AudioCodes Mediant 500 MSBR, Руководство пользователя, Страница: 155 / 1248

Version 7.2 155 Mediant 500 MSBR
User's Manual 16. Security
16 Security
This section describes the VoIP security-related configuration.
16.1 Configuring TLS for SIP
The device uses TLS over TCP to encrypt and optionally, authenticate SIP messages. This
is referred to as Secure SIP (SIPS). SIPS uses the X.509 certificate exchange process, as
described in Configuring SSL/TLS Certificates on page 117, where you need to configure
certificates (TLS Context).
Note: When a TLS connection with the device is initiated by a SIP client, the device
also responds using TLS, regardless of whether or not TLS was configured.

To configure SIPS:
1. Configure a TLS Context as required (see Configuring TLS Certificate Contexts on
page 117).
2. Assign the TLS Context to a Proxy Set or SIP Interface (see Configuring Proxy Sets
on page 348 and Configuring SIP Interfaces on page 325, respectively).
3. Configure a SIP Interface with a TLS port number.
4. Configure various SIPS parameters in the Security Settings page ( Setup menu > IP
Network tab > Security folder > Security Settings ).
For a description of the TLS parameters, see TLS Parameters on page 1024.
5. By default, the device initiates a TLS connection only for the next network hop. To
enable TLS all the way to the destination (
over multiple hops ), configure the 'Enable
SIPS' (EnableSIPS) parameter to Enable on the Transport Settings page ( Setup
menu > Signaling & Media tab > SIP Definitions folder > Transport Settings ):
Figure 16-1: Enabling SIPS
16.2 Intrusion Detection System
The device's Intrusion Detection System (IDS) feature detects malicious attacks on the
device and reacts accordingly. A remote host is considered malicious if it has reached or
exceeded a user-defined threshold (counter) of specified malicious attacks.
If malicious activity is detected, the device can do the following:

Block (blacklist) remote hosts (IP addresses / ports) considered by the device as
malicious. The device automatically blacklists the malicious source for a user-defined
period after which it is removed from the blacklist.

Send SNMP traps to notify of malicious activity and/or whether an attacker has been
added to or removed from the blacklist. For more information, see Viewing IDS Alarms
on page 162.
The Intrusion Detection System (IDS) is an important feature for Enterprises to ensure
legitimate calls are not being adversely affected by attacks and to prevent Theft of Service
and unauthorized access.
There are many types of malicious attacks, the most common being: