MiCollab - Server Gateway mode with 1:1 NAT - Possible?

[sarond]

Hi All,

Has anyone ever had a MiCollab Server in Server-Gateway mode using 1:1 NAT for the WAN connection?

We have a client that purchased MiVBX with standard UCC licensing. Initially there was no need for remote services like Teleworking and MiCollab mobile client.
Now that they have seen and used some of the features like AWC via VPN they are keen to start using it for clients.

They have applied for additional public IP addresses and now have them.
The way it has been setup is as a 1:1 NAT so public IP is not directly attached to the MiVBX.
They also want to restrict the ports to the server so I assume I can get those from the Engineering Guidelines.

Is it possible to use a custom network profile in the MBG to have this work?
Should I just get sales to sell them a separate MBG in DMZ? (I'd like to avoid this if possible)

Also with AWC what is the second ip address for? How is it use

I don't deal with the apps very often so you might have to talk slow

Regards,

[johnp]

I haven't done it, but custom mode should allow the external address to be sent to the remote. I would agree that a MBG in DMZ would be Mitel's recommendation and with them clustered you should be good. With AWV, you could likely have the firewall send the https connection on in to 4443

[eugenej]

My two cents:
The architecture you suggesting isn't supported but may work. Problem with NATting is that whatever is responsible for it, needs to have all the checks and balances to do with the voice bits the way Mitel needs it to be. Just check the engineering guide on MBG/MiCollab and you can see it's pretty intricate with all the ports and directions necessary.

My other 3 cents is that I would use a supported deployment architecture with MBG in DMZ only because support won't/can't respond with merely, "Sorry not supported"

[sarond]

Thanks for the replies,

This is working with 1:1 NAT with custom profile, I understand it is not really a supported config but if it causes problems I will be recommending a separate MBG.
I have all the ports configured from the MBG EGL and it has all worked.

I even have the AWC working on a single IP address. I have just changed the port on the AWC settings to 4443 for external the same as it is internal.
It just means that the public need to be able to connect on port 4443 and that will depend on how strict their firewall environment is.

Even WebRTC is working