Call Manager Secure Subnet

[AJ1982]

Good Afternoon All,

Our test lab has its own low end Call Manager server, it is planned that in the next few months the test environment will have increased usage inclusive of the Call Manager server.

What would the implications be of placing the CCM server into its own secure subnet and only allowing a specific set pof ports (Remote Admin, VoIP) into it. The CCM server is standalone, is not connected to a PSTN and is only for a test usage.

Main reason for idea is to block out RPC ports to prevent RPC vunerability attacks. My understanding is that a CCM server cannot be patched as MS patches are released, so I am concerned about vunerabilities. The subnet its currently resides on hosts some MS ActiveDir services, so blocking out RPC ports would not be an option. So give its own subnet where it can be done

Any ideas greatly appreciated, including how you guys roll out your CCM environment.

Thanks

AJ

===

Fatman Superstar (Andrew James)

CCNA,
(CCNA Cisco Academy Instructor Trained)

 

[lui3]

Normally in most deployments that i have seen, which are a few at this time,
people normally place the CCM in its own vlan. The phones in one the ccm in another with no other servers other than other ccms or unity or call related stuff. then they use private vlans to limit the servers access to each other within the vlan. essentially the private vlans are vlans inside of vlans. but they enable you to limit a server to accessing only its default gateway and the port it is connected to. that way even if all the servers are in a common vlan they have to reach each other by passing through a router first and then being subject to access lists. rpc broadcast messages will never reach them in this fashion.

what you are proposing is a good design. i would just add the private vlan feature limiting access to the gateway and access port only.

 

[AJ1982]

Thanks for the info, I was sure this was what was practiced in industry but just wanted to make sure.

Thanks

AJ

===

Fatman Superstar (Andrew James)

CCNA,
(CCNA Cisco Academy Instructor Trained)