Abstract:
A system and method for allowing remote access to an IP communications network is disclosed. In one embodiment, a method for allowing access to an IP network comprises: sending a first message addressed to a first port of an IP communications network component, the first message comprising a command requesting the performance of a selected telecommunications function; a selected IP endpoint performing, in response to the first message, the selected telecommunications function; sending a second message addressed to a different second port of the IP communications network component, the second message comprising a request for information associated with the IP endpoint; and tunneling, in response to receiving the second message at the second port, the second message to the IP endpoint.

Description:
CROSS REFERENCE TO RELATED APPLICATIONS 
     The present application claims the benefits under 35 U.S.C. §119(e) of U.S. Provisional Application Ser. No. 60/615,451, of the same title, filed Sep. 30, 2004, to Corliss and Erickson, which is incorporated herein by reference in its entirety. 
    
    
     FIELD OF THE INVENTION 
     The present invention relates to a suite of tools that allow remote diagnostic troubleshooting of Internet Protocol (IP) endpoints. 
     BACKGROUND OF THE INVENTION 
     Private IP communications systems, such as private IP telephony systems, typically comprise a communications server connected to an external communications network, such as a public switched telephone network (PSTN), and a private data network (i.e. a converged IP network). IP endpoints, such as IP telephones (e.g., Avaya Call Manger Definity™ products), are connected to the private data network and provide for IP communications under the control of the communications server. In addition to the IP endpoints used in connection with communications, a customer&#39;s private data network typically includes data processing and storage components, such as server computers, client computers and network storage devices. Thus, giving a third party access to the customer&#39;s private data network so the third party has access to the IP endpoints, such as for support and troubleshooting of the IP communications system, increases security risks associated with the private data network. Since the third party does not typically need access to the private data network except for limited actions related to communicating with the IP endpoints, the increased security risks are typically not warranted. Furthermore, access to customer devices on the private data network other than the IP endpoints and other components provided as part of the private IP communications system is not necessary for the third party to support and troubleshoot the customer&#39;s IP communications system. Thus, the risk of accidental or intentional actions that may damage the private data network should be minimized by limiting the third party&#39;s access to only the portions of the network that the third party actually needs to access. 
     While the third party would typically have access to a communications server attached to an external communications network, the communications server is also typically isolated from the customer&#39;s private data network. For example, since the communications server controls sensitive communications such as 911 emergency calls, the communications server is usually isolated from the private data network to prohibit access to the communications server from users of the private data network. 
     Thus, when the customer&#39;s communications system requires support or troubleshooting of the IP endpoints located on the customer&#39;s private data network, the third party must send a technician to the location of the private data network. The technician is assigned an IP address and connects to the private data network to access the IP endpoints. The technician, for example, may utilize a maintenance information bulletin (MIB) browser to read configuration or operating information from the IP endpoints. After the technician has collected the required information, the technician typically disconnects from the private data network, establishes a remote connection with the third party&#39;s network and forwards the retrieved information back to the third party for analysis. 
     SUMMARY OF THE INVENTION 
     The present invention provides a system and method for securely and remotely accessing information stored on IP endpoints and other components provided as part of a private IP communications system interconnected with an enterprise converged IP network. The system and method allow limited access for a remote user to IP communications devices, such as IP endpoints, signal channel media processors and bearer channel media processors, located on a converged IP network. The system and method further prevent the user from being able to access general purpose computing devices on the converged IP network. In this manner, a remote user can access devices related to an IP communications system without having access to general purpose computing devices residing on the same converged IP network. 
     In one embodiment, for example, a method for allowing remote access to an IP communications network comprises: sending a first message addressed to a first port of an IP communications network component (e.g., a signal or bearer channel media processor), the first message comprising a command requesting the performance of a selected telecommunications function (e.g., dial tone, off-hook, on-hook, etc.); a selected IP endpoint performing, in response to the first message, the selected telecommunications function; sending a second message addressed to a different second port of the IP communications network component, the second message comprising a request for information associated with the IP endpoint; and tunneling, in response to receiving the second message at the second port, the second message to the IP endpoint. 
     In another embodiment, a system for allowing remote access to an IP endpoint device on a communications network comprises a communications server adapted to manage communications functions of a selected IP endpoint via a communications device and a first communications network. The communications server comprises: (a) a remote communications application residing on the communications server adapted to communicate with a remote diagnostic system via a second communications network, the remote communications application adapted to receive a query for the IP endpoint from the remote diagnostic system and to provide a response to the query received from the IP endpoint to the remote diagnostic system; and (b) an appliance manager application residing on the communications server adapted to send a first message addressed to a first port of the communications device, the first message comprising a command requesting the performance of a selected telecommunications functions at the IP endpoint, tunnel the query to the IP endpoint via a different second port of the communications device and receive a response from the IP endpoint via the communications device. The communications server is adapted to be isolated from the first communications network via the communications device, and the application manager application is adapted to allow limited communication between the communications server and the IP endpoint via the communications device. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1  shows a block diagram of an exemplary embodiment of a system for remotely accessing an Internet Protocol (IP) communications device; 
         FIG. 2  shows a block diagram of one embodiment of a communications server for use in the system of  FIG. 1 ; 
         FIG. 3  shows a flow diagram of an embodiment of a method for remotely accessing an IP appliance connected to an IP communications network; 
         FIG. 4  shows a flow diagram of an embodiment of a method for remotely accessing an IP endpoint of an IP communications network; and 
         FIG. 5  shows an embodiment of a method for remotely accessing an IP communications device on an IP communications network. 
     
    
    
     DETAILED DESCRIPTION 
       FIG. 1  shows a block diagram of an exemplary embodiment of a system  20  for remotely accessing an Internet Protocol (IP) device. As shown in  FIG. 1 , the system  20  comprises a remote diagnostic system  24  interconnected to a customer network  42  by a communications network  40 . The remote diagnostic system  24  may include a remote client  32  in communication with a remote server  34 . The customer network  42  generally comprises a converged private data network. With respect to providing real time IP communications functions, such as telephony functions, the customer network comprises a number of IP endpoints  54 . In addition, the customer network  42  may comprise a number of general purpose computing devices  26 , such as data processing and/or storage components. The IP communications endpoints  54  and the general purpose computing devices  26  are part of a converged IP network  52  included in the customer network  42 . In addition, the customer network  42  comprises a communications server  44  interconnected to the IP network through a signal channel media processor  48  (e.g., a C-LAN device) and/or a bearer channel media processor  50 . 
     In accordance with embodiments of the present invention, the communications server  44  interconnects the IP endpoints  54  to other communications endpoints  28  through a communications network  40 , such as a WAN and/or the PSTN. Accordingly, embodiments of the present invention are associated with providing telephony and other communications functions to users of the IP endpoints  54  interconnected to a converged IP network  52 . Furthermore, commands and data associated with such communications functions may be passed between the communications server  44  and the IP endpoints  54  through a signal channel media processor  48  and/or a bearer channel media processor  50 . In general, the signal channel media processor  48  controls or is associated with the IP endpoints  54  and communications features, such as “dial tone,” “on-hook,” “off-hook.” “hold,” “call conferencing” and the like. The bearer channel media processor  50  is generally associated with the management and control of data, such as voice data streams. 
     The remote client  32  may include a client application  30  residing on the remote client  32 . The remote client  32 , for example, comprises a computer such as a personal computer, a server, a mainframe computer, a mini computer, a personal data assistant (PDA), a web-enabled telephone and the like. 
     The client application  30  communicates with a remote server  34 . The remote server  34 , for example, comprises a Unix™ server, a Linux server, a Windows™ server or the like. A web application  36  and a server application  38  reside on the remote server  34 . The web application  36 , in one embodiment, comprises a web server application that communicates with the client application  30  (e.g., a web browser application) residing on the remote client  32 . In this embodiment, the client application  30  of the remote client  32  communicates with the web application  36  of the remote server  34  using a protocol such as HyperText Transfer Protocol (HTTP). The client application  30  may communicate with the web application  36  via any means known in the art, however. The client application  30 , for example, may communicate with the web application  36  over a network such as a public switched telephone network (PSTN), a local area network (LAN), a wide area network (WAN), the Internet, an intranet, a private network, a public network or the like, or any combination of networks. 
     The web application  36  residing on the remote server  34  functions as an intermediary between the client application  30  and the server application  34 . When the web application  36  receives a request from the client application  30 , the web application  36  initiates the server application  38  and forwards the request to the server application  38 . 
     The remote server  34  also communicates with a communications server  44  located on a customer&#39;s network  42  via a communications network  40 . The communications network  40 , for example, may comprise a PSTN, the Internet, a WAN, a LAN, an intranet, a private network, a private network or the like, or any combination of communications networks. The server application  38  residing on the remote server  34  manages communication between the remote server  34  and the communications server  44  from the remote server  34  end. 
     The communications server  44  manages at least a portion of the IP communications for an enterprise, such as a customer of a communications support and troubleshooting third party. The communications server  44 , in one embodiment, comprises a telecommunications server such as an Avaya, Inc. S8500™ Media Server, although other communications servers may be used. The communications server  44 , for example, may manage circuit-switched and voice over IP (VoIP) telecommunications for the enterprise (customer) network. In managing VoIP communications, the communications server  44  manages the communications of IP endpoints  54  interconnected to the server through the converged IP network  52  of the customer network  42 . In the embodiment shown in  FIG. 1 , for example, the communications server  44  controls the communications links between an IP endpoint  54  and another communications endpoint  28  (e.g., a telephone) interconnected to the communications server  44  through the communications network  40  (e.g., a PSTN), via a signal channel media processor  48 . The communications server  44  further controls voice and/or data traffic via a bearer channel media processor  50 . 
       FIG. 2  shows one embodiment of the communications server  44  of  FIG. 1 . In this embodiment, the communications server  44  comprises a processor  60 , a data storage device  62 , a memory  64 , a user input  66 , a user output  68  and a communication network interface  70  connected via a bus  72 . The processor  60  of the communications server  44  executes applications stored in the data storage device  62  via the memory  64 . The processor  60 , for example, executes an operating system  74  stored in the data storage device  62 . The operating system  74  may comprise an operating system for managing the operation of a communications server such as Linux, Unix™ or Windows™ or the like. The processor  60  also executes a remote communications application  45  for managing communications with the remote server  34  shown in  FIG. 1  and an appliance manager application  46  for managing communications with the signal channel media processor  48 , the bearer channel media processor  50  and the IP endpoints  54  also shown in  FIG. 1 . In addition, in the embodiment shown in  FIG. 2 , the processor  60  also accesses a data table  76  during the execution of the appliance manager application  46 . The data table  76 , as described below, comprises device identifiers for one or more device(s), such as the IP endpoint(s)  54  connected to the converged IP network  52 , to enable the communications server  44 , via the communications network interface  70 , to communicate with the IP endpoint(s)  54  via and the signal channel media processor  48  and/or the bearer channel media processor  50 . 
     In addition, the user input  66  and the user output  68  of the communications server  44  allow for user input into and output from the communications server  44 . The communication network interface  70  further allows the communications server  44  to communicate with a network, such as the communication network  40  and/or the converged IP network  52 . 
     The communications server  44  is connected to a converged IP network  52  of the customer network  42  via a signal channel media processor  48  and a bearer channel media processor  50  (e.g., an Avaya Prowler™ media processor). The signal channel media processor  48  and the bearer channel media processor  50 , for example, may reside within the communications server and/or may be located remotely from the communications server  44  and provide connections between the communications server  44  and the converged IP network  52  of the customer network  42 . The communications server  44  may manage circuit-switched telecommunications functions as well as IP telecommunications functions (e.g., voice over IP (VoIP)). The communications server  44  manages IP communications functions for at least one IP endpoint  54  via the converged IP network  52 . The IP endpoint  54 , for example, may comprise an IP telephone or the like. The communications server  44 , for example, controls the connection of an IP telecommunication event (e.g., a VoIP call) between an IP endpoint  54  and another communications endpoint  28  (e.g., a telephone) via the signal channel media processor  48  and further controls voice traffic for the connection via the bearer channel media processor  50 . 
     In the embodiment shown in  FIG. 1 , for example, the signal channel media processor  48  comprises four ports: a first control port CP 1 , a second control port CP 2 , a first tunnel port TP 1  and a second tunnel port TP 2 . The control and tunnel ports may be statically or dynamically established for the signal channel media processor  48 . Tunneling comprises temporarily changing the destination of a packet in order to traverse one or more routers that are incapable of routing to the real destination. Although the present embodiment describes the tunneling functionality of the present invention with respect to the signal channel media processor  48 , it may also be implemented with respect to the bearer channel media processor  50  (i.e., the bearer channel media processor  50  may comprise the first and second tunnel ports TP 1  and TP 2 ). 
     The first control port CP 1  is connected to the communications server  44  for communicating with the communications server  44  with respect to controlling IP communications between an IP endpoint  54  and another communications device. The second control port CP 2  is connected to the IP network for controlling the IP communications between the IP endpoint  54  and the other communications device. For example, where the IP endpoint  54  comprises an IP telephone participating in a telephone call, the communications server  44  may determine that the telephone call has gone “on-hook” (i.e., the telephone has been hung up). In this example, the communications server  44  sends a control message to the signal channel media processor  48  via the first control port CP 1 , as known in the art, instructing the signal channel media processor  48  to close a socket being used by the IP telephone for the call. The signal channel media processor  48  then communicates with the converged IP network  52  via the second control port CP 2  to close the socket associated with the call. 
     The first and second tunnel ports TP 1  and TP 2  of the signal channel media processor  48 , however, are used to “tunnel” information between the communications server  44  and an IP endpoint  54  via the converged IP network  52 . Where the communications server  44  or an IP endpoint  54  send information to one of the tunnel ports TP 1  or TP 2 , the signal channel media processor  48  forwards the information to the IP endpoint  54  or the communications server  44 , respectively. Thus, if the signal channel media processor  48  receives information via a control port CP 1  or CP 2 , the signal channel media processor  48  performs as a traditional signal channel media processor, while if the signal channel media processor  48  receives information via a tunnel port TP 1  or TP 2 , the signal channel media processor  48  performs a tunneling function to transmit information between the communications server  44  and an IP endpoint  54 . In this manner, the functionality of the signal channel media processor  48  is determined by the port that an instruction is received at the signal channel media processor  48 . 
     As discussed above, the communications server  44  typically comprises a sensitive component of the customer network  42  (e.g., handles 911 emergency calls) and is isolated from the converged IP network  52  to prevent unauthorized access to the communications server  44 . Thus, for security reasons, the communications server  44  is typically prevented from directly addressing IP endpoints  54  via the converged IP network  52 , and the IP endpoints  54  are also prevented from directly addressing the communications server  44 . The signal channel media processor  48  and the bearer channel media processor  50  serve to isolate the communications server  44  from the converged IP network  52 . 
     The destination of traffic flowing from the communications server  44  to the converged IP network  52  can be controlled to provide security constraints by limiting the devices the communications server  44  (and thus a remote user) can communicate with to specific devices connected to the converged IP network  52 . For example, the signal channel media processor  48  may operate as a “dumb” router that will forward information from the communications server  44  only to an IP address on the converged IP network  52  identified in the tunnel command issued to the signal channel media processor  48  via the first tunnel port TP 1 . Thus, the signal channel media processor  48  will not forward information to a device connected to the converged IP network  52  unless it is associated with a valid IP address for the converged IP network  52 . In one embodiment, a device table  76  (shown in  FIG. 2 ) is maintained on a data storage device  62  of the communications server  44 . The device table, for example, may comprise an IP endpoint identifier (e.g., a telephone number or the like) and a valid IP address for a predetermined number of IP endpoints  54  located on the converged IP network  52 . The device table  76  is maintained on the communications server  44  located on the customer network  42 , which is under control of the customer, and provides a secure list of IP endpoints  54  that may be accessed remotely. As described below, when the appliance manager application  46  receives a request for access to an IP endpoint  54  (e.g., via an IP endpoint identifier), the appliance manager application  46  may determine whether the requested IP endpoint  54  is allowed to be accessed. If the identifier is not listed in the device table  76 , the appliance manager application  46  prevents remote access to the requested device. If the identifier for an IP endpoint  54  is listed in the device table  76 , however, the appliance manager application forwards the request to the IP endpoint  54  via the signal channel media processor  48  and the converged IP network  52 . 
     In another embodiment, the device table  76  may reside in the signal channel media processor  48 , and the signal channel media processor  48  may restrict access in two directions between the communications server  44  and particular IP endpoints  54  on the converged IP network  52  listed in the device table  76 . In the first direction, the signal channel media processor  48  limits communications from the communications server  44  to the IP endpoints  54  listed in the device table  76  by refusing to forward commands received at the first tunnel port TP 1  to the converged IP network  52  unless the destination IP endpoint is listed in the device table  76 . In the second direction the signal channel media processor  48  also limits communications received from the converged IP network  52  to the communications server  44  via the second tunnel port TP 2  to specific devices identified in the device table  76 . In particular, if a message arrives at the second tunnel port TP 2  from the converged IP network  52  and did not originate from an allowable IP endpoint  54 , the signal channel media processor may refuse to forward the message to the communications server  44 . 
       FIG. 3  shows a flow diagram of an embodiment of a method  100  for establishing a remote communication session on a communications server  44  located on a private customer network  42 . In this embodiment, the user initiates a remote access session by accessing a uniform resource locator (URL) (e.g., http://avaya.com/remoteaccess/ipendpoint) via the client application  30  at the remote client  32  in operation  110 . In operation  114 , the method  100  determines whether the client application  30  is installed on the remote client  32 . If the application  30  is not installed on the remote client  32 , the setup instructions and/or the client application  30  are downloaded onto the remote client  32  in operation  118 . If the client application  30  is already installed on the remote client  32  (or after it has been installed on the remote client  32 ), the method proceeds to operation  122 . 
     In operation  122 , the user starts the client application  30  at the remote client  32 . The remote server  34  initiates a remote session (e.g., a web session) with the client application  30  at the remote client  32  via the web application  36  in operation  126 . After the remote session has been started in operation  126 , the web application  36  waits for an input from the client application  30  in operation  130 . Once an input is received from the client application  30 , the web application  36  initiates the server application  38  in operation  134 . The server application  38 , in turn, initiates an IP endpoint manager session on the remote server  34  in operation  138 . 
     In one embodiment of the present invention, a virtual persistent connection is established between the remote client  32  and the remote server  34 . A virtual persistent connection provides a connection that appears to a user that the connection remains connected to an application even though the connection is actually disconnected each time a transaction (e.g., at a web page) is completed. Where the remote client  32  and the remote server  34  are connected over the Internet, for example, the connection  33  between the remote client  32  and the remote server  24  is typically not a persistent connection (i.e., the connection is disconnected each time there is a transaction at a web page). In such a situation, a virtual persistent connection may be established to provide the appearance of a persistent connection between the remote client  32  and the remote server  34 . The web application  36  and/or the server application  38 , for example, may use a common gateway interface (CGI) to maintain a table in which one or more existing virtual persistent connection(s) are stored (e.g., between the remote server and one or more remote client(s)). When the server application  38  is about to transmit information to the client application  30 , the server application  38  consults the table to see if a virtual persistent connection currently exists. If so, the server application  38  establishes a connection transparent to a user at the remote client  32  and transmits the information as if a persistent connection were in place. Then, the managing application closes the connection and waits for the next transmission. 
     In connection with service operations involving an IP endpoint  54 , the user submits an IP endpoint identifier for the IP endpoint  54  and, optionally, one or more command(s) to be performed with respect to the identified IP endpoint  54  in operation  142 . An IP endpoint identifier, for example, may comprise a telephone number assigned to a particular IP endpoint or any other identifier for one or more IP endpoint(s). The optional command, for example, may comprise a command to read information from an IP endpoint, write information to the IP endpoint, reset information on an IP endpoint, ping an IP endpoint or the like. Where a system is limited to a particular command (e.g., read MIB information from an IP endpoint) or group of commands (e.g., read MIB information from an IP endpoint and ping the IP endpoint) and does not enable other commands to be performed, the command field does not have to be included since the same command (or group of commands) will be performed on the IP endpoint for each request. 
     The server application  38  then establishes a connection with the communications server  44  and initiates a logon procedure to the communications server  44  via the remote communications application  45  and the communications network  40  in operation  146 . In an embodiment where the communications network  40  comprises a PSTN, for example, the server application  38  and the remote communications application  45  communicate via a computer telephone integration (CTI) protocol. After the server application  38  has logged on to the communications server  44 , the appliance manager application  46  begins a remote communication session with the client application  30  via the server application  38  in operation  150 . In one embodiment, for example, the appliance manager application  46  initiates the remote session with the client application  30  by opening a window (e.g., a SAT window) on the communications server  44  in operation  154 . 
     Once the remote communication session is opened between the remote client  32  and the communications server  44 , a user at the remote client  32  may access one or more tools for communicating with the customer network  42 . In the embodiment shown in  FIG. 4 , for example, the user may access an IP endpoint  54  located on a converged IP network  52  of the private customer network  42 . In this embodiment, a method  200  is shown for accessing the IP endpoint  54 . 
     In operation  210 , for example, the user selects a tool for accessing an IP endpoint  54  and submits a request for access to an IP endpoint  54  (e.g., read data, write data, reset data, ping an endpoint and the like). This request is forwarded to the server application  38  residing on the remote server  38  and is forwarded by the server application  38  to the appliance manager application  46  in operation  214 . As described above, the request includes an IP endpoint identifier (e.g., a telephone number corresponding to the IP endpoint  54 ). The appliance manager application  46  determines that the request is to access an IP endpoint  54  in operation  218  and proceeds to operation  222 . 
     In operation  222 , the appliance manager application  46  looks up the IP endpoint identifier in a device table  76  (see  FIG. 2 ) to determine the IP address for the IP endpoint  54  on the converged IP network  52 . As described above with reference to  FIG. 1 , if the requested IP endpoint  54  is not listed in the device table  76 , the appliance manager application  46  may determine that the IP endpoint  54  identified in the request is not a valid IP endpoint on the converged IP network  52  or may determine that the IP endpoint is not on a list of remotely accessible IP endpoints and refuse to access the requested IP endpoint. Accordingly, embodiments of the present invention prevent a remote user from accessing any general purpose computing device  26  or other device on the converged IP network  52  that is not an IP endpoint. 
     If the IP endpoint  54  requested to be accessed is listed in the device table  76 , however, the appliance manager application  46  forwards a request to the first tunnel port TP 1  (see  FIG. 1 ) of the signal channel media processor  48  in operation  226 . In one embodiment, for example, the appliance manager application  48  comprises a MIB browser for communicating with an IP endpoint  54  and reading, writing and resetting MIB information located on the IP endpoint  54 . The appliance manager application  48 , for example, may issue a request comprising a simple network management protocol (SNMP) request for querying MIB information in the IP endpoint  54 . The use of SNMP and ICMP protocols between the communications server  44  and the IP endpoint  54  allows for the system  20  to query an IP endpoint at a network management software level, yet does not compromise security on the private customer network  42 , nor does it allow access to network routers, switches and the like. In effect, the system  20  allows commands originating from the remote diagnostic system  24  to be securely “tunneled” through the signal channel media processor  48  (or the bearer channel media processor  50 ) to an IP endpoint  54 . Furthermore, this remote diagnostic capability is provided without compromising the separation between the communications server  44  and the converged IP network  52  that is maintained to prevent tampering with the customer network  42  components or settings. 
     The signal channel media processor  48  receives the request at the first tunnel port TP 1  and recognizes (by the port accessed) that the request is to be tunneled to an IP endpoint  54  located on the converged IP network  52 . The signal channel media processor  48  forwards the request to the IP endpoint  54  at the IP address identified in the request in operation  230 . The IP endpoint receives the request, performs any requested action (e.g., reset MIB information) and, if requested (e.g., read MIB information), forwards a response to the second tunnel port TP 2  of the signal channel media processor  48  in operation  234 . Again, when the response is received at the second tunnel port TP 2 , the signal channel media processor  48  recognizes the request as a response to be forwarded to the communications server  44 . The signal channel media processor  48  then forwards the response to the communications server  44  in operation  238 . When the appliance manager application  46  residing on the communications server  44  receives the response, the appliance manager application  46  forwards the response to the client application  30  via the server application  38  in operation  242 . 
     The method shown in  FIG. 4  provides a user located at the remote client  32  to remotely access an IP endpoint  54  and retrieve information such as MIB information from the IP endpoint  54  attached to a remote private customer network  42 . In this embodiment, the user may retrieve MIB information such as circuit status, endpoint information, forward error correction (FEC) status, error counts, direct memory access (DMA) buffer, DMA error counts, voice/data statistics, active endpoint information, ping, active background ping IP adders, queue read information, current route table, resource reservation protocol (RSVP) statistics, real time conferencing protocol (RTCP) status, hardware components, trace route (IP address), current vintage information and the like. In addition, where the security of the information on the IP endpoints  54  themselves is not an overriding concern, the MIB information may also be set (or reset) in the IP endpoints  54 . In another embodiment, however, the user may be prevented from setting or resetting any MIB information in the IP endpoints  54 . Alternatively, a higher security level or protection may limit the ability to set (or reset) information in the IP endpoints  54  to a select group of users. 
       FIG. 5  shows an embodiment of a method  300  for remotely accessing the signal channel media processor  48  and/or the bearer channel media processor  50  of the private customer network  42 . In this embodiment, for example, the method shows a user accessing a command prompt of the signal channel media processor  48  and/or the bearer channel media processor  50  shown in  FIG. 1 . 
     In operation  310 , a user selects the signal channel media processor  48  and bearer channel media processor  50  command prompt tool from a window on the communications server  44  (see  FIG. 3 ). The server application  38  forwards the request to the appliance manager application  46  in operation  314 . The appliance manager application  46  then determines that the request is to access a command prompt of the signal channel media processor  48  or the bearer channel media processor  50 . In operation  322 , the appliance manager application  46  enables and begins a session (e.g., a Telnet session) to a selected signal channel media processor  48  or bearer channel media processor  50 . After the session (e.g., the Telnet session) is successfully begun, the request from the remote client  32  is then processed by the session initiated in operation  322  in operation  326 . After the request has been processed, the appliance manager application  46  forwards result of the request executed on the signal channel media processor  48  or the bearer channel media processor  50  to the client application  30  via the server application  38 . 
     The method shown in  FIG. 5  provides a user located at the remote client  32  to remotely access a device on a remote private customer network  42 . In one embodiment, for example, a user may remotely access the signal channel media processor  48  and/or the bearer channel media processor  50  command prompt and perform diagnostic functions on the signal channel media processor  48  of a remote private customer network  42 . In this embodiment, for example, the user may initiate signal channel media processor diagnostic commands on the signal channel media processor  48  from the remote client  32 . The user may initiate diagnostic commands, such as show system buffers, display address resolution protocol (ARP) table, flush ARP table, display socket table information, show host table, check stack, get system buffer usage, display network interfaced, main Ethernet interface statistics, display active IP sockets, display IP statistics, point-to-point protocol (PPP) information, PPP statistics, show Internet control message protocol (ICMP) statistics, route show, route statistics, show task regs, task show, transmission control protocol (TCP) statistics, user datagram protocol (UDP) statistics and the like. 
     The foregoing discussion of the invention has been presented for purposes of illustration and description. The foregoing is not intended to limit the invention to the form or forms disclosed herein. In the foregoing Detailed Description for example, various features of the invention are grouped together in one or more embodiments for the purpose of streamlining the disclosure. This method of disclosure is not to be interpreted as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in less than all features of a single foregoing disclosed embodiment. Thus, the following claims are hereby incorporated into this Detailed Description, with each claim standing on its own as a separate preferred embodiment of the invention. 
     Moreover though the description of the invention has included description of one or more embodiments and certain variations and modifications, other variations and modifications are within the scope of the invention, e.g. as may be within the skill and knowledge of those in the art, after understanding the present disclosure. It is intended to obtain rights which include alternative embodiments to the extent permitted, including alternate, interchangeable and/or equivalent structures, functions, ranges or steps to those claimed, whether or not such alternate, interchangeable and/or equivalent structures, functions, ranges or steps are disclosed herein, and without intending to publicly dedicate any patentable subject matter.