Table of Contents
Advertisement
FTP
An FTP service exists, but is disabled by default. Communication Manager must enable the
FTP service, and only does so for firmware downloads. Once the FTP service is started,
Communication Manager initiates the client-side of the FTP protocol, and then transfers a new
firmware file to the IPSI. Once the transfer is complete, the FTP service is automatically
disabled. A 5-minute time-out is enforced to guard against cases where the firmware download
is started but terminated prematurely. When time-out occurs, the FTP service is disabled until a
new command from Communication Manager enables it again.
DHCP
In S8700 Multi-Connect systems only, the IPSI has the ability to receive its IP address
information from the S8700 server through DHCP. This DHCP service only runs on the control
network, and does not connect to a customer's LAN. Avaya has also implemented mechanisms
for restricting this DHCP service, so that non-IPSIs do not receive an IP address and IPSIs do
not receive an address from a non-S8700 server.
Control link
In order to communicate with the S8700 server, the IPSI establishes a control link. This link is
encrypted through Triple-DES (3DES) by default, although AES is also available. The control
link is not open for communication to or from any other entity than the S8700 server.
TN2302 Media Processor (MedPro)
The TN2302 circuit pack is the interface to the audio gateway portion of IP Telephony. The
circuit pack:
Uses an isolated/proprietary operating system, so it is not susceptible to known viruses.
Runs independently of administrator traffic in order to maintain an isolated security
domain, protecting against attacks that exploit trusted relationships.
Establishes audio connections and only responds to a connection when a corresponding
signaling connection is established.
Successfully survives some Denial of Service (DoS) attacks, including SynFlood, and is
very resilient to flood-based attacks.
Because of the proprietary operating system, limited number of open ports, and reliance on
UDP sessions, the TN2302 is very secure, and is difficult to take out of service. Regardless, the
TN2302 is completely independent of the administration, maintenance, or reliability of the
Avaya Media Gateways, so it cannot be used a "jumping point" to the Media Gateways.
IP Telephony circuit pack security
Issue 3.4.1 June 2005
199
Advertisement
Table of Contents
