RedMax EXtreme EX-LRT Anleitung zur Fehlerbehebung PDF herunterladen (Seite 121)

Oracle SBC Security Guide

To simplify the use of this BCP, no other elements are configured in this case, so no redundancy or DDoS

prevention are configured in the configurations exposed. The configurations follow the guides of BCP for

access (using policy based realm bridging) and peering scenarios. For TLS, it is assumed single-side

authentication in all cases.

The configurations presented use SDES mechanism for SRTP encryption. If MIKEY is desired, the

configurations presented still apply, only the mikey-profile should apply instead of the sdes-profile for the

configuration, however consider that SDES-MIKEY interworking is currently not supported. No SRTP

pass-through cases are presented here, as there is nothing required for the SBC to be transparent to the

SRTP negotiation end-to-end.

Single-Ended SRTP Termination on secured networks.

This is the typical access scenario where SRTP is deployed completely in the access network, allowing

the users to use TLS for SIP and SRTP for media. In the core network, UDP is used for SIP and RTP is

used for media.

The IP used for SIP and SRTP in the SBC in the access network is 172.18.1.71, and the IP used for SIP

and RTP in the core network is 172.18.2.71. The SIP Registrar/Proxy in the core network is in

172.18.2.100.

In this case, secured-network is set to DISABLED under the access sip-interface and ENABLED on the

core sip-interface. Two security-policies are configured, one for SRTP and one that creates the exception

for SIP signaling. Also, two media-sec-policies are created, one in the access network with mode=SRTP

and one in the core with mode=RTP.

RTP and Single-Ended SRTP Termination on unsecured networks.

This is a very common architecture, where both RTP and SRTP endpoints reside in the access network,

especially while in transition from RTP to SRTP. This means that both UDP/RTP and TLS/SRTP can be

present in the access network. In the core network, UDP for SIP and RTP for media will be used.

In this case, in the access network we will use 172.18.1.71 for SIP traffic (UDP and TLS) and also for

RTP traffic. 172.18.1.72 will be used for SRTP traffic. In the core network, 172.18.2.71 will be used for

SIP and RTP. The SIP Proxy/Registrar uses 172.18.2.100.

1 2 ... 116 117 118 119 120 121 122 123 124 125 126 ... 141 142

Keine Kommentare

RedMax EXtreme EX-LRT Anleitung zur Fehlerbehebung Seite 121