EGISTECH

How to Protect IPT Network

• Use private IP to hide IP-PBX and Separate Voice network and Data networks by VLAN.
  Most of enterprises use same networks for voice and data. But it causes QoS problem and Eavesdropping. Although it is the safest to configure voice and data network respectively, it can cause to raise cost in IP network. Therefore, two networks should be separated logically by using VLAN, it is the most efficient measure to operate VoIP safely.
• Strengthen user authentication and access control.
  Sometimes the system managers overlook changing the default password and configure ACL for access to system, moreover the extensions have no password or consist of extension number plus a certain code to remember easily. By making using of hacking tool, this easy password will be cracked with little effort.
• Use TLS/SRTP to protect eavesdropping.
  The only way to avoid eavesdropping is to encrypt Signal Message and RTP by TLS(Transport Layer Security)/SRTP(SecureRTP). Especially it is required in the field of government and Military.
• Install VoIP Firewall certified by CC(Common Criteria) certified by ITCC.
  Vulnerabilities of internet is likely to occur in VoIP networks. In order to secure VoIP Infra, VoIP firewall should be installed and open or close port pinholes dynamically by analyzing SIP messages and detect and block VoIP attacks.

What is the benefit of VoIP Firewall?

When introducing VoIP into your network. It is inevitable to consider how to connect your network and how to secure your network from VoIP Cyber Threats. VoIP firewall absolutely meets the requirements that is suggested by Cyber Security Authorities in Korea

SIP Connectivity

VoIP Firewall should resolve networking and NAT related issues and interconnect SIP compatibility for SIPtrunking.

Cyber Security

VoIP Firewall should inspect SIP protocol, sessions and prevent denial of Service attack, toll fraud attacks.

What is different from each other?

This table shows you the reason why you choose VoIP Firewall.
As it has shown, Data F/W is useless to protect your IPT, as Data Firewall has no ability to parse SIP messages.
SBC has just limited security functions, most of SBC of vendors work security functions based on rate limit of SIP packet, and so these are not enough to detect the professional hacking attacks like a International Revenue Sharing Fraud.

What does SentryAll provide?

How does SentryAll detect VoIP Attacks?

This chart explains SentryAll security engine, when packets flow into SentryAll, Every packets goes through security engine, Just normal messages can go to next steps.
Most of VoIP Firewall and SBC have similar functions from Step 1 to Step 4, While Step 5 and Step 6 are unique functions, SentryAll looks up IP address in the Register messages and deny messages from the prohibited countries, examines signatures in the SIP message, ie, USER-Domain.

• STEP1
  • L3/L4 layer firewall function( 5-tuple base)
  • Black List, White List
  • Priority access
• STEP2
  • Network packet : Block DoS/DDOS attack
• STEP3
  • SIP MESSAGE : SIP Interface ACL
  • Rate Control
  • Bandwidth Control
• STEP4
  • SIP MESSAGE block(pre-set)
  • Block Abnormal SIP MESSAGE(Parsing error, out of range/value)
  • SIP MESSAGE ACL(Pass/Screen Specific Prefix number)
  • Block SIP MESSAGE DOS/DDOS attack
• STEP5
  • Block register messages from prohibited countries
  • Block mismatched DOMAIN in register messages
  • Block mismatched USER-AGENT in register messages
  • Pass/Drop specific prefix calls
  • Block Auth-failed USER continuously
• STEP6
  • SPAM Filter
  • Gap calls
  • Limit call attempts
  • Limit maximum number of accumulated calls
  • Static / Dynamic international call limitation
  • liSystem Capacity : CPU/Concurrent SESSION / MAX CALL

How to install SABER for Your IPT?

This diagram shows how the SentryAll should be implemented in order to secure IPT from VoIP Cyber threats.

This is the most common scenario for All SIP network, SentryAll is doing main 2 features, Session Border Controller and VoIP Security In the past, IP administrators used to install NAT/Firewall for secure the IPT, and they believe the firewall would protect the VoIP Attacks But it would fail to detect VoIP Attacks, because most of firewall has no feature to handle SIP messages to attain RTP port info. for communication. So it should open all UDP port, and it causes to be victims of VoIP Cyber criminal.
Data Firewall may be optional but when you want to install it in front of SentryAll, you should set IPS mode and turn off SIP ALG feature.

Back to this diagram, SentryAll should have public IP address and role as Session Border Controller that enables to solve NAT Traversal issue and manipulates SIP messages for interworking with Telco, sometimes IP-PBX doesn’t meet SIP requirement of Telco.
SentryAll has many references for interworking with Global IP-PBX vendors, Cisco, Avaya, Nortel, SAMSUNG, ERICSSON, Asterisk.

It would scan all SIP messages with its own security algorithm at the same time.
As for the redundancy, it provides switchover for the seamless service when active system doesn’t work normally based on periodic health check.