 Escalation in case of a valid Inter-Working Report

The InterWorking Report describes the test cases which have been performed, the conditions of thetesting and the observed limitations.

This defines the scope of what has been certified.

If the issue is in the scope of the IWR, both parties, Alcatel-Lucent and the Application Partner, areengaged:

Case 1: the responsibility can be established 100% on Alcatel-Lucent side.In that case, the problem must be escalated by the ALU Business Partner to the Alcatel-Lucent Support Center using the standard process: open a ticket (eService Request –eSR)

Case 2: the responsibility can be established 100% on Application Partner side.In that case, the problem must be escalated directly to the Application Partner by opening a

ticket through the Partner Hotline. In general, the process to be applied for the ApplicationPartner is described in the IWR.

Case 3: the responsibility can not be established.In that case the following process applies:

The Application Partner shall be contacted first by the Business Partner (responsible forthe application, see figure in previous page) for an analysis of the problem.

The Alcatel-Lucent Business Partner will escalate the problem to the Alcatel-LucentSupport Center only if the Application Partner has demonstrated with traces a problemon the Alcatel-Lucent side or if the Application Partner (not the Business Partner) needs

the involvement of Alcatel-Lucent.

In that case , the Alcatel-Lucent Business Partner must provide the reference of the CaseNumber on the Application Partner side. The Application Partner must provide to Alcatel-Lucent the results of its investigations, traces, etc, related to this Case Number.

Alcatel-Lucent reserves the right to close the case opened on his side if the investigationsmade on the Application Partner side are insufficient or do no exist.

Note: Known problems or remarks mentioned in the IWR will not be taken into account.

For any issue reported by a Business Partner outside the scope of the IWR, Alcatel-Lucent offers

the “On Demand Diagnostic” service where Alcatel-Lucent will provide 8 hours assistance againstpayment.

IMPORTANT NOTE 1: The possibility to configure the Alcatel-Lucent PBX with ACTIS quotationtool in order to interwork with an external application is not the guarantee of the availability andthe support of the solution. The reference remains the existence of a valid InterWorking Report.

Please check the availability of the Inter-Working Report on the AAPP (URL:https://private.applicationpartner.alcatel-lucent.com) or Enterprise Business Portal (Url: EnterpriseBusiness Portal) web sites.

IMPORTANT NOTE 2: Involvement of the Alcatel-Lucent Business Partner is mandatory, theaccess to the Alcatel-Lucent platform (remote access, login/password) being the Business Partner

responsibility.

https://private.applicationpartner.alcatel-lucent.com/


https://businessportal.alcatel-lucent.com/alugesdp/faces/gesdp/products/Listing.jspx?DOCTYPE=Technical_Documentation/Interworking_Reports&RESULTSBYPAGE=25&BOXES=partner,product&OPENFOLDER=doctype.Interworking_Reports&_afPfm=2







7/25/2019 Bc Proxyswg 6.5.1.1 Ot



14.3 Escalation in all other cases

These cases can cover following situations:

1. An InterWorking Report exist but is not valid (see Chapter 2 “Validity of an Interworking

Report”)

2. The 3rd party company is referenced as AAPP participant but there is no officialInterWorking Report (no IWR published on the Enterprise Business Portal for BusinessPartners or on the Alcatel-Lucent Application Partner web site) ,

3. The 3rd party company is NOT referenced as AAPP participant

In all these cases, Alcatel-Lucent offers the “On Demand Diagnostic” service where Alcatel-Lucentwill provide 8 hours assistance against payment.

7/25/2019 Bc Proxyswg 6.5.1.1 Ot


14.4 Technical Support accessThe Alcatel-Lucent Support Center is open 24 hours a day; 7 days a week:

e-Support from the Application Partner Web site (if registered Alcatel-Lucent ApplicationPartner): http://applicationpartner.alcatel-lucent.com

e-Support from the Alcatel-Lucent Business Partners Web site (if registered Alcatel-LucentBusiness Partners): https://businessportal.alcatel-lucent.com click under “Let us help you”the eService Request link

e-mail: [email protected] Fax number: +33(0)3 69 20 85 85 Telephone numbers:

Alcatel-Lucent Business Partners Support Center for countries:

Country Supported language Toll free number

France

French

+800-00200100

Belgium

LuxembourgGermany

German Austria

Switzerland

United Kingdom

English

Italy

Australia

Denmark

Ireland

Netherlands

South Africa

Norway

Poland

Sweden

Czech Republic

Estonia

Finland

GreeceSlovakia

Portugal

Spain Spanish

For other countries:













Bc Proxyswg 6.5.1.1 Ot

Documents

Transcript of Bc Proxyswg 6.5.1.1 Ot