The Dual Network Interfaces option enables the LAN 2 interface on your VCS Expressway (the
option is not available on a VCS Control). The LAN 2 interface is used in situations where your
VCS Expressway is located in a DMZ that consists of two separate networks - an inner DMZ and an
outer DMZ - and your firewall rules prevent communication between the two.
With the LAN 2 interface enabled, you can configure the VCS with two separate IP addresses, one
for each network in the DMZ. Your VCS then acts as a proxy server between the two networks,
allowing calls to pass between the internal and outer firewalls that make up your DMZ.

All ports configured on the VCS, including those relating to firewall traversal, will apply to
both IP addresses; it is not possible to configure these ports separately for each IP
address.

Firewall Traversal and Dual Network Interfaces

We recommend that you turn off any H.323 and SIP protocol support on the firewall: these
are not needed in conjunction with the TANDBERG Expressway™ solution and may interfere
with its operation.

In order for Expressway™ firewall traversal to function correctly, the firewall must be configured to:

allow initial outbound traffic from the client to the ports being used by the VCS Expressway

•

allow return traffic from those ports on the VCS Expressway back to the originating client.

•

TANDBERG offers a downloadable tool, the Expressway Port Tester, that allows you to test your
firewall configuration for compatibility issues with your network and endpoints. It will advise if
necessary which ports may need to be opened on your firewall in order for the Expressway™
solution to function correctly. The Expressway Port Tester currently only supports H.323. Contact
your TANDBERG representative for more information.

Firewall Configuration