Page History
Create security group rules for the four subnets, by referring to the corresponding tables in this section:
- MGT0
- HA
- PKT0
- PKT1
Customize security groups based on your network security requirement.
| Info | ||
|---|---|---|
| ||
If you are installing SBC SWe for the first time, you must create a security group to allow https HTTPS access. |
Inbound Security Group Rules
Sonus recommends opening up It is recommended to open the following ports for Inbound/Ingress rules in the security groups associated with management, HA, and packet interfaces.
Management Security Group
| Caption | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
...
|
HA Security Group
| Caption | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| ||||||||||
|
...
| Caption | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ||||||||||||||||
|
...
Outbound Security Group Rules
Sonus recommends opening up all It is recommended to open all the ports for outbound/Egress rules in the security groups associated with management, HA and packet interfaces.
| Caption | ||||||||
|---|---|---|---|---|---|---|---|---|
| ||||||||
|
| Info | ||
|---|---|---|
| ||
The HA solution works only if the mgt0 has internet access. If the routing table (associated with the subnet of mgt0) fails to have all the traffic rules, the HA solution does not work. |
| Note | ||
|---|---|---|
| ||
If specific ports are opened in outbound security group rules, the remaining ports are blocked. |
| Info | ||
|---|---|---|
| ||
Refer to the Management Security Group, HA Security Group, and Packet Security Group tables for the minimum required security group rules for SBC to function. |
...
| Infocaption | ||||||
|---|---|---|---|---|---|---|
| ||||||
| ||||||
| Type | Protocol | Port Range | Destination | Notes/Purpose | ||
| Custom UDP rule | UDP | 123 | 0.0.0.0/0 | NTP | Custom UDP rule | UDP | 161 |
| ||||||
Considering that SIP signaling port for SBC configuration is set to the default port (5060), the port numbers for UDP/TCP are set to 5060 and 5061. |
Route Table Rule
The AWS uses the most specific route in your route table that matches the traffic to determine how to route the traffic (longest prefix match). You need to have the rule to route all the non-Virtual Private Clouds (VPC) traffic to internet gateway or ensure that the internet traffic is routed through your own NAT instance or Gateway. If you cannot provide a way to send out the SBC API query to the internet, the HA solution fails (SBC) in the AWS.
The routes to the IPv4 and IPv6 addresses or CIDR blocks are independent of each other. The AWS uses the most specific route that matches either IPv4 traffic or IPv6 traffic to determine how to route the traffic.
For example, the following route table has a route for IPv4 Internet traffic 0.0.0.0/0
...
that points to an Internet gateway. Any traffic destined for a target within the VPC (10.0.0.0/
...
16) is covered by the Local route, and therefore, routed within the VPC. All other traffic from the subnet uses the Internet gateway.
| Caption | ||||
|---|---|---|---|---|
| ||||
|
...
|
...
|
|
...
HA Security Group
...
| 0 | Table |
|---|---|
| 1 | Configuring Security Group for HA Subnet |
| 3 | T2 |
| Type | Protocol | Port Range | Destination | Note/Purpose |
|---|---|---|---|---|
| All Traffic | All | All | x.x.x.x/y | x.x.x.x/y is the HA subnet CIDR. |
Packet Security Group
...
| 0 | Table |
|---|---|
| 1 | Configuring Security Group for Packet Ports PKT0 and PKT1 |
| 3 | T3 |
| Type | Protocol | Port Range | Destination | Note/Purpose |
|---|---|---|---|---|
| Custom UDP rule | UDP | 5060 | x.x.x.x/y | Destination IP address to be filled based on call configuration |
| Custom TCP rule | TCP | 5061 | x.x.x.x/y | Destination IP address to be filled based on call configuration |
| Custom UDP rule | UDP | 1024-65535 | 0.0.0.0/0 |
|
For detailed information on the Route Table, refer to AWS documentation.
Dynamic Host Configuration Protocol (DHCP) Option Set
The Dynamic Host Configuration Protocol (DHCP) provides a standard for passing configuration information to hosts on a TCP/IP network. The options field of a DHCP message contains the configuration parameters. Some of those parameters are the domain name, domain name server, and the netbios-node-type.
The DHCP options sets are associated with your AWS account so that you can use them across all of your VPC. For detailed information on the DHCP option sets, refer to DHCP Options Sets of the AWS documentation.
The following DHCP option sets are provided by AWS:
- default DHCP option set
- custom DHCP option set
When you create a VPC, the AWS automatically creates a set of DHCP options and associates them with the VPC. This set includes two options:
domain-name-servers=AmazonProvidedDNSdomain-name=domain-name-for-your-region
The AmazonProvidedDNS is an Amazon DNS server, which enables DNS for instances that need to communicate over the VPC's Internet gateway. The string AmazonProvidedDNS maps to a DNS server running on a reserved IP address at the base of the VPC IPv4 network range, with the last octet incremented by two digits. For example, the DNS Server on a 10.0.0.0/16 network is located at 10.0.0.2.”. For VPCs with multiple IPv4 CIDR blocks, the DNS server IP address is located in the primary CIDR block.
The AWS HA uses several API requests to know the peer instance and also during IP switch-over. At the back-end, the AWS has several servers with different IP address running to provide the SBC seamless performance or response. If one server goes down, the Amazon provided DNS automatically updates the API endpoint. This may not be the case with the custom DNS and results in an API request failure. To overcome this issue, the SBC needs to add the field AmazonProvidedDNS in the DNS server, in addition to the IP address of the custom DNS server. For detailed information on the custom DNS, refer to Using DNS with Your VPC of the AWS documentation.
| Info | ||
|---|---|---|
| ||
Considering that SIP signaling port for SBC configuration is set to the default port (5060), the port numbers for UDP/TCP are set to 5060 and 5061. |
Create Security Group
To create a security group:
- Navigate to EC2 Management Console.
From the left pane, click Security Groups.
Caption 0 Figure 1 Security Groups Tab
Click Create Security Group. The Create Security Group page displays.Anchor Step3 Step3
Enter Security group name and Description.
Select an appropriate VPC from the list.
Click Add Rule to create security group rules.
Info title Note By default, inbound rules are displayed in on the screen.
Caption 0 Figure 1 Creating Security Group for MGT
Click Create.Anchor Step7 Step7
Repeat step 3 through 7 to create the new security group for HA, PKT0, and PKT1 network interfaces.
...
Overview
Content Tools