Versions Compared

Old Version 4

changes.mady.by.user Ribbon Communications

Saved on

compared with

New Version 5

changes.mady.by.user Ribbon Communications

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Expand
titleClick here for Sample ACL Rule (Packet Filter)
Info

These are sample ACLs and should be customized for your specific deployment.

A typical SBC deployment may have two 'sides'.  One side is the LAN-side or the corporate-network side, and the other is the Internet-side, WAN-side or the provider-network side. Neither side should be trusted entirely.  ACLs must be configured so that only SIP/VOIP/RTP traffic is allowed on both sides. An additional task is usually to determine the IP interface WebUI/REST management is allowed on.

Note

When configuring ACLs, it is possible to isolate the SBC out of the network. Ensure there are rules in place to accept HTTPS on at least one IP interface. The order of rules in the ACL is important.

For this example, consider that the Sonus

Spacevars
0company
SBC 1000 has two IP interfaces

  1. Ethernet 1 IP: 12.3.10.10/24  (LAN-side, office-side, branch-side, corporate network-side)
  2. Ethernet 2 IP: 10.1.10.10/24  (SIP trunk side, WAN-side, Provider-side, Internet-side)
LAN Side ACL

(For this example, this ACL must be applied to 'Ethernet 1 IP' as "Input ACL")

DescriptionProtocolAction

Port
Selection

Service

Source
IP

Source
Mask

Source
Min Port

Source
Max Port		Dest
IP		Dest
Mask		Dest
Min Port		Dest
Max Port		Description
Allow WebUI/HTTPSTCPAllowServiceHTTPS0.0.0.00.0.0.0  0.0.0.00.0.0.0  For more security, replace the source IP and mask with the network addresses that is on the LAN-side. Also, consider the subnets used for VPN users of that corporate network.
Allow WebUI/HTTP to redirect to HTTPSTCPAllowServiceHTTP0.0.0.00.0.0.0  0.0.0.00.0.0.0  Not strictly required, but this is good for convenience. SBC will redirect all HTTP requests to HTTPS.
Accept SIP Signaling over UDPUDPAllowRange 40.1.1.1255.255.255.2551024655350.0.0.00.0.0.050605060

Create one rule for every SIP protocol/port combination on the SBC, based on all Signaling Groups. Source IP and mask, must match what is configured on the Federated-IP network as well.

In this example, perhaps 40.1.1.1 is an IP-PBX that supports SIP over UDP.

Accept SIP Signaling over TCP and TLSTCPAllowRange 50.1.1.2255.255.255.2551024655350.0.0.00.0.0.050675067

Create one rule for every SIP protocol/port combination on the SBC, based on all Signaling Groups. Source IP and mask, must match what is configured on the Federated-IP network as well.

In this example, perhaps 50.1.1.2 is a Lync Mediation Server that supports SIP over TLS.

Accept SIP Signaling TCP and TLS ACKsTCPAllowRange 50.1.1.2255.255.255.255506750670.0.0.00.0.0.0102465535

Create one rule for every SIP server. This rule allows the TCP ACKs to return to the SBC. Source IP and mask, must match what is configured on the Federated-IP network as well.

In this example, perhaps 50.1.1.2 is a Lync mediation server that supports SIP over TLS.

Accept RTP/RTCP packetsUDPAllowRange 0.0.0.00.0.0.01024655350.0.0.00.0.0.01638417583Accept all RTP/SRTP packets. Note that the port-range must match that of Media System Configuration on the SBC.
Accept DNS responsesUDPAllowRange 0.0.0.00.0.0.053530.0.0.00.0.0.0102465535Accept DNS responses for all DNS_requests initiated by the SBC.
Discard all other packetsANYDeny  0.0.0.00.0.0.0  0.0.0.00.0.0.0  Discard all other packets.
             (Destination IP and mask may be replaced with a specific IP address of 12.3.10.10/255.255.255.255, for ensuring all communications only use that specific IP address. )

 

SIP Trunk Side ACL

(For this example, this ACL must be applied to 'Ethernet 2 IP' as "Input ACL")

DescriptionProtocolAction

Port
Selection

Source
IP

Source
Mask

Source
Min Port

Source
Max Port		Dest
IP		Dest
Mask		Dest
Min Port		Dest
Max Port		Description
Accept SIP Signaling over UDPUDPAllowRange20.5.1.20255.255.255.25510246553510.1.10.10255.255.255.25550605060

Create one rule for every SIP protocol/port combination on the SBC, based on all Signaling Groups. Source IP and mask, must match what is configured on the Federated-IP network as well.

In this example, perhaps 20.5.1.20 is the IP address of the SIP-trunk peer.

Accept RTP/RTCP packetsUDPAllowRange20.5.1.20255.255.255.25510246553510.1.10.10255.255.255.2551638417583Accept all RTP/SRTP packets. Note that the port-range must match that of Media System Configuration on the SBC.
Accept DNS responsesUDPAllowRange0.0.0.00.0.0.053530.0.0.00.0.0.0102465535Accept DNS responses for all DNS_requests initiated by the SBC.
Discard all other packetsANYDeny 0.0.0.00.0.0.0  0.0.0.00.0.0.0  Discard all other packets.
            (Destination IP and mask may be replaced with a specific IP address of the SBC on the SIP-trunk side).

...