Deploying servers in the DMZ

Deploying all servers in the DMZ is a valid option for small, highly secure deployments when hardware is limited.

Deploying IBM® Sametime® servers outside the internal firewall, but still separated from the Internet with a DMZ firewall, is a valid option for small, highly secure deployments. Advantages to this deployment keeps critical services such as LDAP services and IBM DB2® Server behind the internal firewall while requiring fewer computers for the deployment.

Disadvantages of deploying servers outside the internal firewall are that Sametime services are more easily exposed to the Internet and there is no separation between internal and external meetings.

The Sametime System Console deployed in the DMZ can be in the same cell as the Meeting Server, Media Manager, and Sametime Proxy Server. The Sametime System Console can also serve as the Deployment Manager for any other Sametime servers hosted in the DMZ (with the exception of the Video Manager and Sametime Video MCU). Hosting a Sametime Proxy Server in the DMZ enables the awareness feature for external users who attend meeting.

Most of the time clients inside a company must pass through a Network Address Translator (NAT) to get to the Internet. And most of the time users who work from a home office must pass through a NAT-enabled router to get to the Internet. If your users must pass through NAT or a firewall, and you want them to access audio and video, then you need to deploy a Sametime TURN Server. A TURN Server is required when direct peer-to-peer communications are not possible.

If using a TURN Server, open a UDP port range between internal clients and the Media Manager and between the Media Manager and the TURN Server for clients that use audio/video.

Note: If a client is behind an HTTP Proxy Server and access to the Internet is only allowed using Port 80 HTTP or 443 SSL, then Sametime cannot support audio/video. See Planning a Sametime TURN Server deployment for more information.

The graphic that follows shows how you can create a secure deployment of voice and video services outside the intranet for external, anonymous access.