Panel | ||||
---|---|---|---|---|
In this section:
|
The SBC supports importing PEM and DER file types and PrivateKey. To use this functionality, keep the file in an external directory on an active SBC. To support the encrypted private keys, a prompt is raised for the passPhrase
when the private key is imported. The imported privateKeys and related fields, such as passPhrases, are stored in a container database (CDB) to ensure robust security. The parameter keyFileName
allows importing keys separately. In previous versions, the SBC did not supportthe p12
file import if the FIPS mode was used. Validation is added in the SBC 12.1 build to reject the p12
file import with a reason if the FIPS mode is used.
The parameter keyFileName,
is added to allow importing keys separately.
Command Syntax
Code Block | ||
---|---|---|
| ||
% set system security pki certificate <certificate name> keyFileName <1-255 characters> % show system security pki % delete system security pki |
Command Parameters
Parameter | Length/Range | Default | Description | M/O |
---|---|---|---|---|
keyFileName | 0 to 255 | N/A | The name of the file containing the private key in DER/PEM format. | O |
Configuration Examples
Importing PEM/DER certificates and keys:
Code Block | ||
---|---|---|
| ||
set system security pki certificate newcert type local fileName mycert.pem keyFileName mycert.key passPhrase sonus Commit complete. |
The PEM/DER keys are supported:
Code Block |
---|
set system security pki certificate newcert4 type local fileName mycert.pem keyFileName mycert.key.der Commit complete. |
The PKCS12 certificates are not supported in FIPS mode:
Code Block |
---|
set system security pki certificate myp12 state enabled type local fileName mycert.p12 passPhrase sonus Aborted: 'system security pki certificate': PKCS12 certs are not supported in FIPS mode, please provide both cert and key as PEM/DER. |
Importing encrypted keys without passphrase fails:
Code Block |
---|
set system security pki certificate newcert3 type local fileName mycert.pem keyFileName mycert.key.enc Aborted: 'system security pki certificate': Failed to read private key, please verify key/passphrase |
The configuration object "vsaVendorType" is added to RADIUS Authentication.
Command Syntax
Code Block | ||
---|---|---|
| ||
% set oam radiusAuthentication radiusServer <serverName> authenticationMethod <pap | peapmschapv2> mgmtInterfaceGroup <string> priority <#> radiusNasIp <x.x.x.x> radiusServerIp <x.x.x.x> radiusServerPort <#> radiusSharedSecret <8-128> state <disabled | enabled> vsaVendorType <none | 0-255> |
Command Parameters
Parameter | Length/Range | Default | Description | M/O |
---|---|---|---|---|
vsaVendorType | none | 0-225 | none | Select "none" to allow all VSA vendor-types, or a number between 0-225 to only allow the group name to get returned in a VSA with that vendor-type. | O |
Configuration Examples
Code Block | ||
---|---|---|
| ||
set oam radiusAuthentication radiusServer defaultServer vsaVendorType 123 commit |
SIPREC commands are created or updated to support CNe pods. As well, SIPREC commands are updated to accept GUID as a key alongside GCID on the SBC CNe. On the SBC CNe, the OAM pod will execute action commands.
The following GUID commands are added to Request Global:
stopRecordByGuid
The following GCID commands are updated for the SBC CNe:
stopRecord
Command Syntax
Code Block | ||
---|---|---|
| ||
% request service SC podName <SC podName | ALL> global siprec startRecordByGuid GUID <GUID> callLeg ingress numOfStreams <1 | 2> srsIpAddress <SRS IP ADDRESS> srsFqdn1 <FQDN> srsPort <SRS PORT> transport <tcp | udp> trunkGroup <TRUNK GROUP NAME> srsIpAddress2 <SRS IP ADDRESS> srsFqdn2 <secondary FQDN> srsPort2 <SRS Port> transport2 <tcp | udp> trunkGroup2 <SIP Trunk Group> |
Code Block | ||
---|---|---|
| ||
% request service SC podName <SC podName | ALL> global siprec stopRecordByGuid GUID <GUID> recorderAddress <IP Address> recorderFqdn <FQDN> recorderPort <Port Number> recorderId <recording session ID> |
Command Description
Command | Description |
---|---|
| Use this command and its sub-parameters to define and initiate a SIPREC recording session identified with GUID.
|
| Use this command and its sub-parameters to halt a recording session identified with GUID.
|
Info | ||
---|---|---|
| ||
Commands which take GUID as key need not specify the SC podName and use "ALL" option for podName to trigger the command. |
Configuration Examples
Code Block | ||
---|---|---|
| ||
request service SC podName ALL global siprec startRecordByGuid GUID 1234567 callLeg ingress numOfStreams 1 srsIpAddress 123.45.67.89 srsFqdn1 exampledomain.com srsPort 7321 transport udp trunkGroup exampleTrunkGroup commit |
Code Block | ||
---|---|---|
| ||
request service SC podName ALL global siprec stopRecordByGuid GUID 1234567 recorderAddress 123.45.67.89 recorderFqdn exampledomain.com recorderPort 1 recorderId testID commit |
Command Syntax
Code Block | ||
---|---|---|
| ||
% request service SC podName <SC podName> global siprec startRecord gcid <gcid> callLeg ingress numOfStreams <1 | 2> srsIpAddress <SRS IP ADDRESS> srsFqdn1 <FQDN> srsPort <SRS PORT> transport <tcp | udp> trunkGroup <TRUNK GROUP NAME> srsIpAddress2 <SRS IP ADDRESS> srsFqdn2 <secondary FQDN> srsPort2 <SRS Port> transport2 <tcp | udp> trunkGroup2 <SIP Trunk Group> |
Code Block | ||
---|---|---|
| ||
% request service SC podName <SC podName> global siprec stopRecord gcid <gcid> recorderAddress <IP Address> recorderFqdn <FQDN> recorderPort <Port Number> recorderId <recording session ID> |
Command Description
Command | Description |
---|---|
| Use this command and its sub-parameters to define and initiate a SIPREC recording session identified with GCID.
|
| Use this parameter and its sub-parameters to halt a recording session identified with GCID.
|
Info | ||
---|---|---|
| ||
Commands which take GCID as key must specify the SC podName on which the call is hosted. |
Configuration Examples
Code Block | ||
---|---|---|
| ||
request service SC podName testPod global siprec startRecord gcid 1234567 callLeg ingress numOfStreams 1 srsIpAddress 123.45.67.89 srsFqdn1 exampledomain.com srsPort 7321 transport udp trunkGroup exampleTrunkGroup commit |
Code Block | ||
---|---|---|
| ||
request service SC podName testPod global siprec stopRecord gcid 1234567 recorderAddress 123.45.67.89 recorderFqdn exampledomain.com recorderPort 1 recorderId testID commit |
The SBC is enhanced to send the tenant number in the INPUT DATA to the PES, derived from the REFER SIP message's FROM header. A trunk group option, "Send Refer Transferor Number To PSX" controls this activity. When enabled, the INPUT DATA contains the tenant number from the REFER message. A trunk group parameter, sendReferTransferorNumberToPSX,
is added to control sending the transferor number in the INPUT DATA for the PES from the REFER SIP message.
When the control is enabled, the SBC exhibits the same behavior as the Diversion. If the control sendReferTransferorNumberToPSX
is enabled and the REFER Transferor number is sent to the PSX, the next INVITE’s To header is mapped from the Redirection Origination Number and becomes different from the RURI, unless the following control is set:
Code Block |
---|
% set profiles signaling ipSignalingProfile <IPSP_NAME> egressIpAttributes sipHeadersAndParameters sipToHeaderMapping calledNumber |
Command Syntax
Code Block | ||
---|---|---|
| ||
% set addressContext <addressContext name> zone <ZONE NAME> sipTrunkGroup <TG NAME> services sendReferTransferorNumberToPSX <disabled | enabled> |
Command Parameters
Parameter | Length/Range | Default | Description | M/O |
---|---|---|---|---|
sendReferTransferorNumberToPSX | N/A | disabled | Use this parameter to send the transferor party number to the PSX.
| O |
Configuration Examples
Code Block | ||
---|---|---|
| ||
set addressContext default zone SIP_ZONE_AS sipTrunkGroup SIP_TG_AS_V4 services sendReferTransferorNumberToPSX enabled |
The following parameters are added to the network segment table as part of this feature:
Command Syntax
Code Block | ||
---|---|---|
| ||
% set system networkSegmentTable pfe-pkt0 networkSegmentType PFE pfeID <1-15> networkInterfaceName <pkt0 | pkt1> prefixV4 <0-32> vlanId <0-4095> ipNameV4 <name> ipList [list of space separated IPs] portRanges <range name> rangeStart <1-65535> rangeEnd <1-65535> applicationType <signaling | media | signalingGateway> transport <udp | tcp> state <enabled | disabled> |
Command Parameters
PFE ID
1-15
Packet Frontend ID to which the network segment is anchored.
applicationType
Application type used for portRange signaling, media, and signalingGateway.
rangeStart
rangeEnd
transport
Layer 4 protocol.
state
Configuration Examples
Code Block | ||
---|---|---|
| ||
set system networkSegmentTable pfe-pkt0 networkSegmentType PFE pfeID 1 networkInterfaceName pkt0 prefixV4 23 vlanId 485
set system networkSegmentTable pfe-pkt0 ipNameV4 PFE_PKT0 ipList [ 10.161.116.50 ]
set system networkSegmentTable pfe-pkt0 portRanges range1 rangeStart 4096 rangeEnd 4607 applicationType signaling transport udp
set system networkSegmentTable pfe-pkt0 portRanges range2 rangeStart 4608 rangeEnd 6143 applicationType media transport udp
set system networkSegmentTable pfe-pkt0 portRanges range3 rangeStart 6144 rangeEnd 6655 applicationType signalingGateway transport udp
set system networkSegmentTable pfe-pkt0 state enabled
commit |
SBC SWe only: To support SHA2, the following three options are added to "integrity" in the IPsec Protection Profile:
hmacSha256
hmacSha384
hmacSha512
Command Syntax
Code Block | ||
---|---|---|
| ||
% set profiles security ipsecProtectionProfile <profile> espAlgorithms integrity <hmacMd5 | hmacSha1 | hmacSha256 | hmacSha384 | hmacSha512> |
Command Parameters
SBC SWe only: To support SHA2, the following three options are added to "integrity":
hmacSha256
hmacSha384
hmacSha512
Parameter | Length/Range | Default | Description | M/O |
---|---|---|---|---|
integrity | n/a | hmacSha1 | The IKE Protection Profile Integrity Cipher.
| O |
Configuration Example
Code Block | ||
---|---|---|
| ||
set profiles security ipsecProtectionProfile exampleProfile espAlgorithms integrity hmacSha512 commit |
The following two CLI commands are altered to hide the "Packet Port Speed" entry:
show table system serverAdmin
show table system serverStatus
Users can still access packet port speed information by entering the following command:
show table system ethernetPort packetPortStatus
Configuration Examples
Code Block | ||
---|---|---|
| ||
show table system serverAdmin ACTUAL DEVICE CE COREDUMP SMART MODULAR PKT PORT HW SUB NAME NAME PROFILE ROLE ATTRIB TYPE HW TYPE SPEED TYPE --------------------------------------------------------------------------------------- sbc1 sbc1 default primary 0 false ConnexIP5000 speed1Gbps virtual |
Info | ||
---|---|---|
| ||
Observe how the "PKT PORT SPEED" entry in the config example above is now hidden in the example with the feature applied below. |
Code Block | ||
---|---|---|
| ||
show table system serverAdmin ACTUAL DEVICE CE COREDUMP SMART MODULAR HW SUB NAME NAME PROFILE ROLE ATTRIB TYPE HW TYPE TYPE -------------------------------------------------------------------------- sbc1 sbc1 default primary 0 false ConnexIP5000 virtual |