Creating reverse proxy service for multi-tenant or IP Office powered deployments

Last Updated : Apr 26, 2023 |

About this task

You can configure multiple tenants using the same listen IP and different listen domain for the each tenant.

Before you begin

Create TLS server profiles for all the tenants.

Procedure

  1. Log in to the EMS web interface with administrator credentials.
  2. From the Device menu, click the SBC name to administer.
  3. In the navigation pane, click DMZ Services > Relay.

    The EMS server displays the Relay Services page.

  4. In the Reverse Proxy tab, click Add.
  5. On the Add Reverse Proxy Profile page, administer the following options using Relay Services field descriptions for reference:
    1. In the Service Name field, type the reverse proxy profile name.
    2. Select the Enabled check box.
    3. In the Listen IP field, select the external SBC IP address.

      The IP address must be different from the IP address used for SIP signaling and media interfaces.

    4. In the Listen Protocol field, click the protocol published towards remote workers for configuring the multi tenant.

      If you select the HTTPS protocol, the system enables the Listen TLS Profile field.

    5. In the Listen TLS Profile field, click the TLS profile that you created.

      The default TLS profiles such as AvayaSBCServer have demonstration certificates. For optimum security, Avaya recommends that you do not use demonstration certificates.

    6. In the Listen Port field, type the port for remote workers.

      For HTTPS, the default value is 443. For HTTP, the default value is 80.

    7. In the Server Protocol field, click the protocol used for the Avaya SBC server.

      For security reasons, Avaya recommends the use of HTTPS. If you select the HTTPS protocol, the system enables the Server TLS Profile field.

    8. In the Server TLS Profile field, click the TLS profile that you have created for all the tenants and associate the TLS server profile with the reverse proxy profile.

      The SNI Options field for the TLS server profiles must be None. The number of TLS server profiles configured must be same as the number of tenants.

  6. Optional Create an SNI Group with all tenant’s TLS server profiles except tenant one TLS server profile.
  7. Create TLS server profile using tenant one certificate with SNI options as OPTIONAL or MANDATORY. Associate the tenant one TLS server profile with the SNI group created in the previous step and with the signaling interface.
  8. To enable rewriting URL for the Converged Conference feature, do the following:
    1. To redirect the URL to a different URL, select the Rewrite URL field.
    2. In the Received Server Host field, select the SAN or CN field of the certificate associated with the TLS server profile.
      Note:

      For any mismatched or non-SNI request with Reverse Proxy Profile configured, Avaya SBC and Avaya Workplace Client works as follows:

      • Without Any option in Received server host: Avaya SBC serves the first server configured with the received server host, with TLS server profile configured with SNI Options as Optional or Mandatory.

      • With Any option in Received server host: Avaya SBC serves the server TLS profile certificate configured with the received server host, with TLS server profile configured with SNI Options as Optional or Mandatory.

    3. In the URL Replace field, type the URL that the system must use to replace the current URL.
  9. Click Finish.
Related information
Creating a reverse proxy policy