VoIP technology employs several network protocols such as MGCP, SDP, H323, SIP.

Transcription

1 1 VoIP support configuration First used in the mid-1990s, VoIP is an emerging technology for telephone calls and other data transfer. The concept is relatively simple: Use the multiple networks that comprise the Internet to carry telephone calls. These networks already route data into homes and businesses , web page graphics, documents. By converting voice sounds into bits of data, VoIP is a logical extension of this capacity. Internet protocol calls (VoIP) originate on any broadband line: coaxial cable, DSL, wireless or even satellite. The call is routed to the VoIP company, where a computer converts the sound into data packets similar to the packets used to transfer Internet data such as . Sending data by packets is far more efficient as it enables the same line to handle more information simultaneously. These data packets are sent through any of the Internet's multiple networks to a recipient of the call. The caller can receive the call via a wireless provider, a broadband provider, or a local phone carrier. VoIP technology employs several network protocols such as MGCP, SDP, H323,. This document is oriented to (Session Initiation Protocol ). One of the main reasons for is the widely availability of the based VoIP PBX. 1.1 What is? - Session Initiation Protocol () is a application layer control simple signaling protocol for VoIP implementations using the Redirect Mode. is used to establish and terminate the connection between the IP Phone, the IP PBX and another IP Phone.

2 1.2 How does it work? To initiate the connection ( between phone A and phone B): 1. the phone A sends the request to the VoIP PBX (1) 2. the VoIP PBX contacts the phone B (2) 3. the VoIP PBX sends information ( about phone B ) to the phone A(3) 4. the phone A establishes the connection to the phone B and control is turned to RTP protocol (4) (3) (2) (3) (1) (4) (4) INTERNET Phone A Phone B What is wrong with this picture? There is no networks security in this case, so usually the phones are located behind the firewall. However even behind the traditional firewall there is no real protection. In order to provide VoIP communication several ports should be opened on the firewall. The first problem is that those ports should be opened permanently, the second problem is that those ports should be opened for everybody. This happens because the firewall has no knowledge from where the VoIP call will come and when it will be terminated.

3 So obviously even with the traditional firewall the IP phones (and network where the Phones located) are unprotected. How Ranch Networks will secure the VoIP communication? The Ranch Networks security device will work in one team with the PBX to provide the access to the resources precisely when it needed. The protocol is used to provide the communication between VoIP PBX and RN (Ranch Networks) security device. The next picture shows the integration between Asterisk ( VoIP PBX ) and RN device Asterisk VoIP PBX * engine engine RN device The Asterisk and RN device integration allows implementing the security-on-demand technology for VoIP. Now, the Asterisk ( VoIP PBX) has ability to tell the RN device what firewall rules should be created for each call that is going through the RN device. It means that the each call is handled dynamically - the firewall rules (that allow the voice traffic) are created as needed and deleted when the call is finished. The Asterisk RN integration brings to the new VoIP world the good old ideas of the minimal configuration and least privileges. As the result of this VoIP traffic is allowed only when it is needed and where it is needed.

4 How does the security on-demand work? The next picture shows the Far-End Scenario INTERNET RN device Asterisk Phone B Phone A 1 INVITE phone B FarEnd IP phone A? * RN 2 3 FarEnd IP for phone A INVITE phone B 4 5 OK from phone B FarEnd IP phone B? 6 7 FarEnd IP for phone B OK to phone A 8 9 ACK to phone B Request to bridge FarEnd IP A and FarEnd IP B on RN device 10 RTP 11 RTP traffic 11 RTP The bridge on RN for RTP traffic RTP 11 RTP traffic 11 RTP 12 BYE from phone A Delete RTP bridge 13 As it shown on the picture the RN device working with Asterisk VoIP PBX creates and deletes firewall rules. Also by creating the RTP bridge inside itself the RN device offloads VoIP PBX so PBX can handle more calls.

5 1.3 The example of the RN device and Asterisk ( VoIP PBX) configuration The next figure shows the topology that will be used for this example Subnet /24 Asterisk RN device management interface IP Address * Zone DMZ RN device Phone A Phone B Zone LAN Subnet /24 Zone WAN

6 1.4 RN device configuration This example assumes that the RN device is already configured with the three secure zones: LAN, WAN, DMZ with the IP parameters shown on the figure above. Step 1 Configure the firewall rules for the zones WAN and LAN. Both zones are supposed to have the rule that opens the port 5060 for UDP traffic (for the signaling) and the rule that denies all other traffic. For example for the zone LAN : the rule for the port 5060

7 For example for the zone LAN : the rule to deny the rest of the traffic

8 The summary screen for the secure zone LAN The similar configuration should be done also for the secure zone WAN Step 2 Configure the Virtual IP Address that will be used for the VoIP communication Go to Load Balancing->Switching Configuration->Virtual IP Configuration

9 Step 3 Enabling the zones for the VoIP traffic Go to Firewall Configuration-> Configuration Enable the secure zones LAN and WAN for the VoIP Check One NAT for All IP Addresses option Enter ( configured as virtual IP) at the NAT IP Address field Press Add NAT Range button At this point the RN device is ready to handle the VoIP traffic and interact with the VoIP PBX ( Asterisk) through the interface.

10