Mitel Inter-Tel 5000, Installation And Maintenance Manual

Page: 407 / 468

Appendix B: Network IP Topology
Public (Untrusted) Networks
Inter-Tel
®
5000 Installation Manual – Issue 2.4, May 2008
Page B-9
Public (Untrusted) Networks
The private networking scenarios discussed in “Private (Trusted) Networks” on page B-7
impose very few restrictions on the topology of the IP telephony equipment because there are
no security barriers between devices. However, one of the major benefits of IP telephony is the
ability to leverage the existence of large public IP networks (for example, the Internet) to extend
the communication network. Using public (untrusted) networks requires security measures to
protect the private (trusted) network. This protection is usually provided through a firewall.
Unfortunately, the functionality provided by a firewall impedes the communications necessary
for IP telephony.
To use the public network in safe manner, it is necessary to provide some protection while
allowing the necessary communications. In network terminology, this is usually configured using
a topology known as a DMZ (DeMilitarized Zone)
1
. Devices in a DMZ network are accessible
from the Internet in very specific ways according to the source and destination addresses and
the applications that they support. However, the devices in the DMZ have very limited access
into the private LAN to protect it should these devices be compromised. Devices in a DMZ
network generally include web servers, mail servers, etc.
1. Many home router/firewalls (for example Linksys
®
) inaccurately use the term DMZ to describe
something else: a internal host accessible at a public address. This appendix uses the term DMZ as
described in “Terminology” on
page B-2 .
Internet
(Untrusted )
Private Network
(Trusted)
DMZ
Network
Communication
from the Internet to
the Private network
is blocked unless it
was initiated from
an internal party (a
response)
Communication from the
Internet to the DMZ is
limited to specific sources,
destinations, and
applications (ports)
Communication from the
DMZ to the internal
network is limited to
specific sources,
destinations, and
applications (ports)