You are viewing an old version of this page. View the current version.

Compare with Current View Page History

Version 1 Current »

Create security group rules for the four subnets, by referring the corresponding tables in this section:

  • MGT0
  • HA
  • PKT0
  • PKT1

Customize security groups based on your network security requirement.

Note

If you are installing SBC SWe for the first time, you must create a security group to allow https access. 


Inbound Security Group Rules

Sonus recommends opening up the following ports for Inbound/Ingress rules in the security groups associated with management, HA and packet interfaces.

Management Security Group

Configuring Security Group for Management Subnet


TypeProtocolPort RangeSourceNotes/Purpose
SSHTCP220.0.0.0/0SSH to CLI
Custom UDP ruleUDP1230.0.0.0/0NTP
Custom UDP ruleUDP1610.0.0.0/0SNMP Polling
Custom TCP ruleTCP20220.0.0.0/0NetConf over ssh
Custom TCP ruleTCP20240.0.0.0/0SSH to Linux
HTTPTCP800.0.0.0/0EMA
Custom TCP ruleTCP4440.0.0.0/0Platform Manager
HTTPSTCP4430.0.0.0/0REST to ConfD DB
Custom UDP ruleUDP30570.0.0.0/0Used for load balancing service
Custom UDP ruleUDP30540.0.0.0/0Call processing requests
Custom UDP ruleUDP30550.0.0.0/0Keep Alives and Registration
Custom TCP ruleTCP40190.0.0.0/0Applicable to D-SBC only
Custom UDP ruleUDP50930.0.0.0/0SLS (license server) traffic

 

HA Security Group

Configuring Security Group for HA Subnet


TypeProtocolPort RangeSourceNotes/Purpose
All TrafficAllAllx.x.x.x/yx.x.x.x/y is the HA subnet CIDR.

Packet Security Group

Configuring Security Group for Packet Ports PKT0 and PKT1


TypeProtocolPort RangeSource
Custom UDP ruleUDP5060x.x.x.x/y
Custom TCP ruleTCP5061x.x.x.x/y
Custom UDP ruleUDP1024-655350.0.0.0/0

 

Outbound Security Group Rules

Sonus recommends opening up all the ports for outbound/Egress rules in the security groups associated with management, HA and packet interfaces.

Outbound Security Group Rules

Type ProtocolPort RangeDestination
All TrafficAllAll0.0.0.0/0

Caution

If specific ports are opened in outbound security group rules, the remaining ports are blocked.

Note

Refer Management Security Group, HA Security Group, and Packet Security Group tables for the minimum required security group rules for SBC to function.

 

Management Security Group

Configuring Security Group for Management Subnet


TypeProtocolPort Range DestinationNotes/Purpose
Custom UDP ruleUDP1230.0.0.0/0NTP
Custom UDP ruleUDP1610.0.0.0/0SNMP polling
Custom UDP ruleUDP1620.0.0.0/0SNMP traps
Custom UDP ruleUDP30570.0.0.0/0Used for load balancing service
Custom UDP ruleUDP30540.0.0.0/0Call processing requests
Custom UDP ruleUDP30550.0.0.0/0Keep Alives and Registration
Custom UDP ruleUDP50930.0.0.0/0SLS (license server) traffic
Custom TCP ruleTCP4430.0.0.0/0Communicating with EMS and AWS EC2-API server.

HA Security Group

Configuring Security Group for HA Subnet


TypeProtocolPort RangeDestinationNote/Purpose
All TrafficAllAllx.x.x.x/yx.x.x.x/y is the HA subnet CIDR.

Packet Security Group

Configuring Security Group for Packet Ports PKT0 and PKT1


TypeProtocolPort RangeDestination Note/Purpose
Custom UDP ruleUDP5060x.x.x.x/yDestination IP address to be filled based on call configuration
Custom TCP ruleTCP5061x.x.x.x/yDestination IP address to be filled based on call configuration
Custom UDP ruleUDP1024-655350.0.0.0/0 
Note

Considering that SIP signaling port for SBC configuration is set to the default port (5060), the port numbers for UDP/TCP are set to 5060 and 5061.

 

Create Security Group

To create a security group:

  1. Navigate to EC2 Management Console.
     
  2. From the left pane, click Security Groups.

    Security Groups Tab

  3. Click Create Security Group. The Create Security Group page displays.
     

  4. Enter Security group name and Description.
     

  5. Select an appropriate VPC from the list.
     

  6. Click Add Rule to create security group rules. 

    Note

    By default, inbound rules are displayed in the screen.

    Creating Security Group for MGT

  7. Click Create.
     
  8. Repeat step 3 through 7 to create new security group for HA, PKT0, and PKT1 network interfaces.

  • No labels