Mitel MIVOICE OFFICE 250, Installation And Administration Manual

Page: 455 / 585

Network IP Topology
427
Public (Untrusted) Networks
The private networking scenarios discussed in “Private (Trusted) Networks” on page 1-425 impose
very few restrictions on the topology of the IP telephony equipment because there are no security
barriers between devices. However, one of the major benefits of IP telephony is the ability to leverage
the existence of large public IP networks (for example, the Internet) to extend the communication
network. Using public (untrusted) networks requires security measures to protect the private (trusted)
network. This protection is usually provided through a firewall. Unfortunately, the functionality
provided by a firewall impedes the communications necessary for IP telephony.
To use the public network in safe manner, it is necessary to provide some protection while allowing
the necessary communications. In network terminology, this is usually configured using a topology
known as a DMZ (DeMilitarized Zone)
1
. Devices in a DMZ network are accessible from the Internet
in very specific ways according to the source and destination addresses and the applications that
they support. However, the devices in the DMZ have very limited access into the private LAN to
protect it should these devices be compromised. Devices in a DMZ network generally include web
servers, mail servers, etc.
In some environments, DMZs are implemented in what is referred to as a two-tier architecture using
two firewalls as shown in the following example. In this environment, the DMZ is between the inside
trusted network and the outside untrusted network. The security issues are still the same, but the
configuration is split between the two firewalls.
1. Many home router/firewalls (for example Linksys
®
) inaccurately use the term DMZ to describe some -
thing else: a internal host accessible at a public address. This appendix uses the term DMZ as described in
“Terminology” on page 1-418 .