How to live with enterprise border TURN servers and still make WebRTC calls
HTTP proxy servers are well known and common in enterprise networks. When these are being used, the user or network admin will configure the HTTP proxy in the browser. Using an HTTP proxy is a feature supported by the browser.
“Official” enterprise VoIP traffic (meaning VoIP over systems IT is providing) is managed and the enterprise has the means to control and manage it for compliance, security and any other requirement. With the growing usage of VoIP and OTT services, some enterprises realize that there is VoIP traffic it has no means to control. For this reason, more and more enterprises are deploying border TURN servers and require all VoIP media to go through this server.
For the sake of this post we will put aside the discussion of what an enterprise should and shouldn’t monitor with regards to their employees.
Deploying the border TURN server creates a new requirement and issue. Many VoIP services deploy application TURN servers and in some cases require traffic to go through them for reasons of connectivity, QoS, routing decisions and topology hiding. The problem is that according to JSEP (that’s the IETF draft defining Javascript application session establishment) only one TURN server can be provided for an RTCPeerConnection. This means that there is no way to use both TURN servers, and therefore if the application TURN server is selected, the border TURN server will be left out of the media route and therefore the enterprise firewall might block that media.
This is where RETURN comes into play. RETURN allows the browser to encapsulate 2 TURN servers in one – hence the name Recursively Encapsulated TURN.
Once implemented by the browsers, the application will not need to list both TURN servers but rather only the Application TURN server. The border TURN server will be used automatically because it will be configured in the browser.
This is an IETF Internet draft currently in progress.
Details are available for WebRTC Standards Pro users only Signup for Pro Account