IP Office Secure Connection 1

[RW111]

Just wondering how far you guys go to make IPO secure for administration, SIP trunk & SIP/h323 endpoint registration.

Is any one using certificates and if so can anyone explain step by step as to how use them on IPO?

As far as I can see, a certificate identifies the system to a connecting client device ( usually manager running on a PC ) and if its is a trusted certificate registered with a Certificate Authority both a public and private key are used to encrypt/decrypt data between system and pc.

Can I generate a certificate just for my maintained systems and add this certificate to all our engineers PC's so only they connect?

Can I make it so that unless you have a certificate installed you cannot administer the system?

Do I need a separate certificate for every system or could I have one master one used for all systems?

Do we need pay a CA for a certificate so as to have an exchange of public / private key?

Any disadvantages with certificates? ( apologies if the above sounds stupid, but not worked with certificates before )

With SIP endpoints, what methods have you used to stop hackers registering ( hacking passwords ). Ideally we would like to open up the firewall to allow any device ( hardphone / softphone ) to register but not simply rely on user/passwords. With other systems we can tie this down to MAC address?

Any advice would be great.

Thanks

 

[cruzades]

IMHO, I think security relies on your VPN, not with your IPO, it's up to you whether you want your VPN a super secure or not.

 

[RW111]

Thanks for the reply, however I think there are more options than just VPN.We are maintain 100's of IP and would be interested on hearing a few different ideas on the above matters. but once again thanks for replying

 

[tlpeter]

With SIP endpoints, what methods have you used to stop hackers registering ( hacking passwords ). Ideally we would like to open up the firewall to allow any device ( hardphone / softphone ) to register but not simply rely on user/passwords. With other systems we can tie this down to MAC address?

You should not do this at all!!!

Also you do not put an IPO on the public internet, it is not done and asking for problems.
In the bad

http://WWW world

there are guys and girsl who hack in to it because they make money with it.
You will not believe how fast this will happen.

Do not try to invent the wheel again and go for rock solid solutions that are already available.



BAZINGA!

I'm not insane, my mother had me tested!

 

[RW111]

Thanks for the input and I am well aware of the dangers of opening up Firewalls for SIP registration etc, which is why im after any recommendations on providing a flexible secure solution for users with lots of different types of endpoint hardware/software. When you refer "to rock solid solutions" I'm guessing that you are also referring to VPN.
Cheers

 

[tlpeter]

Indeed VPN is what i mean.
If a client wants to use SIP phones then you do not want the IPO on the internet.
Then probably a SBC is required for this.
The SBC should be able to black attacks so it will become more save for SIP extensions on the internet.


BAZINGA!

I'm not insane, my mother had me tested!

 

[IPGuru]

TLPeter is correct.

Wherever possible go for a VPN
Nat traversal for remote handsets is possible but should only be considered for occasional users (regular users are going to need a VPN for their computer anyway so it is sensible to have a secure one!)

these users can be tied down by MAC address if required.

Don not forward any more ports to the IPO than are absolutely required.

8.1 systems can be configured to connect to a openSSL VPN for remote admin if required (although I have not done this myself

A Maintenance contract is essential, not a Luxury.
Do things on the cheap & it will cost you dear

 

[RW111]

Thanks for info guys and comments on SIP registration.

Can anyone comment on if they have used certificates plse when administering IPO?

Thanks

 

[tlpeter]

I did not as i do not see the need for it at the moment.


BAZINGA!

I'm not insane, my mother had me tested!