AudioCodes mediapack MP-500, User Manual

Page: 457 / 574

Version 5.8 457 October 2009
SIP User's Manual 9. IP Telephony Capabilities
9.2.1.2 VoIP Firewall
The device provides a firewall for VoIP:
„ SIP signaling:
•
Deep and stateful inspection of all SIP signaling packets
•
SIP dialog initiations may be rejected based on values of incoming SIP INVITE
message and other Layer-3 characteristics
•
Packets not belonging to an authorized SIP dialog are discarded
„
RTP:
•
Opening pinholes (ports) in the device's firewall based on Offer-Answer SDP
negotiations
•
Deep packet inspection of all RTP packets
•
Late rouge detection - if a SIP session was gracefully terminated and someone
tries to "ride on it" with rouge traffic from the already terminated RTP and SIP
context, the VoIP Firewall will prevent this from occurring
•
Disconnects call (after user-defined time) if RTP connection is broken
•
Black/White lists for both Layer-3 firewall and SIP classification
9.2.1.3 Topology Hiding
The device supports topology hiding, which limits the amount of topology information
displayed to external parties. For example, IP addresses of ITSPs' equipment (e.g. proxies,
gateways, and application servers) can be hidden from outside parties.
The device's topology hiding is provided by implementing back-to-back user agent (B2BUA)
leg routing:
„ Strips all incoming SIP Via header fields and creates a new Via value for the outgoing
message.
„
Each leg has its own Route/Record Route set
„ Modifies SIP To, From, and Request-URI host names
„ Generates a new SIP Call-ID header value (different between legs)
„ Changes the SIP Contact header to the device's own address
„ Layer-3 topology hiding, by modifying source IP address in the SIP IP header
9.2.1.4 SIP Normalization
The device supports SIP normalization whereby the SBC application can overcome
interoperability problems between SIP user agents. This is achieved by the following:
„ Manipulation of SIP URI user and host parts
„ Connection to ITSP SIP trunks on behalf of an IP-PBX - the device can register and
utilize user and password to authenticate for the IP-PBX