DO NOT SHARE THESE DOCS WITH CUSTOMERS!
This is an LA release that will only be provided to a select number of PLM-sanctioned customers (PDFs only). Contact PLM for details.
In this section:
Create security groups to support Management (MGT0), High Availability (HA0), PKT0 and PKT1 subnets for the SBC SWe.
Before creating the security groups, review the recommended security group rule settings in the following section.
Ribbon recommends opening the following ports using Inbound/Ingress rules in the security groups associated with management, HA and packet subnets.
Configuring Security Group for Management Subnet
Type | Protocol | Port Range | Source | Notes/Purpose |
---|---|---|---|---|
SSH | TCP | 22 | x.x.x.x/y | SSH to CLI |
Custom UDP rule | UDP | 123 | x.x.x.x/y | NTP |
Custom UDP rule | UDP | 161 | x.x.x.x/y | SNMP Polling |
Custom UDP rule | UDP | 162 | x.x.x.x/y | SNMP traps |
Custom TCP rule | TCP | 2022 | x.x.x.x/y | NetConf over ssh |
Custom TCP rule | TCP | 2024 | x.x.x.x/y | SSH to Linux |
HTTP | TCP | 80 | x.x.x.x/y | EMA |
HTTPS | TCP | 443 | x.x.x.x/y | REST to ConfD DB |
Custom UDP rule | UDP | 3057 | x.x.x.x/y | Used for load balancing service |
Custom UDP rule | UDP | 3054 | x.x.x.x/y | Call processing requests |
Custom UDP rule | UDP | 3055 | x.x.x.x/y | Keep Alives and Registration |
Custom TCP rule | TCP | 4019 | x.x.x.x/y | Applicable to D-SBC only |
Custom UDP rule | UDP | 5093 | x.x.x.x/y | SLS (license server) traffic |
Custom TCP rule | TCP | 444 | x.x.x.x/y | Communicating with EMS, AWS EC2-API server, and Platform Manager |
Configuring Security Group for HA Subnet
Type | Protocol | Port Range | Source | Notes/Purpose |
---|---|---|---|---|
All Traffic | All | All | x.x.x.x/y | x.x.x.x/y is the HA subnet CIDR. |
Configuring Security Group for Packet Ports PKT0 and PKT1
Type | Protocol | Port Range | Source |
---|---|---|---|
Custom UDP rule | UDP | 5060 | x.x.x.x/y |
Custom TCP rule | TCP | 5061 | x.x.x.x/y |
Custom UDP rule | UDP | 1024-65535 | x.x.x.x/y |
The source ranges for the packet security group may be external IP address ranges, or they may be the HFE private subnet CIDR if a High-availability Forwarding Engine is present in the configuration.
Configuring a Security Group for the Public-facing/Management Port (eth0)
Type | Protocol | Port Range | Source |
---|---|---|---|
Custom UDP rule | UDP | 5060 | x.x.x.x/y |
Custom TCP rule | TCP | 5061 | x.x.x.x/y |
Custom UDP rule | UDP | 1024-65535 | x.x.x.x/y |
Configuring a Security Group for the Private-facing Port (eth2)
Type | Protocol | Port Range | Source |
---|---|---|---|
Custom UDP rule | UDP | 5060 | x.x.x.x/y is the PKT0 or PKT1 subnet CIDR which is to have external connectivity |
Custom TCP rule | TCP | 5061 | x.x.x.x/y is the PKT0 or PKT1 subnet CIDR which is to have external connectivity |
Custom UDP rule | UDP | 1024-65535 | x.x.x.x/y is the PKT0 or PKT1 subnet CIDR which is to have external connectivity |
The source ranges for the HFE Private-facing Port security group may be the private subnet CIDR of the SBC PKT0 or PKT1 subnets.
Ribbon recommends opening all ports using Outbound/Egress rules in the security groups associated with management, HA and packet interfaces.
Outbound Security Group Rules
Type | Protocol | Port Range | Destination |
---|---|---|---|
All Traffic | All | All | 0.0.0.0/0 |
If you open specific ports in outbound security group rules, the remaining ports are blocked.
Refer to the Management Security Group, HA Security Group, and Packet Security Group tables for the minimum required security group rules for the SBC to function.
Considering that the SIP signaling port in SBC configuration is set to the default port (5060), the port numbers for UDP/TCP are set to 5060 and 5061.
Navigate to EC2 Management Console.
From the left pane, click Security Groups.
Security Groups Tab
Enter a Security group name for the MGT0 security group and Description.
Select an appropriate VPC from the list.
Click Add Rule to create security group rules as suggested above.
By default, the Inbound rules tab displays on the screen.
Creating a Security Group for MGT
Repeat steps 3 through 7 to create the new security group for HA, PKT0, and PKT1 subnets.