Voip Firewall; Topology Hiding; Sip Normalization - AudioCodes mediapack MP-500 User Manual

SIP User's Manual
9.2.1.2

VoIP Firewall

The device provides a firewall for VoIP:
SIP signaling:
•
Deep and stateful inspection of all SIP signaling packets
•
SIP dialog initiations may be rejected based on values of incoming SIP INVITE
message and other Layer-3 characteristics
•
Packets not belonging to an authorized SIP dialog are discarded
RTP:
•
Opening pinholes (ports) in the device's firewall based on Offer-Answer SDP
negotiations
•
Deep packet inspection of all RTP packets
•
Late rouge detection - if a SIP session was gracefully terminated and someone
tries to "ride on it" with rouge traffic from the already terminated RTP and SIP
context, the VoIP Firewall will prevent this from occurring
•
Disconnects call (after user-defined time) if RTP connection is broken
•
Black/White lists for both Layer-3 firewall and SIP classification
9.2.1.3

Topology Hiding

The device supports topology hiding, which limits the amount of topology information
displayed to external parties. For example, IP addresses of ITSPs' equipment (e.g. proxies,
gateways, and application servers) can be hidden from outside parties.
The device's topology hiding is provided by implementing back-to-back user agent (B2BUA)
leg routing:
Strips all incoming SIP Via header fields and creates a new Via value for the outgoing
message.
Each leg has its own Route/Record Route set
Modifies SIP To, From, and Request-URI host names
Generates a new SIP Call-ID header value (different between legs)
Changes the SIP Contact header to the device's own address
Layer-3 topology hiding, by modifying source IP address in the SIP IP header
9.2.1.4

SIP Normalization

The device supports SIP normalization whereby the SBC application can overcome
interoperability problems between SIP user agents. This is achieved by the following:
Manipulation of SIP URI user and host parts
Connection to ITSP SIP trunks on behalf of an IP-PBX - the device can register and
utilize user and password to authenticate for the IP-PBX
Version 5.8 457
9. IP Telephony Capabilities
October 2009