SIP Security Practices 1

[SupportDude]

Hello group!
Looking for some best practices for implementing security on SIP trunking installs where the provider does not supply a Session Border Controller.

I know the IPO firewall is a nightmare to configure, but has anybody had any success in using it to only allow SIP on the WAN/LAN2 interface?

Are you using external firewalls?
If so, how are you configuring them ... port forwarding?

Any other strategies for securing the IP Office from SIP based Toll Fraud?

Any and all ideas appreciated!

-SD-

http://www.mysupportguy.net

 

[amriddle01]

Even without a SBC you should still be able to use a public STUN server and leave the system NATd behind the router, no issues with security then

 

[john3voltas]

@amriddle01,
Could you please name some free/public/reliable STUN servers that we can use?

Thanks in advance

 

[Bas1234]

# source :

http://code.google.com/p/natvpn/source/browse/trunk/stun_server_list

# A list of available STUN server.

stun.l.google.com:19302
stun1.l.google.com:19302
stun2.l.google.com:19302
stun3.l.google.com:19302
stun4.l.google.com:19302
stun01.sipphone.com
stun.ekiga.net
stun.fwdnet.net
stun.ideasip.com
stun.iptel.org
stun.rixtelecom.se
stun.schlund.de
stunserver.org
stun.softjoys.com
stun.voiparound.com
stun.voipbuster.com
stun.voipstunt.com
stun.voxgratia.org
stun.xten.com

___________________________________________
It works! Now if only I could remember what I did...

Dain Bramaged (Avaya Search tool

http://tinyurl.com/bas1234

)
______________________________________

 

[SupportDude]

We typically put the IPO behind a firewall running full cone NAT.
No stun required.

This site is a good general VoIP reference and also lists some public STUN servers.

-SD-

http://www.mysupportguy.net

 

[amriddle01]

SupportDude, that means he provider(s) you use have a SBC, when they don't you need your own or a STUN server programmed otherwise nothing adjusts the packets and it cannot traverse NAT

 

[SupportDude]

Sorry amriddle,
I guess I should have been more specific.
I meant we didn't need to use a public STUN server.

Full Cone Nat is a 1 to 1 setup between my public IP/ports and my private IP/ports.
Instead of using a public STUN server, we just configure the necessary information statically on the Network Topology tab.
Configure firewall type as full cone NAT.
Configure Binding refresh time, public IP (the public interface on the firewall), and public port.
This allows the IP Office to provide the correct connection information in the SDP portion of the SIP INVITE or Response.
It works great and I don't have to go searching for a working STUN server.

I also neglected to add the link on my previous post, so here it is.
A good resource for VoIP info.

http://www.voip-info.org/

Still looking for more good/common security practices.

-SD-

http://www.mysupportguy.net