Nortel 1000 Con?guration guide Instruction Manual

Nortel Application Gateway 1000/2000
Nortel Application Gateway Release 6.1
Application Gateway Release Notes
Release Notes
Document Number: NN42360-400
Document Release: Standard 01.10
Date: April 2007
Year Publish FCC TM
Copyright © 2006—2007 Nortel Networks. All rights reserved.
Produced in Canada
The information in this document is subject to change without notice. The statements, configurations, technical
data, and recommendations in this document are believed to be accurate and reliable, but are presented
without express or implied warranty. Users must take full responsibility for their applications of any products
specified in this document. The information in this document is proprietary to Nortel Networks.
Nortel, Nortel (Logo), the Globemark, SL-1, Meridian 1, and Succession are trademarks of Nortel Networks.
Title page

iii
Application Gateway Release Notes
Contents
Upgrading the Application Gateway 1
Upgrading to Release 6.1 from Release 6.0 1
Upgrading from Release 6.1 to 6.1.x 3
Upgrading Broadcast Server 3
Upgrading the Smart Agent Client 4
When Upgrading the Application Gateway Via an ISO File 4
New Features and Changes in Release 6.1 5
Support for Communication Server 1000 Release 5.0 5
Daylight Savings Time Changes 6
Application Gateway 2000 6
Licensing 7
How Licensing Works 7
Voice Office Applications 9
Smart Agent Integration with Outlook Contacts 10
Smart Agent Support for E.164-Compliant Phone Numbers 12
Smart Agent Support from Web and Windows Applications 13
Product Documentation 14
Voice Office Application Suite Overview 14
Application Gateway Capacity 15
Important Security Information 16
Network and Configuration Requirements 17
Customer Network Quality Level 17
Minimum Requirements for IP Phones 17
Deployment and Operation Notes 17
Licensing of IP Phones 17
General 17
Visual Voicemail 20
Zone Paging 20
Broadcast Server 21
Known Issues 23
Voice Office Application Suite 23
Broadcast Server 24
Express Directory 25

Contents
Application Gateway Release Notes
iv
Smart Agent 27
Visual Voicemail 28
Zone Paging 29
Guest Services 30
Application Gateway 30
Issues Fixed in this Release 32
Fixed in Release 6.1.0.409 32
Fixed Prior to Release 6.1.0.409 32
Design Studio Usage Notes 33
Unsupported Software Features 34
Transformation Issues 35
User Interface and Operation Issues 35
Additional Documentation 37
Contacting Support 37

1
Release Notes
Upgrading the Application Gateway
The Nortel Application Gateway 1000/2000 delivers business applications
to Internet-enabled IP telephones. It is an open, standards-based network
platform that supports simultaneous voice and data services. The
Application Gateway is designed to reside virtually anywhere in the
enterprise network. IP telephones access the Application Gateway for
applications. The Application Gateway delivers the Voice Office
Application Suite to Nortel IP phones.
Upgrading the Application Gateway
The following sections describe how to upgrade the Application Gateway
and related software:
•Upgrading to Release 6.1 from Release 6.0, page 1
•Upgrading from Release 6.1 to 6.1.x, page 3
•Upgrading Broadcast Server, page 3
•Upgrading the Smart Agent Client, page 4
•When Upgrading the Application Gateway Via an ISO File, page 4
Upgrading to Release 6.1 from Release 6.0
In addition to the following upgrade instructions, please refer to release
announcements for additional instructions regarding upgrade files and
licensing.
To upgrade the Application Gateway:
Note When you upload a server upgrade, the Application Gateway
drops the active sessions, so it is best to upgrade the server when
you know that traffic is at a minimum.
1Before upgrading:
a. Save the 6.0 version of the Application Gateway configuration file
(Administration > Maintenance page). The upgrade to release 6.1 will
overwrite portions of the file, so you must restore the 6.0 configuration
file after the upgrade.
b. Use Design Studio to back up the Device Definition File (DDF). The
upgrade overwrites the DDF, so you must use Design Studio to restore
the DDF after the upgrade.

Upgrading the Application Gateway
2Release Notes
c. If port 3001 is closed in your firewall, open it. The Administration Tool
now uses ports 3001 and 9001 for TCP traffic over HTTPS. The
administration ports are no longer configurable.
2Download the upgrade file to your local network.
If you cannot locate the upgrade file or do not know which upgrade file to
use, please contact our support organization.
3Upload the upgrade file:
a. Go to the Administration > Maintenance page.
b. Across from Upload Server Upgrade, click Browse.
c. Locate the upgrade file that you want to upload and click Open.
d. Click Upload to upload the upgrade to the Application Gateway.
e. After the upload completes, click the Reboot button that appears.
4To restore the configuration file from 6.0:
a. Go to the Administration > Maintenance page.
b. Across from Upload Server Upgrade or Saved Config, click Browse.
c. Locate the configuration file, click Open, and then click Upload.
d. After the upload completes, click the Reboot button that appears.
5On the Administration > Maintenance page, click Synchronize (Settings
After Upgrade). This step is required to ensure that all information
entered in the previous version is properly updated for use with release
6.1.
6On the Operation > Voice Office > IP Phone page, click Synchronize
Now. This step is required to reconnect the phones to the Application
Gateway.
7If you saved a customized DDF file before upgrading the Application
Gateway, use Design Studio to upload the saved DDF file to the
Application Gateway.
To install additional or upgraded licenses:
When you purchase an Application Gateway or upgrades, you will receive
instructions for obtaining license files.
1After you have downloaded license files, go to the Administration >
Licenses page.
2Click Browse, locate a license file (named ag_hostID.lic), click Open, and
then click Upload. You must upload the base license before uploading the
phone licenses.
3After you upload all license files, restart the Application Gateway.

3
Release Notes
Upgrading the Application Gateway
For information on licensing management, refer to the Application Gateway
Administration Guide.
Upgrading from Release 6.1 to 6.1.x
Use the following instructions to upgrade Release 6.1 with an up-issue
release (only the build number changes) or with Release 6.1.x.
To upgrade the Application Gateway:
Note When you upload a server upgrade, the Application Gateway
drops the active sessions, so it is best to upgrade the server when
you know that traffic is at a minimum.
1Download the upgrade file to your local network.
If you cannot locate the upgrade file or do not know which upgrade file to
use, please contact our support organization.
2Upload the upgrade file:
a. Go to the Administration > Maintenance page.
b. Across from Upload Server Upgrade, click Browse.
c. Locate the upgrade file that you want to upload and click Open.
d. Click Upload to upload the upgrade to the Application Gateway.
e. After the upload completes, click the Reboot button that appears.
Upgrading Broadcast Server
Note If you are installing Broadcast Server for the first time, refer to “Broadcast
Server Installation” in the Application Gateway Administration Guide.
To upgrade your Broadcast Server software:
1Make a backup copy of the following files:
C:\Program Files\Nortel\BCS\__db\db.mdb
(the Broadcast Server database file)
C:\Program Files\Nortel\BCS\web\_media
(the Broadcast Server media directory)
2Uninstall the old version of Broadcast Server.
3Insert the Broadcast Server installation CD-ROM into the device to be used
as the Broadcast Server server.

Upgrading the Application Gateway
4Release Notes
4On the CD, double-click the installation file to begin the installation. You
do not need to answer any prompts in the Setup Wizard or the
Configuration Wizard. Your configuration will be restored in the next
step.
Note (3872) Do not change the default installation path provided in the wizard.
The wizard will fail if you change the path.
5Replace the database file and media directory with the files that you
copied in Step 1.
6Restart Broadcast Server.
Upgrading the Smart Agent Client
Smart Agent users must uninstall the previous Smart Agent client before
installing version 6.1. Upgrading the Smart Agent client results in several
issues, noted in this document.
Note If your site uses Outlook 2002 Service Pack 3 (the default Outlook 2002
installation), you must install an Outlook add-in as described in the
section “Changing Outlook 2002 Security Settings for Smart Agent” in the
Application Gateway Administration Guide. The add-in changes an Outlook
security setting so that Smart Agent can access Outlook email addresses
without triggering the Outlook error message “A program is attempting
to access e-mail addresses…it may be a virus….”.
When Upgrading the Application Gateway Via an ISO File
In some cases, an upgrade is distributed in the form of an .iso file. If you
receive an .iso file for upgrading the Application Gateway, be sure to
follow the instructions that accompany the .iso file for recording the CD
image and re-imaging and re-licensing the Application Gateway.
Before you re-image the Application Gateway, save your configuration
settings (Administration > Maintenance page). Re-imaging the
Application Gateway will overwrite your configuration. By saving the
configuration, you can then restore it after you complete the re-image.
The zip file that you download contains an .iso format CD image.
1Extract the zip, then record the CD image to a CD using your favorite CD
recording software.

5
Release Notes
New Features and Changes in Release 6.1
Please make sure that you record the image with recording software that
recognizes the ISO format. Your software will warn you if it does not
recognize the format.
Dragging the .iso image onto your CD-RW drive will result in creating an
invalid CD with just the CD-image file stored on it.
2Put the recorded CD into the Application Gateway CD drive and reboot
the server by powering it on.
In about a minute after the server restarts, you should see information
about the progress of the installation through the serial console.
New Features and Changes in Release 6.1
The following sections provide an overview to Release 6.1:
Support for Communication Server 1000 Release 5.0, page 5
Daylight Savings Time Changes, page 6
Application Gateway 2000, page 6
Licensing, page 7
Voice Office Applications, page 9
Smart Agent Integration with Outlook Contacts, page 10
Smart Agent Support for E.164-Compliant Phone Numbers, page 12
Smart Agent Support from Web and Windows Applications, page 13
Product Documentation, page 14
Support for Communication Server 1000 Release 5.0
Sites using Communication Server 1000 Release 5.0 can now obtain
IP-to-DN mapping information from the signaling and call servers. You
configure a connection between the Application Gateway and one
signaling server, which provides the Application Gateway with
information from all connected call servers (even if there are two signaling
server). IP to DN synchronization creates a map of Phone IP addresses to
Phone primary DNs.
For information about configuring IP-to-DN mapping, refer to “Specifying
a Source for Phone IP-to-DN Mappings” in Chapter 4 of the Application
Gateway Administration Guide.

New Features and Changes in Release 6.1
6Release Notes
Daylight Savings Time Changes
The Daylight Savings Time (DST) start and end dates are changing in the
United States, the Bahamas, and in the Canadian provinces which observe
DST. Starting in March 2007, DST in the United States, the Bahamas, and
Canada begins on the second Sunday in March and ends on the first
Sunday in November.
This upgrade includes the updated time zone files required for
Linux-based servers. After you install the upgrade and reboot, the
Application Gateway will handle DST changes without further
intervention.
Note For information on updating computers running Windows, refer to the
Microsoft web site. You will need to update the computer that has
Broadcast Server installed.
Application Gateway 2000
The Application Gateway is now provided on an additional platform that
accommodates more phones and supports clusters. The new platform, the
Application Gateway 2000, runs on the IBM xSeries 306m server. The
Application Gateway 2000 capacity is as follows:
•A maximum of 1000 phones per Application Gateway 2000.
•Up to 4 Application Gateway 2000 servers per cluster.
•A maximum of 4000 phones in a cluster of 4 servers. (That is, 1000
times the number of servers.)
•Smart Agent is supported across clustered Application Gateway 2000
servers.
Note The Application Gateway 1000 runs on the ISP 1100 platform and is still
available for smaller deployments. The Application Gateway 1000
supports a maximum of 500 phones and does not support clusters.
For more information about Application Gateway capacity, see
“Application Gateway Capacity,” page 15.

7
Release Notes
New Features and Changes in Release 6.1
Licensing
Keycode Licensing for the Application Gateway is provided by the Nortel
KRS (Keycode Retrieval System). For information on obtaining a keycode
license, refer to the Application Gateway Quick Start Guide.
How Licensing Works
The information in this section supplements the Application Gateway
Administration Guide.
Prerequisites for obtaining a license
•IP/DN map must exist.
•The Application Gateway must be synchronized with the
Communication Server.
•A phone’s IP address and primary DN must be in the IP/DN map.
The licensing process
•Phone connects to the Application Gateway.
•The Application Gateway uses the phone’s IP address to verify that it
is in the IP/DN map and then verifies that there is a corresponding
DN.
•The Application Gateway registers the phone, adding the phone’s
MAC address, primary DN, and IP address to the Device Registry.
After a phone has registered with the Application Gateway, its DN
becomes available for inclusion in zones and alert lists. That DN stays
available until the administrator uses the License Monitor to manually
release the license (thereby unregistering the phone).
•The Application Gateway issues a license to the phone.
Changes that impact licensing
•Once a phone is licensed, it holds the license, even when it is idle or
disconnected. A license is removed from a phone only through the
administrator’s use of the License Monitor to manually release the
license.
•If a phone’s IP address changes (perhaps based on a DHCP lease
expiration), the Application Gateway changes the phone’s IP address
in the Device Registry the next time the phone reconnects with the
Application Gateway.

New Features and Changes in Release 6.1
8Release Notes
•If a phone’s DN changes (perhaps through the use of Virtual Office or
by the administrator), the Application Gateway does not have a way
to update the Device Registry, thus the phone continues to function as
if its DN was unchanged until the next IP-to-DN synchronization with
the Nortel Communication Server.
•If a phone has registered with the Application Gateway and is
replaced by a new phone (that is a phone with a new MAC address
registers with the Application Gateway with the same IP address as
another phone), the phone will register with the Application Gateway
and will consume a second license. The original phone will remain
licensed until the administrator manually removes the license using
the License Monitor.
•If all allowed licenses are consumed and new phones attempt to
register with the Application Gateway, they will be shown in the
License Monitor as unlicensed. You can the use the License Monitor to
deny a license to an already licensed phone and to request a license for
an unlicensed or denied phone. When a phone is unlicensed or denied
a license, the phone will display a message indicated that it is
unlicensed when the expand key is pressed.
•If the Application Gateway is restarted, it must be resynchronized
with the datasource providing the IP/DN map information.
License Monitor
To free one of the licenses occupied by the phone, use the License Monitor
to change the extension’s status to denied.
•To open the License Monitor, go to the Operation > Advanced page
and log in when prompted.
•To change the license status of an extension, right-click the extension
and choose Toggle Status.
Licensing and clusters
If the Application Gateways are arranged in a cluster:
•Phones that are licensed on one member of the cluster will be shown
as unlicensed on the other members of the cluster.
•Phones that are denied a license, will be shown as Denied on all of the
members of the cluster.
•The administrator can sync the cluster to propagate changes across the
cluster. Changes are synchronized across the cluster each time the
Application Gateway synchronizes with the signaling server.

9
Release Notes
New Features and Changes in Release 6.1
Log messages related to licensing
•When an IP/DN map is created, this message appears in the log.
(Licenses cannot be granted until there is an IP/DN map.)
<time date> localhost server[861]: datasources: added mapping: <Phone IP => <Phone DN>
•Before a phone is granted a license, this message or one similar
appears in the log:
<time date> localhost server[850]: license: Checking available <Phone type> licenses 1 of
10
This message indicates the number of available licenses. In the
example, there is one available license. After that license is issued to
the phone, no licenses remain. Note that “phone type” information is
no longer relevant to licensing.
•When the Application Gateway is out of licenses, these two messages
appear when phones try to acquire a license:
<time date> localhost server[850]: licensed: No more licenses available
<time date> localhost server[850]: server: No more licenses available for <MAC address of
phone trying to take a license>
Voice Office Applications
•If a user is logged into Visual Voicemail when a new voicemail arrives,
the phone now automatically changes from the telephony service to
one of the following screens:
– If the last Voice Office screen displayed was Visual Voicemail, the
phone returns to Visual Voicemail.
– If the last Voice Office screen displayed was the Voice Office
Menu, the phone returns to the Voice Office Menu.
A new voicemail does not result in a phone screen change if the last
Voice Office screen displayed was for some other application such as
a zone page, alert, or the directory.
•When a page ends or a broadcast alert expires (per the duration set for
the alert), the phone now automatically returns to the telephony
service. Broadcast alert handling includes the following:
– While an alert is active (not yet expired), it remains on the screen
unless the user presses the Exit key (to exit Voice Office).
– If an alert is displayed and the user answers a phone call, the
phone screen switches to the telephony service. When the user
goes back to Voice Office, if the alert is still active, it displays
under GXAS but not under XAS.

New Features and Changes in Release 6.1
10 Release Notes
– An active alert remains on the phone screen when a call comes in
but is not picked up.
•You can now start paging a zone by selecting it directly from the Voice
Office Menu. This shortcut eliminates several steps previously
required to start a page. Use the Zone Paging interface in the
Administration Tool to specify which extensions should include a
particular zone in the Voice Office Menu.
•When a phone receives a page, text related to the page will no longer
be included. The text was interrupting the audio of in-progress calls.
•The Administration Tool interface for setting up paging zones now
includes the ability to filter extensions and other usability
improvements. In addition, you can specify the maximum duration of
a page (to guard against situations in which a user leaves a phone off
hook after paging) and an idle time out for paging. The Application
Gateway will end a page if there is no paging audio during the idle
time out period.
•The Administration Tool interface for configuring LDAP directories
has changed so that directory sources are now tracked by name, rather
than number.
•2007 IP phone users (GXAS mode) and 1120E/40E IP phone users can
switch between entering the first and last names by typing # (the
pound key) or by typing a space from the popup keyboard. For
example, you can enter the first few letters of the first name, type #,
and then start typing the last name.
•You can now synchronize the time on the Application Gateway to a
specified NTP time server. This, in combination with synchronizing
the PC on which Broadcast Server runs with the same time server will
eliminate problems caused by the previous lack of synchronization
between the two servers.
Smart Agent Integration with Outlook Contacts
Smart Agent is more fully integrated with Microsoft Outlook 2000, XP,
2002, and 2003. The click-to-call functionality is now also available from
the following Outlook locations:
•In email messages received after the user installed Smart Agent, phone
numbers in the message body or names in an incoming message
header (To, From, CC, BCC fields).

11
Release Notes
New Features and Changes in Release 6.1
•Outlook Contacts main contacts window. Right-click a name or email
address or click the Call Now toolbar button.
•Outlook Contacts details window. Right-click a name, phone number,
or email address.

New Features and Changes in Release 6.1
12 Release Notes
Smart Agent Support for E.164-Compliant Phone Numbers
Note To use Smart Agent international dialing features, Smart Agent users
must uninstall the previous Smart Agent client and then install the new
Smart Agent client.
Smart Agent parses Web applications and emails as the user accesses
them, searching for number sequences that appear to be public switched
network telephone numbers. Upon finding a candidate number sequence,
Smart Agent adds a hypertext link to the number so that it is dialable
through a mouse click. Smart Agent finds a high percentage of public
telephone numbers in conventionally constructed Web applications, Web
pages, and HTML-based emails. Smart Agent is not able to parse certain
types of Web pages, nor will it recognize numbers that are in unusual
formats. Smart Agent does not recognize internal or private network
telephone numbers.
Smart Agent searches Web applications and emails for public switched
network telephone numbers that are E.164-compliant. E.164 is a standard
for phone numbers recommended by the International
Telecommunication Union (ITU-T). The majority of the world’s telephone
numbers conform to the E.164 format, which is typically + or ++ (plus
sign), followed by a maximum of fifteen digits consisting of country code,
area code, and subscriber number. Smart Agent also looks for numbers
prefixed with an international code, such as 00 or 011. If a number is not
prefixed with a +, ++, 00, or other international dial prefix, Smart Agent
might consider the number a domestic number, if it is unable to recognize
the number as international.

13
Release Notes
New Features and Changes in Release 6.1
To enable Smart Agent to recognize and format numbers for a particular
locale, you must configure the Application Gateway with the country and
area code for the location of the call server associated with the Application
Gateway. That configuration then guides Smart Agent in its recognition
and number manipulation using built-in ITU-T (International
Telecommunication Union) standards tables for phone number
components such as international and domestic prefixes.
For details about Smart Agent configuration, phone number recognition
and manipulation, and unsupported number formats, refer to the “Smart
Agent Configuration” chapter in the Application Gateway Administration
Guide.
For details about restricting the numbers that Smart Agent recognizes as
telephone numbers, refer to the Smart Agent Support Supplement, now
posted on the TS portal:
http://www130.nortelnetworks.com/go/main.jsp?cscat=DOCDETAIL&DocumentO
ID=531066&RenditionID=REND835344&poid=17621
1To navigate to the site, go to www.nortel.com/support and click the
Browse product support tab.
2Click the Product Finder link.
3Search for Voice & IP Communications, select the product category
Applications & Gateways, and then select the product Application
Gateway 2000.
4Select the content Documentation and then click Go.
Smart Agent Support from Web and Windows Applications
Web developers can add c2c URIs to custom Web applications, enabling a
user to dial a number by clicking a Web page element such as a button,
image, link text, or asp.net control. To add a simple link to a Web
application, include the c2c URI as follows. Do not include spaces in the
phone number.
<a href="c2c://phoneNumber">link text</a>
Examples:
<a href="c2c://6-2-34850">6-2-34850</a>
<a href="c2c://6-2-34850">Customer Support</a>
Windows developers can modify applications so that users can dial
telephone numbers displayed in the application by clicking them. The
application plug-in must make a Windows API call that is equivalent to:
cmd /c start c2cN:phoneNumber

Voice Office Application Suite
Overview
14 Release Notes
For more information about adding Click-to-Call links to Web and
Windows applications, refer to the “Smart Agent Configuration” chapter
of the Application Gateway Administration Guide.
Product Documentation
•The Voice Office Configuration Guide and Smart Agent Configuration
Guide have been consolidated into the Application Gateway
Administration Guide. Troubleshooting information has been
supplemented and grouped at the end of the Application Gateway
Administration Guide.
•The entire contents of the Application Gateway Administration Guide and
the Guest Services Configuration Guide are now available as a searchable
context-sensitive Help systems. Clicking the red Help link (just below
the tabs) on any page of the upgraded Administration Tool displays a
help topic specific to the page. Use the accordion tabs in the help
window to access the table of contents and index, to search the help,
or to bookmark a topic.
•The Application Gateway Quick Start Guide now includes a task list for
configuring Voice Office applications. The task list contains references
to related topics in the Application Gateway Administration Guide and
other documents.
Voice Office Application Suite Overview
The Application Gateway provides Voice Office Application Suite
capabilities for users of Nortel Communication Server 1000 systems. The
Voice Office Application Suite enables enterprises to leverage their IP
telephony investments and increase workforce productivity by delivering
converged applications to the screens and speakers of Nortel IP phones.
Voice Office applications include:
Express Directory provides an LDAP-based, organization-wide directory
with high speed, real time pruning.
Visual Voicemail enables users to see a visual list of their voice messages
with the ability to select the most important ones to review, without
having to listen to each message in a serial fashion. During message
playback, the user can play, pause, rewind, etc. using labeled soft keys
rather than using cryptic control codes.
Zone Paging enables users to page through groups of IP phones in specific
zones without the expense of installing an overhead paging system.

15
Release Notes
Voice Office Application Suite
Overview
Broadcast Server delivers alerts such as emergency, IT, and weather
broadcasts in the form of text and audio messages to IP phones.
Smart Agent enables Windows PC users to initiate a call from a desk
phone by clicking a link in Internet Explorer, Outlook, and Outlook
Express.
Application Gateway Capacity
The Application Gateway 2000 supports 1000 concurrent sessions. The
Application Gateway 1000 supports 500 concurrent sessions. Each
licensed IP phone occupies one session.
The following capacity figures assume that the host network can handle
the traffic. For larger installations, pre-testing is required to ensure that
the network capacity is adequate.
•Up to four Application Gateway 2000’s can be clustered, supporting
up to 4000 phones.
•An Application Gateway supports 100 concurrent broadcasts (alerts or
zone pages) for phones. A broadcast is one alert sent to one phone.
Thus 100 broadcasts would be one alert sent to 100 phones or two
concurrent alerts sent to 50 phones. For a cluster, the maximum
broadcast or zone page distribution is 400 phones per cluster.
•An Application Gateway supports a maximum of 256 broadcast zones.
•An Application Gateway supports 32 concurrent buffered audio
streams. When an attempt to open a 33rd buffered audio stream
occurs, the phone user will see an audio unavailable error message.
– An alert sent from Broadcast Server occupies one buffered audio
stream per Application Gateway, regardless of the size of the
distribution list.
– A user listening to a message in Visual Voicemail occupies one
buffered audio stream. Visual Voicemail is not affected by
clustering.
– Zone pages do not require audio to be buffered and are therefore
not subject to the limitation of 32 simultaneous buffered audio
streams.
Note For a list of the Nortel software requirements, please refer to the
Application Gateway Pre-Installation Checklist for Nortel Communication
Server.

Important Security Information
16 Release Notes
Important Security Information
Improper configuration of the Application Gateway can result in a
security risk. Before you deploy the Application Gateway, verify that it
does not have access to protected intranet sites.
Be aware of the following security considerations:
•Protected servers
Do not put the Application Gateway on the same subnet as protected
servers if the Application Gateway is configured to proxy all web
pages. As a result, the Application Gateway will provide access to
computers on the same subnet as the web servers that are configured
to work with the Application Gateway. For example, suppose an
Application Gateway has an external IP address of 24.221.1.1 and an
internal IP address of 192.168.1.31. On the same subnet, you have an
intranet server protected from outside access, with an IP address of
192.168.1.20. You can access all ports on the protected intranet server
through the Application Gateway by using this URL:
http://24.221.1.1/http://192.168.1.20.
•IP phone/Application Gateway connection
We recommend that you locate the connection between an IP phone
and the Application Gateway behind a firewall.
•SSL to non-SSL redirects
When a web page in Design Studio is redirected to an SSL site (HTTPS)
from a non-SSL site (HTTP), the connection between Design Studio
and the Application Gateway is not secure. We recommend that you
locate the connection between Design Studio and the Application
Gateway behind a firewall.