Security & Reliability in VoIP Solution

Security & Reliability in VoIP Solution

July 19th_{, 2006}

• Founder, Ranch Networks

• 20 years experience in the telecom industry

• Part of of architecture team that built the

prestigious IP and ATM switches

• Recipient of the 1998 Bell Laboratories

President’s Gold Award

 Ranch manufactures Network appliances built to

advance VoIP telephony deployments

 The RN series of products provide security,

reliability, and scalability to VoIP applications

 The only PBX controlled VoIP Appliance

 The only integrated Asterisk security solution  Per-call QoS – rate limiting & BW guarantee  Protocol and Encryption independence

 Scales PBX to handle a lot more calls

• Ranch agent code is integrated into

Asterisk

• VoIP appliances that enable service

providers to secure, scale and

provide reliable VoIP

– RN300

– RN20L

– RN20

– RN40

– RN41

• Seamless Connectivity

 Call should succeed irrespective of the locations of caller & called party

• High Call Quality

 No Voice Clipping & call drops

• Security

 Prevent attacks on PBX, phones and the rest of the network  Prevent Eavesdropping of VoIP signaling / media

• High Availability

 Minimal interruption or downtime

• Scalability

 Dynamically increase capacity with minimal impact

Enterprise Challenges



VoIP Security & Data Security



Call Quality & Data Traffic



Scalability

• Educating COIs/CTOs - security threats are real • Picking the appropriate security appliances

– Future proofing (encryption, protocol changes) – Security enforcement methodologies

• Traditional firewalls • SIP firewalls

• SBCs

• PBX controlled appliances

– VoIP & data traffic on the same physical cable – Preventing voice quality/call drops due to

viruses/worms

• Eaves dropping

– Media (Sensitive Information Revelation) – Signaling (Identity Revelation)

• Man in the middle attack

• Denial of Service attack

• Limitations of traditional firewalls

• Non-awareness of above issues

• Robustness

• Scalability

• Future Proof

• Easily Manageable

• Agnostic to Vendor/Protocol revisions

• Reliability

• Traditional Firewalls

• VoIP Protocol aware firewalls

• Session Border Controllers

• PBX Controlled appliances

• Security appliance MUST be able to

segregate & prioritize voice/data traffic

• ALL access to IP PBX MUST go through the security appliance

• Security appliance MUST raise alerts for ANY unauthorized access

• Security appliance MUST have the ability to mirror traffic to an IDS system

• Look for the solutions being promoted by the IP PBX vendor

• Allocate guaranteed BW for VoIP traffic

• Choose the solution(s) that meet the

objectives

• Use VPN for encrypting VoIP traffic

• Educate the Network Admins on VoIP

security

SIP issues in a Typical Deployment

*

Connectivity Issue: SIP is NAT unfriendly Security Issue: Media is firewall unfriendly Quality Issue: Bandwidth contention with data

SIP Phone A

Ranch – Asterisk solution

Internet

 Call Setup: SIP Invite & Authenticate

 Forward invite, Receive 200 OK and finish call setup

 Asterisk (NetSec) applies real-time POLICIES to RN:  _{Security policies – what “pin holes” to open}  NAT policies – how to provide NAT

 Bandwidth policies – what “Pipe width” to use  _{Bridging policies – how to “connect” the phones}

 Call in progress.

 Default: SIP allow with rate limit & RTP deny



NetSec

PSTN

1+1 High Availability (HA)

Internet

 _{Single public IP address for Asterisk servers}  _{SIP based health check will initiate switchover}

Central Office Single Public IP Branch RN20 Firewall

 _{ALL SIP messages forwarded to current Active PBX}  _{Switchover does not terminate current conversations}

Internet Asterisk PSTN Asterisk

*

*

• RN20 initiates the Asterisk fail over within the service provider network

• Single IP public address for Asterisk servers in service provider network

• RN300 initiates the fail over from service provider to local Asterisk

• Local Asterisk provides local PSTN backup

Hosted PBX with local fail over to PSTN

PSTN

*

Clustering

 _{Allows one or more Asterisk IP PBXs to be grouped (Cluster) as a single}

IP PBX

 _{Cluster visible to the user as a single public IP and PBX have private IPs}  _{A PBX can be added or removed from a cluster at any time}

 _{When a PBX is removed from the cluster current active calls should not}

be dropped, at a minimum conversations should go on

 _{Health checks determine if a PBX should handle new calls}  _{New calls should be sent to a PBX if-and-only-if}

 _{PBX is accessible (ex: SIP based pings)}

 _{PBX has access to critical resources such as an data base, external auth server}

such as RADIUS/LDAP

*

*

*

*

Low Cost Large Scale PBX Solution

Registrars-A

Heartbeat

Redundant, Carrier Class

Large Scale PBX Clusters

Low cost Asterisk Proxies

Gigabit interfaces

SIP based health check

*

*

*

*

*

*

 _{Highly scalable solution}

 _{SIP based health check determines if an Asterisk within a cluster is active or not}  _{Each Asterisk cluster is accessible using single public IP address}

 _{Supports multiple Asterisk clusters}

 Making a server inactive server does not terminate current conversations

 _{Each registrar and proxy cluster share a single public IP}

Ranch RN40

Proxies-A Proxies-B

*

*