Users Guide

The Web lync listening port is automatically permitted by the firewall. The user does not have to explicitly define a
firewall policy to permit this port.
3. Click Apply.
Using the CLI
Use the following command:
(host) (config) #web-server profile
Listen Lync XML messages on HTTP:
(host) (Web Server Configuration) #web-lync-listen-port http <listen-port>
Or
Listen Lync XML messages on HTTPS:
Before configuring the controller to receive Lync SDN API messages using HTTPS, a server certificate must be
generated and installed on the controller. Server certificate can be generated either by the controller or Certificate
Authority (CA). For more information, see Obtaining a Server Certificate on page 879.
(host) (Web Server Configuration) #web-lync-listen-port https <listen-port>
To verify if the port is automatically permitted by the firewall, use the following command:
(host) #show firewall-cp
Configuring Lync ALG Status
Configure the controller to read Secure SIP signaling messages sent by the Lync clients on port 5061. You can
enable or disable Stateful SIPS processing using the following CLI commands. This is enabled by default.
Before you configure Lync ALG status, disable classify-media. To disable classify-media, see Disable Media
Classification on page 990.
Enabling Lync ALG
(host) (config) #no firewall disable-stateful-sips-processing
Disabling Lync ALG
(host) (config) #firewall disable-stateful-sips-processing
Dynamically Open Firewall for UCC Clients using STUN
Prior to ArubaOS 6.4, the administrator explicitly added ACLs in the user role to allow Lync traffic on the
controller. Starting from ArubaOS 6.4, the controller automatically allows firewall sessions for Lync voice and
video calls. Firewall sessions for Lync desktop-sharing and file-transfer are not allowed. The administrator
should manually open a range of TCP ports under the user role to allow Lync desktop-sharing and file-transfer
traffic.To allow a specific range of ports in the user role, refer the Microsoft Technet article which describes the
port ranges used by Lync clients and servers.
Before media transmission, a Lync client initiates a Session Traversal Utilities for NAT (STUN) connectivity
check. Sessions created by STUN are subjected to media classification that classifies the media as Real-time
Transport Protocol (RTP) or non-RTP. The firewall automatically allows the RTP session on the controller and
denies the non-RTP sessions. For the controller to accept STUN messages, you must allow ICE-STUN based
firewall traversal on the controller and allow UDP 3478 and TCP 443 ports in the user role.
Allowing ICE-STUN
To allow ICE-STUN based firewall traversal, issue the following CLI command:
(host) (config) #firewall allow-stun
Dell Networking W-Series ArubaOS 6.4.x | User Guide Voice and Video |
987