Version 7.2 175 Mediant 500L Gateway & E-SBC
User's Manual 13. Security
Parameter
Firewall Rule
1 2 3 4 5
Burst Bytes
0 0 50000 50000 0
Action Upon Match
Allow Allow Allow Allow Block
The firewall rules in the above configuration example do the following:
Rules 1 and 2: Typical firewall rules that allow packets ONLY from specified IP
addresses (e.g., proxy servers). Note that the prefix length is configured.
Rule 3: A more "advanced” firewall rule - bandwidth rule for ICMP, which allows a
maximum bandwidth of 40,000 bytes/sec with an additional allowance of 50,000 bytes.
If, for example, the actual traffic rate is 45,000 bytes/sec, then this allowance would be
consumed within 10 seconds, after which all traffic exceeding the allocated 40,000
bytes/sec is dropped. If the actual traffic rate then slowed to 30,000 bytes/sec, the
allowance would be replenished within 5 seconds.
Rule 4: Allows traffic from the LAN voice interface and limits bandwidth.
Rule 5: Blocks all other traffic.
13.2 Configuring TLS for SIP
The device uses TLS over TCP to encrypt and optionally, authenticate SIP messages. This
is referred to as Secure SIP (SIPS). SIPS uses the X.509 certificate exchange process, as
described in ''Configuring SSL/TLS Certificates'' on page 113, where you need to configure
certificates (TLS Context).
Note: When a TLS connection with the device is initiated by a SIP client, the device
also responds using TLS, regardless of whether or not TLS was configured.
To configure SIPS:
1. Configure a TLS Context as required (see ''Configuring TLS Certificate Contexts'' on
page 113).
2. Assign the TLS Context to a Proxy Set or SIP Interface (see ''Configuring Proxy Sets''
on page 378 and ''Configuring SIP Interfaces'' on page 355, respectively).
3. Configure a SIP Interface with a TLS port number.
4. Configure various SIPS parameters in the Security Settings page (Setup menu > IP
Network tab > Security folder > Security Settings).
For a description of the TLS parameters, see ''TLS Parameters'' on page 1045.
5. By default, the device initiates a TLS connection only for the next network hop. To
enable TLS all the way to the destination (over multiple hops), configure the 'Enable
SIPS' (EnableSIPS) parameter to Enable on the Transport Settings page (Setup
menu > Signaling & Media tab > SIP Definitions folder > Transport Settings):
Figure 13-2: Enabling SIPS
To Next Page
Loading...
