Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

Bronze

Federation and security / DMZ

Hi,

Design question;

Suppose a customer has a security policy to never expose an internal server directly to the internet and require all traffic to pass through a device/proxy/.... in the DMZ. How would this translate to CUPS/Jabber with XMPP federation?

The design guides only suggest NAT'ing the CUPS server XMPP port to the Internet . This violates the customers policy. I personally think the customer follows good security practice with his policy.

Regards,

Erik

Sent from Cisco Technical Support iPad App

4 REPLIES
New Member

Federation and security / DMZ

Are there any design guides out there for this?  I found a list of ports that the presence server uses:

http://www.cisco.com/en/US/docs/voice_ip_comm/cups/8_0/english/port/cupsportusage.html#wp40778

That list sould help, however I would prefer to see someone that has gotten this to work by possibly installing a CUP server in the DMZ and another CUP server in the Internal network so the DMZ server acts as a gateway/router...  However if it needs the same insternal access to the Active Directory server, CUCM server, clients, it wouldn't seem to gain very much.

-Todd

New Member

Federation and security / DMZ

Hello All,

has anyone been able to manage a federation with external comanies / offers ?

What about the DMZ question ?

The guides in this part are not very clear.

And it somehow seems in opposition with other guidelines in security topics.

Regards

Hi ErikDid you ever solve

Hi Erik

Did you ever solve this problem?

Cheers

Martin

Bronze

Hi Martin,I managed to get

Hi Martin,

I managed to get the federation working, but not via a DMZ. Static NAT translations on the outside firewall to the Presence server(s).

Rumors exist that state the next or a next Expressway solution will solve this in the future. Currently nothing can be done, unfortunately.

Regards,

Erik

675
Views
5
Helpful
4
Replies