Page History

...

Each company has its IT rules and more than often a proper IT staff to apply them. Thus what we are going to suggest to you is not a specific configuration which should lead because you have to adapt it to your own business needs, understanding the basic rules it has been build on. It's more a sort of Rule of Thumb about how we suggest to organise data transport separation.

Basically we'll suggest you to split the services, binding them on multiple interfaces. We found that is far more easy to manage 2 interfaces instead of 3 or 4 of them, still (as said before) this is a matter of your company's network design.

...

1. Use two networks interfaces at least and set them up as: 
   1. Internal Interface: private IP, not directly accessible from the extern of the company
   2. External Interface: public IP, directly accessible from anyone
2. Services should always be split in two categories:
   1. management
   2. service provider
3.  Each category should be mapped on a different interface:
   1. management on the Internal Interface
   2. service provider on the External Interface
4. One amend to rule number 3 is if your company wants to offer the secure voice system to the internal network as well (or to some part of it)
5. Both SIP/TLS and HTTPS-Smartphone Web Services are necessary to run the service on mobile devices
6. public access is needed for  with Data packages are involved
7. No point in having Nagios service on the public interface
8. Disable SSH access as soon as you can or keep it as the last resort: you might want to place it on an hidden network or protect it by a firewall rule

2.9.3

...

scenario 1: for internal use only

scenario 2: internal and external use

scenario 3: internal and external with connection to the company's PBX

Usually an issue related to the network displace of one PrivateServer depends on its feature to join a public access data channel with an internal/private communication/data channel. E.G: each mobile device connected to the PrivateServer via PrivateGSM has to be allowed to use an Internet Data Connection in order to work, but on the other end the PrivateServer could be connected to the internal Corporate PBX via SIP Trunk. The issue arises when the network in which the corporate PBX is placed has no external access. In this scenario the PrivateServer needs a bridge or can act like one, joining two network that should not communicate.

perform private and secure calls sdgsdghsg.

2.9.4 Actual implementations

 without considering the huge differences between each and every network. Nevertheless we have a standard network configuration for the PrivateServer that we think can suite most of the Secure Voice Service Administrator who are dealing with PrivateServer and PrivateGSM.

Possible implementations

Our standard proposal is to split the VoIP service and the Administration service having the former to respond on the first interface, directly connected to the Internet via public IP address or just NATted from a public one. The latter would respond on the second NIC, an internal interface with a private IP address assigned on it. 

So that's a simple schema exemplifying the core of this subject:

...