In this section:

 

The Sonus Lawful Intercept (LI) solution supports the following:

  • Encrypts media transferred from Session Border Controller (SBC) to the collection device to avoid security issues.
  • Supports Internet Protocol Security (IPsec) encapsulation of Call Data interface (X3).
  • Enables IPsec encapsulation on the Call Content (media) interface for LI security.
  • Associates IPsec to the IP interface group configured in the CDC.
  • Manages IPsec at the application level.

 

Creating IKE Protection Profile

  1. Log on to EMS as admin user. 

  2. Under Network Mgmnt, click Cluster / VNF Management. The Cluster/VNF Management window is displayed. 

  3. Create cluster. For more information on creating a cluster from the EMS, refer to the "Creating an SBC SWe Cluster" in the EMS documentation.

  4. Click Configurations tab.

  5. Click New Configuration. The New Configuration pane is displayed.

    New Configuration

  6. Click Master Configurator tab.

  7. Select the version of the configuration from the Version drop-down menu.

  8. Select an SBC Configurator instance from the Master Configurator drop-down menu.
    This node is used to create the configuration. The SBC Configurator nodes are displayed based on the version selected. Only unlocked SBC Configurator nodes are listed.

  9. Enter a name for the configuration in the Configuration Name field. The SBC configuration name can contain letters, numbers, dashes (-), apostrophes ('), underscores (_), colons (:) and spaces.

    Note

    The cluster ID is set as the default name for the first configuration. Subsequent configurations are named with a combination of cluster name and some unique identifying information. The default name varies based on how the configuration is created. If you modify the name, ensure it is unique.

  10. Click Create. A circular progress bar is displayed against the Master Configurator node. It requires minimum of six minutes to load the master configuration.

    When the Master Configurator node is loaded, the Open Editor button is displayed next to the Master Configurator node.

    Open Editor

  11. Click Open Editor. The SBC Configuration Manager window is displayed.   

  12. Click Configuration > Profile Management.
  13. On the navigation pane, choose Security Profiles as Category.

  14. Click IKE Protection Profile > New IKE Protection Profile.

    +New IKE Protection Profile


    The Create New IKE Protection Profile window is displayed.

  15. Type the profile Name, SA Lifetime Time, and DPD Interval. Choose the appropriate option in PFS Required.

  16. Click Save.
     

    Creating New IKE Protection Profile

    IKE Protection Profile Parameters

    Parameter

    Description

    Name

    Specifies the name of the IKE Protection Profile.

    SA Lifetime
    Time

    The maximum interval seconds that any one Security Association is maintained before possible re-keying. This parameter is applied to the IKE SA when it appears in the IKE Protection Profile and to the IPsec SA when it appears in the IPsec Protection Profile.

    Default value: 8 hours (28,800 seconds)

    Value range: 1200-1000000

    DPD Interval

    Specifies the IKE Protection Profile Dead Peer Detection test interval period in seconds.

    The value '0' corresponds to DPD disabled.

    Default value is 30.

    PFS Required

    Enable flag to require PFS use during IPsec SA negotiation.

    • Disabled (default)
    • Enabled

To View and Edit Algorithm

  1. Click Configuration > Profile Management.
  2. On the navigation pane, choose Security Profiles as Category.

  3. Click IKE Protection Profile > New IKE Protection Profile > Algorithms.

  4. In IKE Protection Profile drop-down menu, choose the desired profile to view its respective Algorithm parameters. The Algorithms window is displayed.

  5. Choose the relevant parameters, and click Save.

    New IKE Protection Profile - Algorithms

    New IKE Protection Profile - Algorithms Parameters

    Parameter

    Description

    Encryption

    The IKE Protection Profile Encryption Cipher. You can select multiple encryptions.

    Options are:

    • _3DesCbc
    • aesCbc128 (default)

    Integrity

    The IKE Protection Profile integrity Cipher. You can select multiple parameters.

    Options are:

    • hmacMd5  (default)
    • hmacSha1
    • hmacsha256
    Dh Group

    Specifies the DH group(s) supported in IKE exchange. The options are:

    • modp768
    • modp1024  (default)
    • modp1536
    • modp2048

IPsec - Peer

The object specifies the name of the Internet Key Exchange (IKE) peer database entry that identifies an entry in the IKE Peer Database (IPD). The IPD is a list of remote devices that may become IPsec peers. The IPD establishes the authentication and other phase 1 criteria for the peer-to-peer negotiation to eventually reach an IKE Security Association (SA) between this specific peer and the SBC.

Creating a Peer

  1. On the SBC Configuration Manager page, click All.

  2. On the navigation pane, choose Address Context > IPsec > Peer. Click New Peer.

    The Create New Peer window is displayed.

    Creating New Peer Parameters

     
     Parameter

    Description

    Name

    Specifies the name of the peer you are configuring.

    IP Address V4 or V6

    Specifies the 32-bit IP address of the Peer.

    Protocol

    The SPD traffic selector IP PROTOCOL. Valid values for this parameter are:

    • Ikev1: Indicates the version of IKE protocol. Internet Key Exchange Version 1.
    • Ikev2: Indicates the enhanced version of IKE protocol. Internet Key Exchange Version 2.
    • Any: Indicates either IKEv1 is used or IKEv2 version is used.

    Pre Shared Key

    Specifies the Pre-shared secret with this peer. The Pre Shared Key can be one of the following:

    • A string ranging from 32 to 128 case-sensitive, alphanumeric characters. These characters may only be in the range 0-9, a-z, space, and A-Z
    • A hexadecimal value introduced by "0x" and followed by 16 to 64 hexadecimal digits (0-9, a-f, A-F)

    In either case the given value represents a pre-shared secret between the SBC and the IKE peer. This value is used for mutual authentication for phase 1 negotiation to set up an IKE Security association.

    Sonus recommends using unpredictable (difficult to guess) values. Use a unique value for each IKE peer. This string is never displayed in plain text when using the show commands.

    Protection
    Profile

    		The name of the IKE protection profile to be applied to the Key management protocol exchange with the peer.
    Local IdentityThis object specifies the local identity type that SBC asserts to the peer during phase 1 authentication.
    Note

    The ipVxAddr attribute is not used at this time. If it is present, ignore it. 

Viewing a Peer

  1. On the navigation pane, choose Address Context > IPsec > Peer.

  2. In Address Context drop-down menu, choose the Peer. The Peer List is displayed.

Editing a Peer

  1. Click the radio button adjacent to Peer name.


    The Edit Selected Peer window is displayed.

  2. Modify the relevant parameters, and click Save.

Copying a Peer

  1. Click the radio button adjacent to the Peer. Click Copy Peer.


    The Copy Selected Peer window is displayed.

  2. Type the relevant parameters, and click Save.

    Note

    The ipVxAddr attribute is not used at this time. If it is present, ignore it. 

Deleting a Peer

  1. Click the radio button adjacent to the Peer. Click Delete.

  2. A delete confirmation message appears. Click Yes.

Peer - Local Identity

The object specifies the local identity type  that SBC asserts to the peer during phase 1 authentication.

Viewing and Editing Local Identity

  1. On the SBC Configuration Manager page, click All.

  2. On the navigation pane, choose Address Context > IPsec > Peer > Local Identity. The Local Identity window is displayed.

    Editing Local Identity

  3. In Address Context drop-down menu, choose the Local Identity.

  4. IN Peer drop-down menu, choose the Peer.

  5. In Type drop-down menu, choose the IP V6Addr.
  6. In IP Address Var, type the IP V6 address.

  7. Click Save.

    Editing Local Identity Parameters

    Parameter

     Description

     ipV6Addr <ipAddress> This parameter specifies that the local identity will be presented in IPv6 address hexadecimal/colon format, taking as its value the IP address of the SBC specified by the next argument (example: 1280:1276:3350:2224:2222:3333:8888:1245 or fd00:21:445:128::7880).
    Note

    The ipVxAddr attribute is not used at this time. If it is present, ignore it. 

Peer - Remote Identity

The object specifies the remote Identity that SBC asserts to the PEER during phase 1 authentication.

Viewing and Editing Remote Identity

  1. On the SBC Configuration Manager page, click All.

  2. On the navigation pane, choose Address Context > IPsec > Peer > Remote Identity. The Remote Identity window is displayed.

    Editing Remote Identity

  3. In Address Context drop-down menu, choose the Remote Identity.

  4. IN Peer drop-down menu, choose the Peer.

  5. In Type drop-down menu, choose IP V6Addr.
  6. In IP Address V4 or V6, type the IP address.

  7. Click Save.

    Editing Remote Identity Parameters

    Parameter

     Description

    ipV4Addr <ipAddress>This parameter specifies that the remote identity will be presented in IPv4 address dotted decimal format, taking as its value the IP address of the SBC specified by the next argument (example: 128.127.50.224).
    ipV6Addr <ipAddress>This parameter specifies that the remote identity will be presented in IPv6 address hexadecimal/colon format, taking as its value the IP address of the SBC specified by the next argument (example: 1280:1276:3350:2224:2222:3333:8888:1245 or fd00:21:445:128::7880).

IPsec - SPD

The object is used to configure SPD for the SBC. The SPD establishes the phase 2 criteria for the negotiation between the SBC and the IKE peer. The successful completion of this negotiation results in a Security Association (SA).

Creating an SPD

  1. On the navigation pane, choose Address Context > IPsec > SPD. The SPD window is displayed.

  2. Type relevant parameters, and click Save.

    Creating New SPD

    Creating New SPD Parameters

    Parameter

    Length/Range

    Description

    Name

    1-23

    Specifies the name of an IPsec Security Policy Database (SPD) entry. The IPsec SPD is an ordered list of entries ("rules") that specify sets of packets and determine whether or not to permit, deny, or protect packets between the SBC and the peer that is referenced from the entry. If the packets are to be protected, this entry references information that specifies how to protect them.

    You may create and configure up to 4,096 SPD entries.

    StateN/AAdministrative state to disable or enable a SPD entry. Zero indicates wildcard.
    Precedence0-65535Evaluation order of this entry. Zero indicates wildcard.
    Local Ip Prefix Len0-128Specifies the local IP prefix length of the SPD traffic selector. Default value is 0.
    Local Port0-65535Specifies the local port of the SPD traffic selector. Zero indicates wildcard. Default value is 0.
    Remote Ip AddrN/ASpecifies the remote IPv4 or IPv6 address of the SPD traffic selector. Zero indicates wildcard.
    Remote Ip Prefix Len0-128Specifies the remote IP prefix length of the SPD traffic selector. Zero indicates wildcard. Default value is 0.
    Remote Port0-65535Specifies the remote port of the SPD traffic selector. Zero indicates wildcard. Default value is 0.
    Protocol0-255Specifies the IP protocol number of the SPD traffic selector. This parameter uses IANA protocol number assignment, that is, protocol number 6 represents TCP, protocol number 17 represents UDP. Zero indicates wildcard. Default value is 0.

    Action

    N/A

    Action applied when packets processed by IPsec found matching the selectors of this SPD rule.

    • Discard – Specifies that the packets are dropped.
    • Bypass – Specifies that the packets are bypassed as clear text.
    • Protect – Specifies that the packets are protected by IPsec based on the protection parameters specified in the configured IPsec protection profile.
    ModeN/A
    • Tunnel
    • Transport
    Protection ProfileN/ASpecifies an encryption cipher, a maximum time period for maintaining a security association between these peers (the SA "lifetime"), and an antireplay policy.
    PeerN/ASpecifies the the name of the Internet Key Exchange (IKE) peer database entry.

    Local Ip Addr Var

    N/A

    Specifies the local IPv4 or IPv6 address of the SPD traffic selector.

Viewing an SPD

  1. On the SBC Configuration Manager page, click All.

  2. On the navigation pane, choose Address Context > IPsec > SPD. The SPD window is displayed.

    Viewing an SPD

  3. In Address Context drop-down menu, choose the appropriate address context to view the SPD.

Editing an SPD

  1. Click the radio button adjacent to SPD name.

    Editing an SPD

    The Edit Selected SPD window is displayed.

  2. Modify the relevant parameters, and click Save.

    Editing Selected SPD Parameters

Copying an SPD

  1. Click the radio button adjacent to SPD name. Click Copy SDP.

    Copying an SPD

     


    The Copy Selected SPD window is displayed.

  2. Type the relevant parameters, and click Save.

    Copying Selected SPD Parameters

Deleting an SPD

  1. Click the radio button adjacent to the SPD. Click Delete.

    Deleting an SPD

  2. A delete confirmation message appears. Click Yes.

    Deleting SPD Prompt