User's Manual
13. Security
Version 6.8
141
Mediant 500 E-SBC
13
Security
This section describes the VoIP security-related configuration.
13.1 Configuring Firewall Settings
The Firewall Settings table lets you configure the device's Firewall, which defines network
traffic filtering rules (
access list
). You can add up to 50 firewall rules. The access list offers
the following firewall possibilities:
Block traffic from known malicious sources
Allow traffic only from known "friendly" sources, and block all other traffic
Mix allowed and blocked network sources
Limit traffic to a user-defined rate (blocking the excess)
Limit traffic to specific protocols, and specific port ranges on the device
For each packet received on the network interface, the table is scanned from top to bottom
until the first matching rule is found. This rule can either permit (
allow
) or deny (
block
) the
packet. Once a rule in the table is located, subsequent rules further down the table are
ignored. If the end of the table is reached without a match, the packet is accepted.
Notes:
•
This firewall applies to a very low-level network layer and overrides all your other
security-related configuration. Thus, if you have configured higher-level security
features (e.g., on the Application level), you must also configure firewall rules to
permit this necessary traffic. For example, if you have configured IP addresses to
access the Web and Telnet interfaces in the Web Access List (see ''Configuring
Web and Telnet Access List'' on page
), you must configure a firewall rule that
permits traffic from these IP addresses.
•
Only Security Administrator users or Master users can configure firewall rules.
•
Setting the 'Prefix Length' field to
0
means that the rule applies to
all
packets,
regardless of the defined IP address in the 'Source IP' field. Thus, it is highly
recommended to set this parameter to a value other than 0.
•
It is recommended to add a rule at the end of your table that blocks all traffic and
to add firewall rules above it that allow required traffic (with bandwidth limitations).
To block all traffic, use the following firewall rule:
√
Source IP: 0.0.0.0
√
Prefix Length: 0 (i.e., rule matches all IP addresses)
√
Start Port - End Port: 0-65535
√
Protocol:
Any
√
Action Upon Match:
Block
.
•
If you are using the High Availability feature and you have configured "block" rules,
ensure that you also add "allow" rules for HA traffic. For more information, see
Configuring Firewall Allowed Rules on page
Summary of Contents for Mediant 500 E-SBC
Page 2: ......
Page 16: ...User s Manual 16 Document LTRT 10437 Mediant 500 E SBC This page is intentionally left blank...
Page 22: ...User s Manual 22 Document LTRT 10437 Mediant 500 E SBC This page is intentionally left blank...
Page 23: ...Part I Getting Started with Initial Connectivity...
Page 24: ......
Page 26: ...User s Manual 26 Document LTRT 10437 Mediant 500 E SBC This page is intentionally left blank...
Page 28: ...User s Manual 28 Document LTRT 10437 Mediant 500 E SBC This page is intentionally left blank...
Page 33: ...Part II Management Tools...
Page 34: ......
Page 36: ...User s Manual 36 Document LTRT 10437 Mediant 500 E SBC This page is intentionally left blank...
Page 64: ...User s Manual 64 Document LTRT 10437 Mediant 500 E SBC This page is intentionally left blank...
Page 82: ...User s Manual 82 Document LTRT 10437 Mediant 500 E SBC This page is intentionally left blank...
Page 89: ...Part III General System Settings...
Page 90: ......
Page 106: ...User s Manual 106 Document LTRT 10437 Mediant 500 E SBC This page is intentionally left blank...
Page 107: ...Part IV General VoIP Configuration...
Page 108: ......
Page 238: ...User s Manual 238 Document LTRT 10437 Mediant 500 E SBC This page is intentionally left blank...
Page 250: ...User s Manual 250 Document LTRT 10437 Mediant 500 E SBC This page is intentionally left blank...
Page 280: ...User s Manual 280 Document LTRT 10437 Mediant 500 E SBC This page is intentionally left blank...
Page 329: ...Part V Gateway Application...
Page 330: ......
Page 332: ...User s Manual 332 Document LTRT 10437 Mediant 500 E SBC This page is intentionally left blank...
Page 352: ...User s Manual 352 Document LTRT 10437 Mediant 500 E SBC This page is intentionally left blank...
Page 412: ...User s Manual 412 Document LTRT 10437 Mediant 500 E SBC This page is intentionally left blank...
Page 441: ...Part VI Session Border Controller Application...
Page 442: ......
Page 489: ...User s Manual 28 SBC Configuration Version 6 8 489 Mediant 500 E SBC...
Page 510: ...User s Manual 510 Document LTRT 10437 Mediant 500 E SBC This page is intentionally left blank...
Page 511: ...Part VII Cloud Resilience Package...
Page 512: ......
Page 521: ...Part VIII High Availability System...
Page 522: ......
Page 536: ...User s Manual 536 Document LTRT 10437 Mediant 500 E SBC This page is intentionally left blank...
Page 537: ...Part IX Maintenance...
Page 538: ......
Page 544: ...User s Manual 544 Document LTRT 10437 Mediant 500 E SBC This page is intentionally left blank...
Page 546: ...User s Manual 546 Document LTRT 10437 Mediant 500 E SBC This page is intentionally left blank...
Page 548: ...User s Manual 548 Document LTRT 10437 Mediant 500 E SBC This page is intentionally left blank...
Page 582: ...User s Manual 582 Document LTRT 10437 Mediant 500 E SBC This page is intentionally left blank...
Page 600: ...User s Manual 600 Document LTRT 10437 Mediant 500 E SBC This page is intentionally left blank...
Page 602: ...User s Manual 602 Document LTRT 10437 Mediant 500 E SBC This page is intentionally left blank...
Page 603: ...Part X Status Performance Monitoring and Reporting...
Page 604: ......
Page 654: ...User s Manual 654 Document LTRT 10437 Mediant 500 E SBC This page is intentionally left blank...
Page 655: ...Part XI Diagnostics...
Page 656: ......
Page 672: ...User s Manual 672 Document LTRT 10437 Mediant 500 E SBC This page is intentionally left blank...
Page 687: ...Part XII Appendix...
Page 688: ......
Page 914: ...User s Manual 914 Document LTRT 10437 Mediant 500 E SBC This page is intentionally left blank...