From 2052b47f155c3246083488149998527e85b37c9f Mon Sep 17 00:00:00 2001 From: Simon Thorpe Date: Thu, 24 Oct 2024 18:02:24 -0700 Subject: [PATCH 01/16] Initial commit --- .../figure1.svg | 4 + .../figure2.svg | 3 + .../figure3.svg | 4 + .../figure4.svg | 4 + ...-hosted-VoIP-services-for-hybrid-users.mdx | 85 +++++++++++++++++++ 5 files changed, 100 insertions(+) create mode 100644 src/assets/images/reference-architecture/deploying-self-hosted-voip-services-for-hybrid-users/figure1.svg create mode 100644 src/assets/images/reference-architecture/deploying-self-hosted-voip-services-for-hybrid-users/figure2.svg create mode 100644 src/assets/images/reference-architecture/deploying-self-hosted-voip-services-for-hybrid-users/figure3.svg create mode 100644 src/assets/images/reference-architecture/deploying-self-hosted-voip-services-for-hybrid-users/figure4.svg create mode 100644 src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx diff --git a/src/assets/images/reference-architecture/deploying-self-hosted-voip-services-for-hybrid-users/figure1.svg b/src/assets/images/reference-architecture/deploying-self-hosted-voip-services-for-hybrid-users/figure1.svg new file mode 100644 index 000000000000000..627476d0481345b --- /dev/null +++ b/src/assets/images/reference-architecture/deploying-self-hosted-voip-services-for-hybrid-users/figure1.svg @@ -0,0 +1,4 @@ + + + + diff --git a/src/assets/images/reference-architecture/deploying-self-hosted-voip-services-for-hybrid-users/figure2.svg b/src/assets/images/reference-architecture/deploying-self-hosted-voip-services-for-hybrid-users/figure2.svg new file mode 100644 index 000000000000000..28e897e8fcd3f1a --- /dev/null +++ b/src/assets/images/reference-architecture/deploying-self-hosted-voip-services-for-hybrid-users/figure2.svg @@ -0,0 +1,3 @@ + + + diff --git a/src/assets/images/reference-architecture/deploying-self-hosted-voip-services-for-hybrid-users/figure3.svg b/src/assets/images/reference-architecture/deploying-self-hosted-voip-services-for-hybrid-users/figure3.svg new file mode 100644 index 000000000000000..9b039236e302454 --- /dev/null +++ b/src/assets/images/reference-architecture/deploying-self-hosted-voip-services-for-hybrid-users/figure3.svg @@ -0,0 +1,4 @@ + + + + diff --git a/src/assets/images/reference-architecture/deploying-self-hosted-voip-services-for-hybrid-users/figure4.svg b/src/assets/images/reference-architecture/deploying-self-hosted-voip-services-for-hybrid-users/figure4.svg new file mode 100644 index 000000000000000..9b039236e302454 --- /dev/null +++ b/src/assets/images/reference-architecture/deploying-self-hosted-voip-services-for-hybrid-users/figure4.svg @@ -0,0 +1,4 @@ + + + + diff --git a/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx b/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx new file mode 100644 index 000000000000000..33c0ab70b1a72eb --- /dev/null +++ b/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx @@ -0,0 +1,85 @@ +--- +title: Deploying self hosted VoIP services for hybrid users +pcx_content_type: reference-architecture-diagram +products: + - Access + - Gateway +sidebar: + order: 1 + label: Self hosted VoIP for hybrid users +updated: 2024-10-24 +--- + +## Introduction + +Traditional VPN solutions create several problems for VoIP deployments, primarily due to their inefficiencies in handling real-time traffic protocols such as [SIP](https://en.wikipedia.org/wiki/Session_Initiation_Protocol) and [RTP](https://en.wikipedia.org/wiki/Real-time_Transport_Protocol). Legacy VPN deployments introduce high latency and jitter, which negatively impact voice call quality. Additionally, they often struggle with [NAT](https://en.wikipedia.org/wiki/Network_address_translation) traversal, leading to connection issues for VoIP calls. + +Cloudflare improves over traditional VPN solutions by leveraging its [global network](https://www.cloudflare.com/network/) of data centers in over 300 cities to significantly reduce latency for remote users. When using our device agent, remote users are automatically connected to the nearest Cloudflare data center, thus reducing latency. Additionally, the WARP Connector ensures secure, bidirectional communication between remote users and the on-premise SIP server, without exposing the server to the public Internet. This shields the VoIP infrastructure from potential attacks while maintaining a seamless, encrypted connection for real-time communications. + +This document explains how Cloudflare can be architected with a self-hosted VoIP service. Note the solution below uses our [WARP Connector](/cloudflare-one/connections/connect-networks/private-net/warp-connector/), a small piece of software deployed on a server in the same subnet as the VoIP servers and creates bi-directional traffic flow through Cloudflare to users. + +## Bi-directional VoIP traffic flow + +![Figure 1: Cloudflare facilitates secure connectivity from user devices to the network where the SIP server is running.](~/assets/images/reference-architecture/deploying-self-hosted-voip-services-for-hybrid-users/figure1.svg "Figure 1: Cloudflare facilitates secure connectivity from user devices to the network where the SIP server is running.") + +The diagram above shows the WARP Connector and our device agent deployed to create a highly performant, reliable connectivity for private VoIP services. Note that Cloudflare will assign remote users an address from the [CGNAT range](/cloudflare-one/connections/connect-networks/private-net/warp-to-warp/), which is used for the Cloudflare created private network. + +1. VoIP server resides on a private network with no public IP. +2. WARP Connector creates a secure tunnel to Cloudflare, and is configured as a virtual router in the private network. +3. Allow any Cloudflare sourced traffic to reach the VoIP server, but also allow any private network initiated traffic, such as an outbound VoIP call from the server to also route over the Cloudflare tunnel. In the above diagram, we just add a static route on the default gateway of 100.96.0.0/12 (the WARP CGNAT range) via 10.0.50.10 (the WARP Connector virtual router) +4. Traffic passes through our [secure web gateway](/cloudflare-one/policies/gateway/) (SWG), which applies network level firewall rules to both inbound and outbound traffic. +5. Device agent's installed on remote user devices connect them to Cloudflare via secure tunnels, which then allow VoIP software to both receive and make calls. + +## Call flow examples + +VoIP software running on the remote user's device registers with the VoIP server using SIP. The Cloudflare device agent will be assigned an address from the CGNAT IP range, 100.96.0.0/12. As routing has been established to Cloudflare for 100.96.0.0/12 and to the on-prem network of 10.0.50.0/24, call flows will work as normal – both direct and indirect media are supported. + +### Remote user calling another remote user + +When calls are made from user to user, some traffic flows from user devices, through Cloudflare to the on-premises server, and some traffic flows through Cloudflare directly to the other user. Note the user agent is creating a secure tunnel through which the CGNAT addresses are routed. Both users in this flow have registered their SIP clients with the server. + +![Figure 2: For remote user to remote user, not all traffic flows over the WARP Connector to the SIP server.](~/assets/images/reference-architecture/deploying-self-hosted-voip-services-for-hybrid-users/figure2.svg "Figure 2: For remote user to remote user, not all traffic flows over the WARP Connector to the SIP server.") + +The above diagram shows the high level signaling and media paths. + +1. Alice registers directly with the SIP server (10.0.50.60) with her Cloudflare assigned CGNAT IP of 100.96.0.12 +2. Bob (also registers directly with the SIP server (10.0.50.60) with his CGNAT IP of 100.96.0.13 +3. When Alice calls Bob, the SIP server will send a SIP INVITE message to Bob at 100.96.0.13 +4. The default gateway for the SIP server is 10.50.0.1, but we have defined a static route such that for destination 100.96.0.0/12, the next hop is the WARP Connector interface (10.0.50.10). +5. The SIP INVITE message will be routed across the WARP Connector to the Cloudflare network and then received by Bob. +6. Bob accepts and the SIP server will send SIP/SDP messages to both Alice and Bob specifying which parameters to use for the RTP (audio) data. +7. For Direct Media paths where the SIP server is not in the audio path and the RTP streams are directly between Alice and Bob, ensure that [WARP-to-WARP Connectivity](/cloudflare-one/connections/connect-networks/private-net/warp-to-warp/#enable-warp-to-warp) has been enabled in Cloudflare. Audio streams in the Direct Media use case will not need to route over the WARP Connector. + +### Remote user to on-premises user + +Calls between remote and on-premise users are very similar, but RTP audio will be sent over the WARP Connector in addition to the SIP signaling. + +![Figure 3: Remote user to on-premises user has all traffic routed via Cloudflare to SIP server and client.](~/assets/images/reference-architecture/deploying-self-hosted-voip-services-for-hybrid-users/figure3.svg "Figure 3: Remote user to on-premises user has all traffic routed via Cloudflare to SIP server and client.") + +The high-level signaling and media paths are shown below: + +![Figure 4: Both signaling and media (audio, video etc) travel via secured tunnels from remote devices to on-premises clients.](~/assets/images/reference-architecture/deploying-self-hosted-voip-services-for-hybrid-users/figure4.svg "Figure 4: Both signaling and media (audio, video etc) travel via secured tunnels from remote devices to on-premises clients.") + +1. Alice registers directly with the SIP server (10.0.50.60) with her CGNAT IP of 100.96.0.12 +2. Bob (also registers directly with the SIP server (10.0.50.60) with his LAN IP of 10.0.50.101 +3. When Alice calls Bob, the SIP server will send a SIP INVITE message to Bob at 10.0.50.101 +4. The default gateway for the SIP server is 10.50.0.1, but we have defined a static route such that for destination 100.96.0.0/12, the next hop is the WARP Connector interface (10.0.50.10). +5. The SIP INVITE message will be sent on the local network to Bob. +6. Bob accepts and the SIP server will send SIP/SDP messages to both Alice and Bob specifying which parameters to use for the RTP (audio) data. +7. Bob will send audio to Alice at 100.96.0.12, which will be routed across the WARP Connector to Cloudflare, and Alice will send audio to Bob at 10.0.50.101, which will be sent from Cloudflare across the WARP Connector to the on-premise local network. + +## Summary + +Remote users communicating with other remote users or on-premise users via on-premise SIP servers using Cloudflare's WARP Connector, will have a seamless and secure experience for both ends, with key benefits: + +1. **Bidirectional Connectivity**: WARP Connector supports bidirectional traffic, which is crucial for remote users communicating with on-prem users. Both signaling and media traffic (SIP/RTP) flow securely between the two, regardless of where the user is physically located. This is done via Cloudflare's global network, using a WireGuard-encrypted tunnel, ensuring data integrity and encryption​. + +2. **Private Communication Over CGNAT**: The WARP Connector assigns Carrier-Grade NAT (CGNAT) IPs to devices, which allows remote users to securely communicate with on-premise users over private networks. This ensures that communication remains isolated from the public Internet, enhancing security. The CGNAT functionality means that remote and on-premise users can communicate as though they are on the same network​. + +3. **No NAT Traversal Issues**: NAT traversal often poses a challenge in VoIP scenarios, but because WARP Connector preserves source IP addresses and handles bidirectional traffic without additional NAT boundaries, remote and on-prem users can communicate without issues typically caused by firewalls or NAT devices, improving the overall call setup and quality​ + +## Related resources + +- [Set up WARP Connector](/cloudflare-one/connections/connect-networks/private-net/warp-connector/) +- [Enable WARP-to-WARP Connectivity](/cloudflare-one/connections/connect-networks/private-net/warp-to-warp/#enable-warp-to-warp) +- [About Cloudflare WARP](/cloudflare-one/connections/connect-devices/warp/) From aac12804f364874a65a16b45c57f3a230ce3e77e Mon Sep 17 00:00:00 2001 From: Simon Thorpe Date: Mon, 28 Oct 2024 09:53:17 -0700 Subject: [PATCH 02/16] Updating images --- .../figure1.svg | 180 +++++++++++++++++- .../figure2.svg | 173 ++++++++++++++++- .../figure3.svg | 129 ++++++++++++- .../figure4.svg | 161 +++++++++++++++- 4 files changed, 632 insertions(+), 11 deletions(-) diff --git a/src/assets/images/reference-architecture/deploying-self-hosted-voip-services-for-hybrid-users/figure1.svg b/src/assets/images/reference-architecture/deploying-self-hosted-voip-services-for-hybrid-users/figure1.svg index 627476d0481345b..4cfffbb7aca078e 100644 --- a/src/assets/images/reference-architecture/deploying-self-hosted-voip-services-for-hybrid-users/figure1.svg +++ b/src/assets/images/reference-architecture/deploying-self-hosted-voip-services-for-hybrid-users/figure1.svg @@ -1,4 +1,178 @@ - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/src/assets/images/reference-architecture/deploying-self-hosted-voip-services-for-hybrid-users/figure2.svg b/src/assets/images/reference-architecture/deploying-self-hosted-voip-services-for-hybrid-users/figure2.svg index 28e897e8fcd3f1a..af3262537d1ec61 100644 --- a/src/assets/images/reference-architecture/deploying-self-hosted-voip-services-for-hybrid-users/figure2.svg +++ b/src/assets/images/reference-architecture/deploying-self-hosted-voip-services-for-hybrid-users/figure2.svg @@ -1,3 +1,172 @@ - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/src/assets/images/reference-architecture/deploying-self-hosted-voip-services-for-hybrid-users/figure3.svg b/src/assets/images/reference-architecture/deploying-self-hosted-voip-services-for-hybrid-users/figure3.svg index 9b039236e302454..b076bcd3f95b74f 100644 --- a/src/assets/images/reference-architecture/deploying-self-hosted-voip-services-for-hybrid-users/figure3.svg +++ b/src/assets/images/reference-architecture/deploying-self-hosted-voip-services-for-hybrid-users/figure3.svg @@ -1,4 +1,127 @@ - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - diff --git a/src/assets/images/reference-architecture/deploying-self-hosted-voip-services-for-hybrid-users/figure4.svg b/src/assets/images/reference-architecture/deploying-self-hosted-voip-services-for-hybrid-users/figure4.svg index 9b039236e302454..6887a0c7ff883db 100644 --- a/src/assets/images/reference-architecture/deploying-self-hosted-voip-services-for-hybrid-users/figure4.svg +++ b/src/assets/images/reference-architecture/deploying-self-hosted-voip-services-for-hybrid-users/figure4.svg @@ -1,4 +1,159 @@ - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - From db5383533fb145051a4f5934f06bfdeb3e60641a Mon Sep 17 00:00:00 2001 From: Simon Thorpe Date: Mon, 28 Oct 2024 10:02:22 -0700 Subject: [PATCH 03/16] Update src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx Co-authored-by: hyperlint-ai[bot] <154288675+hyperlint-ai[bot]@users.noreply.github.com> --- .../deploying-self-hosted-VoIP-services-for-hybrid-users.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx b/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx index 33c0ab70b1a72eb..95514bcbc8c9bab 100644 --- a/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx +++ b/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx @@ -43,7 +43,7 @@ When calls are made from user to user, some traffic flows from user devices, thr The above diagram shows the high level signaling and media paths. 1. Alice registers directly with the SIP server (10.0.50.60) with her Cloudflare assigned CGNAT IP of 100.96.0.12 -2. Bob (also registers directly with the SIP server (10.0.50.60) with his CGNAT IP of 100.96.0.13 +2. Bob (also registers directly with the SIP server (10.0.50.60) with their CGNAT IP of 100.96.0.13 3. When Alice calls Bob, the SIP server will send a SIP INVITE message to Bob at 100.96.0.13 4. The default gateway for the SIP server is 10.50.0.1, but we have defined a static route such that for destination 100.96.0.0/12, the next hop is the WARP Connector interface (10.0.50.10). 5. The SIP INVITE message will be routed across the WARP Connector to the Cloudflare network and then received by Bob. From 5611cad77a9ed5ca4cd0be4048e35fdd60cc5c87 Mon Sep 17 00:00:00 2001 From: Simon Thorpe Date: Mon, 28 Oct 2024 10:02:33 -0700 Subject: [PATCH 04/16] Update src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx Co-authored-by: hyperlint-ai[bot] <154288675+hyperlint-ai[bot]@users.noreply.github.com> --- .../deploying-self-hosted-VoIP-services-for-hybrid-users.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx b/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx index 95514bcbc8c9bab..6da39ec63bc8886 100644 --- a/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx +++ b/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx @@ -61,7 +61,7 @@ The high-level signaling and media paths are shown below: ![Figure 4: Both signaling and media (audio, video etc) travel via secured tunnels from remote devices to on-premises clients.](~/assets/images/reference-architecture/deploying-self-hosted-voip-services-for-hybrid-users/figure4.svg "Figure 4: Both signaling and media (audio, video etc) travel via secured tunnels from remote devices to on-premises clients.") 1. Alice registers directly with the SIP server (10.0.50.60) with her CGNAT IP of 100.96.0.12 -2. Bob (also registers directly with the SIP server (10.0.50.60) with his LAN IP of 10.0.50.101 +2. Bob (also registers directly with the SIP server (10.0.50.60) with their LAN IP of 10.0.50.101 3. When Alice calls Bob, the SIP server will send a SIP INVITE message to Bob at 10.0.50.101 4. The default gateway for the SIP server is 10.50.0.1, but we have defined a static route such that for destination 100.96.0.0/12, the next hop is the WARP Connector interface (10.0.50.10). 5. The SIP INVITE message will be sent on the local network to Bob. From 456fde677952a86b3eda5b7f1fcfcbaa01ada3ae Mon Sep 17 00:00:00 2001 From: Simon Thorpe Date: Wed, 30 Oct 2024 14:43:05 -0700 Subject: [PATCH 05/16] Update src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx Co-authored-by: ranbel <101146722+ranbel@users.noreply.github.com> --- .../deploying-self-hosted-VoIP-services-for-hybrid-users.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx b/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx index 6da39ec63bc8886..2d524d3f8300ffa 100644 --- a/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx +++ b/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx @@ -22,7 +22,7 @@ This document explains how Cloudflare can be architected with a self-hosted VoIP ![Figure 1: Cloudflare facilitates secure connectivity from user devices to the network where the SIP server is running.](~/assets/images/reference-architecture/deploying-self-hosted-voip-services-for-hybrid-users/figure1.svg "Figure 1: Cloudflare facilitates secure connectivity from user devices to the network where the SIP server is running.") -The diagram above shows the WARP Connector and our device agent deployed to create a highly performant, reliable connectivity for private VoIP services. Note that Cloudflare will assign remote users an address from the [CGNAT range](/cloudflare-one/connections/connect-networks/private-net/warp-to-warp/), which is used for the Cloudflare created private network. +The diagram above shows the WARP Connector and our device agent deployed to create a highly performant, reliable connectivity for private VoIP services. Note that Cloudflare will assign remote users an address from the CGNAT range, which is used for the private network created between device agents. 1. VoIP server resides on a private network with no public IP. 2. WARP Connector creates a secure tunnel to Cloudflare, and is configured as a virtual router in the private network. From 24784af26a62056dd02e05c2d3ee7d20b1bfbfb5 Mon Sep 17 00:00:00 2001 From: Simon Thorpe Date: Wed, 30 Oct 2024 14:43:18 -0700 Subject: [PATCH 06/16] Update src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx Co-authored-by: ranbel <101146722+ranbel@users.noreply.github.com> --- .../deploying-self-hosted-VoIP-services-for-hybrid-users.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx b/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx index 2d524d3f8300ffa..f2559590c1e2c94 100644 --- a/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx +++ b/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx @@ -25,7 +25,7 @@ This document explains how Cloudflare can be architected with a self-hosted VoIP The diagram above shows the WARP Connector and our device agent deployed to create a highly performant, reliable connectivity for private VoIP services. Note that Cloudflare will assign remote users an address from the CGNAT range, which is used for the private network created between device agents. 1. VoIP server resides on a private network with no public IP. -2. WARP Connector creates a secure tunnel to Cloudflare, and is configured as a virtual router in the private network. +2. WARP Connector creates a secure tunnel to Cloudflare and is configured as a virtual router in the private network. 3. Allow any Cloudflare sourced traffic to reach the VoIP server, but also allow any private network initiated traffic, such as an outbound VoIP call from the server to also route over the Cloudflare tunnel. In the above diagram, we just add a static route on the default gateway of 100.96.0.0/12 (the WARP CGNAT range) via 10.0.50.10 (the WARP Connector virtual router) 4. Traffic passes through our [secure web gateway](/cloudflare-one/policies/gateway/) (SWG), which applies network level firewall rules to both inbound and outbound traffic. 5. Device agent's installed on remote user devices connect them to Cloudflare via secure tunnels, which then allow VoIP software to both receive and make calls. From b31b1d495e043b8996876bad154919b1e068f9bb Mon Sep 17 00:00:00 2001 From: Simon Thorpe Date: Wed, 30 Oct 2024 14:44:03 -0700 Subject: [PATCH 07/16] Update src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx Co-authored-by: ranbel <101146722+ranbel@users.noreply.github.com> --- .../deploying-self-hosted-VoIP-services-for-hybrid-users.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx b/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx index f2559590c1e2c94..70fbd0f61db9b06 100644 --- a/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx +++ b/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx @@ -26,7 +26,7 @@ The diagram above shows the WARP Connector and our device agent deployed to crea 1. VoIP server resides on a private network with no public IP. 2. WARP Connector creates a secure tunnel to Cloudflare and is configured as a virtual router in the private network. -3. Allow any Cloudflare sourced traffic to reach the VoIP server, but also allow any private network initiated traffic, such as an outbound VoIP call from the server to also route over the Cloudflare tunnel. In the above diagram, we just add a static route on the default gateway of 100.96.0.0/12 (the WARP CGNAT range) via 10.0.50.10 (the WARP Connector virtual router) +3. Allow traffic from Cloudflare to reach the VoIP server, but also allow private network initiated traffic, such as an outbound VoIP call from the server, to route over the Cloudflare tunnel. In the above diagram, we add a static route on the default gateway of `100.96.0.0/12` (the WARP CGNAT range) via `10.0.50.10` (the WARP Connector virtual router). 4. Traffic passes through our [secure web gateway](/cloudflare-one/policies/gateway/) (SWG), which applies network level firewall rules to both inbound and outbound traffic. 5. Device agent's installed on remote user devices connect them to Cloudflare via secure tunnels, which then allow VoIP software to both receive and make calls. From 42d6d45cc220d36529307b9e964cb30a576108dc Mon Sep 17 00:00:00 2001 From: Simon Thorpe Date: Wed, 30 Oct 2024 14:44:12 -0700 Subject: [PATCH 08/16] Update src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx Co-authored-by: ranbel <101146722+ranbel@users.noreply.github.com> --- .../deploying-self-hosted-VoIP-services-for-hybrid-users.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx b/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx index 70fbd0f61db9b06..7fedbf52b1d64cc 100644 --- a/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx +++ b/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx @@ -27,7 +27,7 @@ The diagram above shows the WARP Connector and our device agent deployed to crea 1. VoIP server resides on a private network with no public IP. 2. WARP Connector creates a secure tunnel to Cloudflare and is configured as a virtual router in the private network. 3. Allow traffic from Cloudflare to reach the VoIP server, but also allow private network initiated traffic, such as an outbound VoIP call from the server, to route over the Cloudflare tunnel. In the above diagram, we add a static route on the default gateway of `100.96.0.0/12` (the WARP CGNAT range) via `10.0.50.10` (the WARP Connector virtual router). -4. Traffic passes through our [secure web gateway](/cloudflare-one/policies/gateway/) (SWG), which applies network level firewall rules to both inbound and outbound traffic. +4. Traffic passes through our [Secure Web Gateway](/cloudflare-one/policies/gateway/) (SWG), which applies network level firewall rules to both inbound and outbound traffic. 5. Device agent's installed on remote user devices connect them to Cloudflare via secure tunnels, which then allow VoIP software to both receive and make calls. ## Call flow examples From dd22e45a25d11fa4557483888546c62d8cfc3e03 Mon Sep 17 00:00:00 2001 From: Simon Thorpe Date: Wed, 30 Oct 2024 14:44:39 -0700 Subject: [PATCH 09/16] Update src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx Co-authored-by: ranbel <101146722+ranbel@users.noreply.github.com> --- .../deploying-self-hosted-VoIP-services-for-hybrid-users.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx b/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx index 7fedbf52b1d64cc..375cc7f39ddd95a 100644 --- a/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx +++ b/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx @@ -76,7 +76,7 @@ Remote users communicating with other remote users or on-premise users via on-pr 2. **Private Communication Over CGNAT**: The WARP Connector assigns Carrier-Grade NAT (CGNAT) IPs to devices, which allows remote users to securely communicate with on-premise users over private networks. This ensures that communication remains isolated from the public Internet, enhancing security. The CGNAT functionality means that remote and on-premise users can communicate as though they are on the same network​. -3. **No NAT Traversal Issues**: NAT traversal often poses a challenge in VoIP scenarios, but because WARP Connector preserves source IP addresses and handles bidirectional traffic without additional NAT boundaries, remote and on-prem users can communicate without issues typically caused by firewalls or NAT devices, improving the overall call setup and quality​ +3. **No NAT Traversal Issues**: NAT traversal often poses a challenge in VoIP scenarios, but because WARP Connector preserves source IP addresses and handles bidirectional traffic without additional NAT boundaries, remote and on-premise users can communicate without issues typically caused by firewalls or NAT devices, improving the overall call setup and quality​. ## Related resources From d37c206d836f5ea10bf092d65cd87153a5ae7b78 Mon Sep 17 00:00:00 2001 From: Simon Thorpe Date: Wed, 30 Oct 2024 14:44:46 -0700 Subject: [PATCH 10/16] Update src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx Co-authored-by: ranbel <101146722+ranbel@users.noreply.github.com> --- .../deploying-self-hosted-VoIP-services-for-hybrid-users.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx b/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx index 375cc7f39ddd95a..903eb20c4322361 100644 --- a/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx +++ b/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx @@ -81,5 +81,5 @@ Remote users communicating with other remote users or on-premise users via on-pr ## Related resources - [Set up WARP Connector](/cloudflare-one/connections/connect-networks/private-net/warp-connector/) -- [Enable WARP-to-WARP Connectivity](/cloudflare-one/connections/connect-networks/private-net/warp-to-warp/#enable-warp-to-warp) +- [Enable WARP-to-WARP connectivity](/cloudflare-one/connections/connect-networks/private-net/warp-to-warp/#enable-warp-to-warp) - [About Cloudflare WARP](/cloudflare-one/connections/connect-devices/warp/) From 1d3d878b792db06e0cd0d70d13496b7b7c505f81 Mon Sep 17 00:00:00 2001 From: Simon Thorpe Date: Wed, 30 Oct 2024 14:44:58 -0700 Subject: [PATCH 11/16] Update src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx Co-authored-by: ranbel <101146722+ranbel@users.noreply.github.com> --- .../deploying-self-hosted-VoIP-services-for-hybrid-users.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx b/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx index 903eb20c4322361..e2336c218efb9ab 100644 --- a/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx +++ b/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx @@ -1,5 +1,5 @@ --- -title: Deploying self hosted VoIP services for hybrid users +title: Deploy self-hosted VoIP services for hybrid users pcx_content_type: reference-architecture-diagram products: - Access From d7f3245ecfbf6be080ad0414fb08e0238cd5721b Mon Sep 17 00:00:00 2001 From: Simon Thorpe Date: Wed, 30 Oct 2024 14:45:10 -0700 Subject: [PATCH 12/16] Update src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx Co-authored-by: ranbel <101146722+ranbel@users.noreply.github.com> --- .../deploying-self-hosted-VoIP-services-for-hybrid-users.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx b/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx index e2336c218efb9ab..a581dd87a96b22c 100644 --- a/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx +++ b/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx @@ -6,7 +6,7 @@ products: - Gateway sidebar: order: 1 - label: Self hosted VoIP for hybrid users + label: Self-hosted VoIP for hybrid users updated: 2024-10-24 --- From eb81f92d82d8c576d894c95fe2371ef187217bc2 Mon Sep 17 00:00:00 2001 From: Simon Thorpe Date: Wed, 30 Oct 2024 14:47:25 -0700 Subject: [PATCH 13/16] Apply suggestions from code review Co-authored-by: ranbel <101146722+ranbel@users.noreply.github.com> --- ...-hosted-VoIP-services-for-hybrid-users.mdx | 32 +++++++++---------- 1 file changed, 16 insertions(+), 16 deletions(-) diff --git a/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx b/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx index a581dd87a96b22c..de11102a5f348ab 100644 --- a/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx +++ b/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx @@ -28,42 +28,42 @@ The diagram above shows the WARP Connector and our device agent deployed to crea 2. WARP Connector creates a secure tunnel to Cloudflare and is configured as a virtual router in the private network. 3. Allow traffic from Cloudflare to reach the VoIP server, but also allow private network initiated traffic, such as an outbound VoIP call from the server, to route over the Cloudflare tunnel. In the above diagram, we add a static route on the default gateway of `100.96.0.0/12` (the WARP CGNAT range) via `10.0.50.10` (the WARP Connector virtual router). 4. Traffic passes through our [Secure Web Gateway](/cloudflare-one/policies/gateway/) (SWG), which applies network level firewall rules to both inbound and outbound traffic. -5. Device agent's installed on remote user devices connect them to Cloudflare via secure tunnels, which then allow VoIP software to both receive and make calls. +5. A device agent is installed on remote user devices. The agent establishes a secure tunnel to Cloudflare, which allows VoIP software to both receive and make calls. ## Call flow examples -VoIP software running on the remote user's device registers with the VoIP server using SIP. The Cloudflare device agent will be assigned an address from the CGNAT IP range, 100.96.0.0/12. As routing has been established to Cloudflare for 100.96.0.0/12 and to the on-prem network of 10.0.50.0/24, call flows will work as normal – both direct and indirect media are supported. +VoIP software running on the remote user's device registers with the VoIP server using SIP. The Cloudflare device agent will be assigned an address from the CGNAT IP range, `100.96.0.0/12`. As routing has been established to Cloudflare for `100.96.0.0/12` and to the on-prem network of `10.0.50.0/24`, call flows will work as normal – both direct and indirect media are supported. ### Remote user calling another remote user -When calls are made from user to user, some traffic flows from user devices, through Cloudflare to the on-premises server, and some traffic flows through Cloudflare directly to the other user. Note the user agent is creating a secure tunnel through which the CGNAT addresses are routed. Both users in this flow have registered their SIP clients with the server. +When calls are made from user to user, some traffic flows from user devices through Cloudflare to the on-premises server, while other traffic flows through Cloudflare directly to the other user. Note that the device agent is creating a secure tunnel through which the CGNAT addresses are routed. Both users in this flow have registered their SIP clients with the server. ![Figure 2: For remote user to remote user, not all traffic flows over the WARP Connector to the SIP server.](~/assets/images/reference-architecture/deploying-self-hosted-voip-services-for-hybrid-users/figure2.svg "Figure 2: For remote user to remote user, not all traffic flows over the WARP Connector to the SIP server.") The above diagram shows the high level signaling and media paths. -1. Alice registers directly with the SIP server (10.0.50.60) with her Cloudflare assigned CGNAT IP of 100.96.0.12 -2. Bob (also registers directly with the SIP server (10.0.50.60) with their CGNAT IP of 100.96.0.13 -3. When Alice calls Bob, the SIP server will send a SIP INVITE message to Bob at 100.96.0.13 -4. The default gateway for the SIP server is 10.50.0.1, but we have defined a static route such that for destination 100.96.0.0/12, the next hop is the WARP Connector interface (10.0.50.10). +1. Alice registers directly with the SIP server (`10.0.50.60`) with her Cloudflare assigned CGNAT IP of `100.96.0.12`. +2. Bob also registers directly with the SIP server (`10.0.50.60`) with their CGNAT IP of `100.96.0.13`. +3. When Alice calls Bob, the SIP server will send a SIP INVITE message to Bob at `100.96.0.13`. +4. The default gateway for the SIP server is `10.50.0.1`, but we have defined a static route such that for destination `100.96.0.0/12`, the next hop is the WARP Connector interface (`10.0.50.10`). 5. The SIP INVITE message will be routed across the WARP Connector to the Cloudflare network and then received by Bob. 6. Bob accepts and the SIP server will send SIP/SDP messages to both Alice and Bob specifying which parameters to use for the RTP (audio) data. -7. For Direct Media paths where the SIP server is not in the audio path and the RTP streams are directly between Alice and Bob, ensure that [WARP-to-WARP Connectivity](/cloudflare-one/connections/connect-networks/private-net/warp-to-warp/#enable-warp-to-warp) has been enabled in Cloudflare. Audio streams in the Direct Media use case will not need to route over the WARP Connector. +7. For Direct Media paths where the SIP server is not in the audio path and the RTP streams are directly between Alice and Bob, ensure that [WARP-to-WARP connectivity](/cloudflare-one/connections/connect-networks/private-net/warp-to-warp/#enable-warp-to-warp) has been enabled in Cloudflare. Audio streams in the Direct Media use case will not need to route over the WARP Connector. -### Remote user to on-premises user +### Remote user to on-premise user Calls between remote and on-premise users are very similar, but RTP audio will be sent over the WARP Connector in addition to the SIP signaling. -![Figure 3: Remote user to on-premises user has all traffic routed via Cloudflare to SIP server and client.](~/assets/images/reference-architecture/deploying-self-hosted-voip-services-for-hybrid-users/figure3.svg "Figure 3: Remote user to on-premises user has all traffic routed via Cloudflare to SIP server and client.") +![Figure 3: Remote user to on-premise user has all traffic routed via Cloudflare to SIP server and client.](~/assets/images/reference-architecture/deploying-self-hosted-voip-services-for-hybrid-users/figure3.svg "Figure 3: Remote user to on-premise user has all traffic routed via Cloudflare to SIP server and client.") The high-level signaling and media paths are shown below: -![Figure 4: Both signaling and media (audio, video etc) travel via secured tunnels from remote devices to on-premises clients.](~/assets/images/reference-architecture/deploying-self-hosted-voip-services-for-hybrid-users/figure4.svg "Figure 4: Both signaling and media (audio, video etc) travel via secured tunnels from remote devices to on-premises clients.") +![Figure 4: Both signaling and media (audio, video etc) travel via secured tunnels from remote devices to on-premise clients.](~/assets/images/reference-architecture/deploying-self-hosted-voip-services-for-hybrid-users/figure4.svg "Figure 4: Both signaling and media (audio, video etc) travel via secured tunnels from remote devices to on-premise clients.") -1. Alice registers directly with the SIP server (10.0.50.60) with her CGNAT IP of 100.96.0.12 -2. Bob (also registers directly with the SIP server (10.0.50.60) with their LAN IP of 10.0.50.101 -3. When Alice calls Bob, the SIP server will send a SIP INVITE message to Bob at 10.0.50.101 -4. The default gateway for the SIP server is 10.50.0.1, but we have defined a static route such that for destination 100.96.0.0/12, the next hop is the WARP Connector interface (10.0.50.10). +1. Alice registers directly with the SIP server (`10.0.50.60`) with her CGNAT IP of `100.96.0.12`. +2. Bob also registers directly with the SIP server (`10.0.50.60`) with their LAN IP of `10.0.50.101`. +3. When Alice calls Bob, the SIP server will send a SIP INVITE message to Bob at `10.0.50.101`. +4. The default gateway for the SIP server is `10.50.0.1`, but we have defined a static route such that for destination `100.96.0.0/12`, the next hop is the WARP Connector interface (`10.0.50.10`). 5. The SIP INVITE message will be sent on the local network to Bob. 6. Bob accepts and the SIP server will send SIP/SDP messages to both Alice and Bob specifying which parameters to use for the RTP (audio) data. 7. Bob will send audio to Alice at 100.96.0.12, which will be routed across the WARP Connector to Cloudflare, and Alice will send audio to Bob at 10.0.50.101, which will be sent from Cloudflare across the WARP Connector to the on-premise local network. @@ -72,7 +72,7 @@ The high-level signaling and media paths are shown below: Remote users communicating with other remote users or on-premise users via on-premise SIP servers using Cloudflare's WARP Connector, will have a seamless and secure experience for both ends, with key benefits: -1. **Bidirectional Connectivity**: WARP Connector supports bidirectional traffic, which is crucial for remote users communicating with on-prem users. Both signaling and media traffic (SIP/RTP) flow securely between the two, regardless of where the user is physically located. This is done via Cloudflare's global network, using a WireGuard-encrypted tunnel, ensuring data integrity and encryption​. +1. **Bidirectional Connectivity**: WARP Connector supports bidirectional traffic, which is crucial for remote users communicating with on-premise users. Both signaling and media traffic (SIP/RTP) flow securely between the two, regardless of where the user is physically located. This is done via Cloudflare's global network, using a WireGuard-encrypted tunnel, ensuring data integrity and encryption​. 2. **Private Communication Over CGNAT**: The WARP Connector assigns Carrier-Grade NAT (CGNAT) IPs to devices, which allows remote users to securely communicate with on-premise users over private networks. This ensures that communication remains isolated from the public Internet, enhancing security. The CGNAT functionality means that remote and on-premise users can communicate as though they are on the same network​. From 9406c0442a263d4516ab6dcb92e2a95f80323383 Mon Sep 17 00:00:00 2001 From: Simon Thorpe Date: Wed, 30 Oct 2024 14:48:33 -0700 Subject: [PATCH 14/16] Update deploying-self-hosted-VoIP-services-for-hybrid-users.mdx --- .../deploying-self-hosted-VoIP-services-for-hybrid-users.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx b/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx index de11102a5f348ab..b77df2f3b08005e 100644 --- a/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx +++ b/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx @@ -14,7 +14,7 @@ updated: 2024-10-24 Traditional VPN solutions create several problems for VoIP deployments, primarily due to their inefficiencies in handling real-time traffic protocols such as [SIP](https://en.wikipedia.org/wiki/Session_Initiation_Protocol) and [RTP](https://en.wikipedia.org/wiki/Real-time_Transport_Protocol). Legacy VPN deployments introduce high latency and jitter, which negatively impact voice call quality. Additionally, they often struggle with [NAT](https://en.wikipedia.org/wiki/Network_address_translation) traversal, leading to connection issues for VoIP calls. -Cloudflare improves over traditional VPN solutions by leveraging its [global network](https://www.cloudflare.com/network/) of data centers in over 300 cities to significantly reduce latency for remote users. When using our device agent, remote users are automatically connected to the nearest Cloudflare data center, thus reducing latency. Additionally, the WARP Connector ensures secure, bidirectional communication between remote users and the on-premise SIP server, without exposing the server to the public Internet. This shields the VoIP infrastructure from potential attacks while maintaining a seamless, encrypted connection for real-time communications. +Cloudflare improves over traditional VPN solutions by leveraging its [global network](https://www.cloudflare.com/network/) of data centers in over 300 cities to significantly reduce latency for remote users. When using our device agent, remote users are automatically connected to the nearest Cloudflare data center, thus reducing latency. This document explains how Cloudflare can be architected with a self-hosted VoIP service. Note the solution below uses our [WARP Connector](/cloudflare-one/connections/connect-networks/private-net/warp-connector/), a small piece of software deployed on a server in the same subnet as the VoIP servers and creates bi-directional traffic flow through Cloudflare to users. @@ -22,7 +22,7 @@ This document explains how Cloudflare can be architected with a self-hosted VoIP ![Figure 1: Cloudflare facilitates secure connectivity from user devices to the network where the SIP server is running.](~/assets/images/reference-architecture/deploying-self-hosted-voip-services-for-hybrid-users/figure1.svg "Figure 1: Cloudflare facilitates secure connectivity from user devices to the network where the SIP server is running.") -The diagram above shows the WARP Connector and our device agent deployed to create a highly performant, reliable connectivity for private VoIP services. Note that Cloudflare will assign remote users an address from the CGNAT range, which is used for the private network created between device agents. +The diagram above shows the WARP Connector and our device agent deployed to create a highly performant, reliable connectivity for private VoIP services. Note that Cloudflare will assign remote users an address from the CGNAT range, which is used for the private network created between device agents. The WARP Connector ensures secure, bidirectional communication between remote users and the on-premise SIP server, without exposing the server to the public Internet. This shields the VoIP infrastructure from potential attacks while maintaining a seamless, encrypted connection for real-time communications. 1. VoIP server resides on a private network with no public IP. 2. WARP Connector creates a secure tunnel to Cloudflare and is configured as a virtual router in the private network. From aaca61d15922e4fed995321c7f877ee0335ec710 Mon Sep 17 00:00:00 2001 From: Simon Thorpe Date: Wed, 30 Oct 2024 14:49:42 -0700 Subject: [PATCH 15/16] Update deploying-self-hosted-VoIP-services-for-hybrid-users.mdx --- .../deploying-self-hosted-VoIP-services-for-hybrid-users.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx b/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx index b77df2f3b08005e..bfb2326ac5bd725 100644 --- a/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx +++ b/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx @@ -72,7 +72,7 @@ The high-level signaling and media paths are shown below: Remote users communicating with other remote users or on-premise users via on-premise SIP servers using Cloudflare's WARP Connector, will have a seamless and secure experience for both ends, with key benefits: -1. **Bidirectional Connectivity**: WARP Connector supports bidirectional traffic, which is crucial for remote users communicating with on-premise users. Both signaling and media traffic (SIP/RTP) flow securely between the two, regardless of where the user is physically located. This is done via Cloudflare's global network, using a WireGuard-encrypted tunnel, ensuring data integrity and encryption​. +1. **Bidirectional Connectivity**: WARP Connector supports bidirectional traffic, which is crucial for remote users communicating with on-premise users. Both signaling and media traffic (SIP/RTP) flow securely between the two, regardless of where the user is physically located. This is done via Cloudflare's global network, using an encrypted tunnel, ensuring data integrity and encryption​. 2. **Private Communication Over CGNAT**: The WARP Connector assigns Carrier-Grade NAT (CGNAT) IPs to devices, which allows remote users to securely communicate with on-premise users over private networks. This ensures that communication remains isolated from the public Internet, enhancing security. The CGNAT functionality means that remote and on-premise users can communicate as though they are on the same network​. From e7a3ddd6849465fba4f383722cb1129506b6c3f9 Mon Sep 17 00:00:00 2001 From: ranbel <101146722+ranbel@users.noreply.github.com> Date: Wed, 30 Oct 2024 19:41:34 -0400 Subject: [PATCH 16/16] import missing component --- .../deploying-self-hosted-VoIP-services-for-hybrid-users.mdx | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx b/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx index bfb2326ac5bd725..55c70966e4963e8 100644 --- a/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx +++ b/src/content/docs/reference-architecture/diagrams/sase/deploying-self-hosted-VoIP-services-for-hybrid-users.mdx @@ -10,6 +10,8 @@ sidebar: updated: 2024-10-24 --- +import { GlossaryTooltip } from "~/components"; + ## Introduction Traditional VPN solutions create several problems for VoIP deployments, primarily due to their inefficiencies in handling real-time traffic protocols such as [SIP](https://en.wikipedia.org/wiki/Session_Initiation_Protocol) and [RTP](https://en.wikipedia.org/wiki/Real-time_Transport_Protocol). Legacy VPN deployments introduce high latency and jitter, which negatively impact voice call quality. Additionally, they often struggle with [NAT](https://en.wikipedia.org/wiki/Network_address_translation) traversal, leading to connection issues for VoIP calls.