1. Manuals
  2. Brands
  3. Elastix Manuals
  4. Firewall
  5. SIP Firewall
  6. User manual

Elastix SIP Firewall User Manual

Hide thumbs Also See for SIP Firewall:
Table of Contents

Advertisement

Quick Links

Download this manual

Advertisement

Table of Contents
loading
Need help?

Need help?

Do you have a question about the SIP Firewall and is the answer not in the manual?

Questions and answers

Subscribe to Our Youtube Channel

Related Manuals for Elastix SIP Firewall

Summary of Contents for Elastix SIP Firewall

  • Page 2 Elastix SIP Firewall User Manual...
  • Page 3 Information in this document is subject to change without notice and should not be construed as a commitment on the part of http://www.elastix.org. And does not assume any responsibility or make any warranty against errors. It may appear in this document and disclaims any implied warranty of merchantability or fitness for a particular purpose.

  • Page 4: About This Manual

    1.1. About this manual ® This manual describes the Elastix product application and explains how to work and use it major features. It serves as a means to describe the user interface and how to use it to accomplish common tasks. This manual also describes the underlying assumptions and users make the underlying data model.

  • Page 5: Support Information

    1.2. Support Information Every effort has been made to ensure the accuracy of the document. If you have comments, questions, or ideas regarding the document contact: sales@elastix.com                          ...

  • Page 6: Table Of Contents

    Support Information ....................3 1. Introduction ......................6 1.1. Overview: ......................6 1.1.1. Notification LEDs (On the Front Panel of the SIP Firewall) ......8 1.1.2. SIP Firewall Rear View: ................9 1.1.3. SIP Firewall Deployment Considerations ........... 9 2. Initial Setup & Configuration ................11 2.1.Default Configuration ..................
  • Page 7 6.4. Trace route ..................... 35 6.5. Troubleshooting ..................... 36 6.6. Firmware Upgrade ..................37 6.7. Logs Archive ....................38 7. Appendix A – Using Console Access ............... 39 8. Appendix B – Configuring SIP Firewall IP Address via Console ....40...

  • Page 8: Introduction

    Introduction . Overview: ® This User manual describes the steps involved in setting up the Elastix SIP Firewall ® Appliance. Elastix SIP Firewall is an appliance based VoIP threat prevention solution dedicated to protect the SIP based PBX/Telecom Gateway/IP Phones/Mobile device deployments.
  • Page 9 § The device has been made to operate with default configuration with just powering on the device. No administrator intervention is required to operate the device with default configuration. § USB based power supply § Optional support for security events logging on the USB based storage. Technical Specifications Functional Mode Transparent Firewall with SIP Deep Packet...

  • Page 10: Notification Leds (On The Front Panel Of The Sip Firewall)

    1.1.1. Notification LEDs (On the Front Panel of the SIP Firewall) LED 4-Alert Status Power ON/OFF LED 3-DPI Status Button LED 2- Interface Status Power LED LED 1- System Status Indicator Figure 1: Front Panel LED Notifications The SIP Firewall package includes: •...

  • Page 11: Sip Firewall Rear View

    Some of the PBX/Gateway devices may have an exclusive LAN/Mgmt Interface for device management purpose other than the Data Interface (also referred as WAN/Public Interface). In such cases LAN Port of the SIP Firewall should be connected to the Data Interface (WAN/Public Interface).
  • Page 12 Deployment Scenario 2 In the case of IPPBX deployed in the LAN Setup, the following setup is recommended as it would help to protect against the threats from both Internal Network as well as the threats from the Public Cloud penetrated the Non SIP aware Corporate Firewall. Figure 2: Scenario 2 Deployment Scenario 3 In the case of multiple IPPBX/ VOIP Gateways are deployed in the LAN Setup, the...

  • Page 13: Initial Setup & Configuration

    Some of the PBX/Gateway devices may have an exclusive LAN/Mgmt Interface for device management purpose other than the Data Interface (also referred as WAN/ public Interface). In such cases LAN port of the SIP Firewall should be connected to the Data Interface (WAN/ Public Interface).
  • Page 14 Configure the SIP Firewall Device IP Address from the “Device Settings” Page as per your local network range. Verify the IP address set to SIP Firewall from the dashboard page. Once the user assigns the SIP Firewall Device IP Address successfully, he can access the device using that IP address further.
  • Page 15 Figure 5: Timeout message If somebody is already logged in to SIP Firewall WebUI session, the subsequent attempts to login will notify the details previous login session as illustrated below and will prompt the user to override the previous session and continue OR to discard the attempt the...

  • Page 16: Webui Session Timeout

    Figure 6: Select Login attempt 2.4 WebUI Session timeout After logging into the WebUI, if there is no activity until the WebUI session timeout period (By default, the WebUI session timeout is set to 900 seconds), then the login session will automatically terminated and browser will be redirected to login page again.

  • Page 17: Dashboard

    On logging into the SIP Firewall WebUI, the dashboard will be shown. The user can visit the dashboard page from the any configuration page in the SIP Firewall WebUI, by clicking the SIP Firewall Product Icon that appears in the left corner of the Top panel.

  • Page 18: Device Configuration

    3. Device Configuration Configuration pages of the SIP Firewall WebUI have been made as self- intuitive and easy to configure. All the configuration pages have been made to work with the two-phase commit model. The two-phase commit model is not applicable to time settings and signature update settings.

  • Page 19: General Settings

    IP assignment or to acquire the device IP via DHCP. The page also allows to enable/disable the SSH Access to the device. The ‘Allow ICMP’ option will configure the device to respond to the ICMP ping messages sent to SIP Firewall appliances or not.

  • Page 20: Time Settings

    Figure 11: Date/Time Settings 3.3. Management Access The access the SIP Firewall Device management (SSH CLI / WebUI Access) can be restricted with the management access filters. By default, the access has been allowed to any global address and management VLAN network configurations on the device. The...
  • Page 21 Figure 12: Create Management Access Rule Figure 13: Management access The administrator needs to configure the IP Address or the IP Network or the Range of IP Addresses from with management access to the device should be allowed in the management access filter rule.

  • Page 22: Signature Update

    Figure 14: Signature Update When the user buys the SIP Firewall appliance, the device will be shipped with the SIP signatures that will help in protecting against the SIP based attacks known as of date. However, if the user wants to ensure their SIP deployments get the protection against the newest attack vectors, it is recommended to enable the signature update on the device.
  • Page 23 Figure 15: Logging...

  • Page 24: Configuring The Sip Security Policies

    The possible actions that the SIP Firewall can execute are logging the alert, block the packets containing the attack vector and blacklist the attacker IP for the given duration.
  • Page 25 Failed Authentication will have control of that extension. The Failures/Brute force Attempts/Duration SIP Firewall can block, log or blacklist password Attempt the IP for a period of time if it exceeds the authorized number of trials/second. The intruder will generate calls to an extension and it will look like the calls come from that same extension.

  • Page 26: Sip Protocol Compliance

    4.2. SIP Protocol Compliance The SIP Deep packet inspection engine running the SIP Firewall appliance has been made to inspect the SIP traffic with the SIP Security Compliance rules in built into the SIP DPI engine. The anomalies in the SIP Message headers can result to various erroneous conditions, SIP parser failures &...
  • Page 27 Figure 17: SIP Protocol Compliance Max_sessions A SIP session is the application level connection setup created between the SIP server and SIP client for exchanging the audio/video messages with each other. The max_sessions parameter defines the maximum number session that SIP deep packet inspection engine can keep track of.

  • Page 28: Firewall Rules

    Max_requestName_len Max_requestName_len specifies the maximum request name size that is part of the CSeq ID. The Default is set to 20. The allowed range for this option is 1 - 65535 Max_from_len The From header field indicates the identity of the initiator of the SIP request. Max_from_len specifies the maximum from field size.

  • Page 29: Firewall Settings

    Figure 18: Create Firewall Rule 4.4. Firewall Settings Firewall Settings allows user to configure TCP Flood Rate, TCP Flood Burst, UDP Flood rate and UDP Flood Burst in Global firewall settings. Figure 19: Firewall Settings...

  • Page 30: White List Rules

    This page allows to configure the white listed IP addresses in the untrusted wan zone from which the access to communicate with the protected SIP network will be allowed by the SIP Firewall. This page will also allow configuring whether the white rules take precedence over the blacklist rules (both static and dynamic) configured on the device at any instant.

  • Page 31: Blacklist Rules (Static)

    This page allows to configure the blacklisted IP addresses in the untrusted wan zone from which the access to communicate with the protected SIP network will be blocked by the SIP firewall. This page will also allow configuring whether the white rules take precedence over the blacklist rules (both static and dynamic) configured on the device at any instant.

  • Page 32: Dynamic Blacklist Rules

    4.7. Dynamic Blacklist Rules The dynamic blacklist rules are the blocking rules added by the SIP Firewall deep packet inspection engine to block the traffic from attacker IP addresses for the blocking duration configured in the rules category, on detecting the attack.
  • Page 33 Figure 25: Geo IP Filters...

  • Page 34: Status

    However if the administrator wants to persist the alerts into a USB storage, they can connect the USB storage to the USB data port of SIP Firewall appliance. The rotated logs will be automatically archived in CSV format into USB storage...

  • Page 35: Tools

    The SIP Firewall appliances support taking the configuration backup and restore the configuration later. Figure 27: Administration The configuration backup will contain the lastly persisted configuration, if there are any transient changes that are yet to be applied while taking the backup;...

  • Page 36: Diagnostics

    The device will run the diagnostics task in the backend and display the results once the task is complete. The administrator can download the reports by clicking the ‘Get Report’ button and send the report to the Elastix’s Support team (Note: You can send an email to support@elastix.com) Figure 28: Diagnostics Click the above link to download the diagnostics.

  • Page 37: Ping

    SIP Firewall device. The administrator needs to enter the IP address to which the route needs to be traced from the SIP Firewall appliance/hop count and click the ‘Trace route’ button to run the task. The trace route results will be displayed in the text area once the trace route task is...

  • Page 38: Troubleshooting

    Figure 31: Trace route 6.5. Troubleshooting This page will allow disable/enable the DPI on the SIP Firewall appliance for troubleshooting purposes. Figure 32: Troubleshooting...

  • Page 39: Firmware Upgrade

    • Download the SIP Firewall firmware update package from Elastix website and keep it your local system. • From the browser on your local system, login to SIP Firewall WebUI and launch the SIP Firewall firmware upgrade page. • Click the ‘Browse’ in the firmware page and select the SIP Firewall firmware update package file that you saved on your local system.

  • Page 40: Logs Archive

    6.7. Logs Archive If the USB storage device attached to SIP Firewall, the device will attempt to archive older logs in the USB storage device. The summary information on the logs stored on the archive will be shown on the Logs Archive Page.

  • Page 41: Appendix A - Using Console Access

    APPENDIX     7. Appendix A – Using Console Access 1. Connect the serial console the serial port of SIP Firewall device. 2. Use the following serial console settings to access the 'Elastix' CLI i. Speed : 38400 ii. Parity : None iii.

  • Page 42: Appendix B - Configuring Sip Firewall Ip Address Via Console

    8. Appendix B – Configuring SIP Firewall IP Address via Console The user can choose to view/set the IP address of the SIP Firewall device Elastix > show Now you can access the device from the browser using the URL https://<device-ip>...

Table of Contents