Nortel SMC 2450, Implementation Manual

Page: 38 / 262

Page 38 of 260 Description
553-3001-225 Standard 1.00 May 2006
State synchronization
To allow for faster connection re-establishment during a failover, the Secure
UNIStim proxy master key is synchronized across both SMCs in the HA
configuration. Master keys are also persistently stored on disk.
Traffic protection
The SMZ provides stateful filtering and Denial of Service (DoS) attack
protection on all packets that flow through it.
Stateful filtering
A stateful filter protects services running in the SMZ by using automatically
generated access control lists and filtering policies. Administrators can
customize these lists to handle all traffic that originates or terminates on the
multimedia devices.
Stateful filtering is more secure than a simple packet filtering in that stateful
filtering keeps track of the protocol’s state in every session, thus ensuring that
the stateful filtering device can:
• differentiate between a UNIStim IP phone and server in a conversation
• detect the direction of traffic
• detect non-compliant state changes
DoS attack protection
An embedded DoS Defense Engine protects against common DoS and
Distributed DoS (DDoS) attacks. The SMC provides flow control and
rate-limiting features, which are tied to stateful filtering policies.
Rate limiting
You can use rate limiting to protect services in the multimedia zone (MMZ)
by bounding the number of connections, bytes, or packets per second in each
signaling channel (such as for UNIStim, H.323, and SIP).