Configuring SBC for Ribbon Analytics

Use the following topics to configure your network to send SBC Core media quality statistics as well as Security and Audit logs to Ribbon Analytics.

Report Media Quality Statistics to Ribbon Analytics

To facilitate monitoring and management of voice quality by the SBC Core and Ribbon Analytics, the SBC supports the following functionality to allow service providers to see discrete variations in voice quality, as well as monitor SLA and network operations.

• Communicate with Ribbon Analytics
• Report media quality statistics (RTP/RTCP) and DTMF packets to Ribbon Analytics using the Media Probe configuration

NOTE: Ribbon Protect is rebranded to Ribbon Analytics. Any references to 'Ribbon Protect' and 'Protect' in the SBC Core documentation apply to the Ribbon Analytics product.

The Media Probe feature facilitates monitoring and management of voice quality by the SBC Core and Ribbon Analytics. Use the following example configurations to establish communication with, and send media quality statistics (RTP/RTCP) and DTMF packets to, Ribbon Analytics using the Media Probe feature.

Configuring SBC Core using CLI for Ribbon Analytics

Media Probe CLI

The Media Probe functionality is added to the System Media configuration to capture and report on media quality statistics (RTP/RTCP) and DTMF packets. Configuration details are explained below. 

Command Syntax

% set system media mediaProbe
	dscpValue <0-63>
	encryptionType <None>
	format <rtcp>
	mediaProbeAddressContext <addressContext>
	mediaProbeIpInterfaceGroup <mediaIpInterfaceGroup>
	protocolType <udp>
	reportingInterval <1-8>
	state <disabled | enabled>

Command Parameters

Configuration Example

set system media mediaProbe dscpValue 0 encryptionType none format rtcp mediaProbeAddressContext ADDR_CONTEXT_1 mediaProbeIpInterfaceGroup INGRESS_LIG protocolType udp reportingInterval 1 state enabled
commit

show system media mediaProbe
state                      enabled;
reportingInterval          1;
protocolType               udp;
encryptionType             none;
format                     rtcp;
dscpValue                  0;
mediaProbeAddressContext   ADDR_CONTEXT_1;
mediaProbeIpInterfaceGroup INGRESS_LIG;

Protect CLI

The Protect functionality is added to the System configuration to allow the SBC to communicate to the Ribbon Analytics server. 

Command Syntax

% set system protect
	clusterName <Cluster name>
	serverAddress <DIG IP Address of the Ribbon Analytics Server>
	serverPort <port number>

Command Parameters

Configuration Example

set system protect serverAddress 10.50.100.10 serverPort 5558 clusterName default
commit

show system protect
serverAddress              10.50.100.10;
serverPort                 5558;
clusterName                default;

Enabling DoD Mode on the SBC Core for Ribbon Analytics

Use the following section to use Ribbon Analytics on the SBC Core while DoD mode is enabled. 

1. Remove iptables rule for 2024 that was added on DoD enable. Run the following command as root from a linux shell.

   iptables -D INPUT -i mgt0 -p tcp --syn --dport 2024 -m connlimit --connlimit-above 0 -j REJECT

2. Add an ACL rule to allow connection from specific IP used by Ribbon Analytics to port 2024. Run the following command from the CLI in config mode.

   set addressContext default ipAccessControlList rule RARule sourceIpAddress <IP> destinationPort 2024 action accept sourceAddressPrefixLength 32 precedence 5 state enabled

3. Add ACL rule to override the default allow rule and disallow connections to port 2024. Run the following command from CLI in config mode.

   set addressContext default ipAccessControlList rule rejectAll action discard sourceIpAddress 0.0.0.0 destinationPort 2024 precedence 100 state enabled

Configuring SBC Core using EMA for Ribbon Analytics

Media Probe

Use the Media Probe object to capture and report media quality statistics (RTP/RTCP) and DTMF packets.

EMA UI path: All > System > Media > Media Probe

Media Probe Parameters

The Media Probe fields are described below.

Configure the following fields:

Protect

Use the System > Protect object to allow the SBC to communicate to the Ribbon Analytics server.

EMA UI path: All > System > Protect

Protect Parameters

Configure the following fields.

Configuration and Verification Steps

Statistics

Media Probe License Availability

Service Authorised Cur Stats

On the SBC, go to All > Global > Service Authorised Cur Stats. The Service Authorisation Cur Stats window displays.

Use the Service Authorisation Cur Stats window to view current global statistics that report which licensed features are authorized for use on the SBC. A value of 0 indicates the feature license is not available. If the Media Probe Authorisation column is set to "1", the MEDIA-PROBE license is available.

Service Authorised Int Stats

On the SBC main screen, go to All > Global > Service Authorised Int Stats. The Service Authorisation Int Stats window displays.

Use the Service Authorisation Int Stats window to view global statistics for a series of time intervals that report which licensed features are authorized for use on the SBC. A value of 0 indicates the feature license is not available.

The statistics Media Probe Authorisation displays under the objects "Service Authorised Cur Stats" and "Service Authorised Int Stats".

Service Authorised Cur Stats

> show status global serviceAuthorisedCurStats mediaProbeAuthorisation
serviceAuthorisedCurStats entry {
    licenseMode                    nodeLocked;
    encryptAuthorisation           1;
    srtpAuthorisation              1;
    enhancedVideoAuthorisation     1;
    amrnbLegAuthorisation          1;
    amrwbLegAuthorisation          1;
    evrcLegAuthorisation           1;
    niceRecAuthorisation           1;
    mrfSessionsAuthorisation       1;
    sipRecAuthorisation            1;
    transcodeAuthorisation         1;
    pdcsAuthorisation              1;
    liSessionsAuthorisation        1;
    sbcRtuSessionsAuthorisation    1;
    dspG722SessionsAuthorisation   1;
    gmp4x1SessionsAuthorisation    1;
    sipISessionsAuthorisation      1;
    sip323SessionsAuthorisation    1;
    gmp1x10SessionsAuthorisation   1;
    polRtuSessionsAuthorisation    1;
    psxRtuSessionsAuthorisation    1;
    capacityLicenseAuthorisation   0;
    e911SessionsAuthorisation      1;
    enumSessionsAuthorisation      1;
    swInstanceLicenseAuthorisation 1;
    evsLegAuthorisation            1;
    silkLegAuthorisation           1;
    slbAuthorisation               1;
    slbSessionsAuthorisation       1;
    mediaProbeAuthorisation        1;
}
[ok][<YYYY-MM-DD HH:MM:SS>]

Service Authorised Int Stats

> show status global serviceAuthorisedIntStats mediaProbeAuthorisation
serviceAuthorisedIntStats 646 entry {
    intervalValid                  true;
    time                           581362;
    licenseMode                    nodeLocked;
    encryptAuthorisation           1;
    srtpAuthorisation              1;
    enhancedVideoAuthorisation     1;
    amrnbLegAuthorisation          1;
    amrwbLegAuthorisation          1;
    evrcLegAuthorisation           1;
    niceRecAuthorisation           1;
    mrfSessionsAuthorisation       1;
    sipRecAuthorisation            1;
    transcodeAuthorisation         1;
    pdcsAuthorisation              1;
    liSessionsAuthorisation        1;
    sbcRtuSessionsAuthorisation    1;
    dspG722SessionsAuthorisation   1;
    gmp4x1SessionsAuthorisation    1;
    sipISessionsAuthorisation      1;
    sip323SessionsAuthorisation    1;
    gmp1x10SessionsAuthorisation   1;
    polRtuSessionsAuthorisation    1;
    psxRtuSessionsAuthorisation    1;
    capacityLicenseAuthorisation   0;
    e911SessionsAuthorisation      1;
    enumSessionsAuthorisation      1;
    swInstanceLicenseAuthorisation 1;
    evsLegAuthorisation            1;
    silkLegAuthorisation           1;
    slbAuthorisation               1;
    slbSessionsAuthorisation       1;
    mediaProbeAuthorisation        1;
}
[ok][<YYYY-MM-DD HH:MM:SS>]

License

Depending upon the licensing type, install the following license to use the Media Probe feature.

• NWDL: MEDIA-PROBE-D license
• Node Locked: MEDIA-PROBE license

Push SEC and AUD logs to Ribbon Analytics

The SBC Core routinely logs and reports invalid login attempts for access to all its accounts and interfaces. These logs and reports serve as an important data set for Ribbon Analytics, which warns administrators when many invalid attempts are seen across the network. The event reporting notes the IP and port from which the invalid attempt was made, and makes logs available in the SEC and AUD logs.

The SBC currently logs this information along with the remote IP to the file auth.log. The SBC also pushes the auth.log via syslogd so that Ribbon Analytics can access messages.

If the SBC is configured with a call trace filter to capture all SIP PDU messages in the trace log, then you must update the settings for the fields diskThrottleLimit, eventLogValidation, fileSize and messageQueueSize using the information provided in the Event Log - CLI page.

Improve Traffic Between Ribbon Analytics and SBC

Using the default Access Control List (ACL) rules, Ribbon Analytics traffic can be throttled when trying to collect files from the SBC. Using the CLI, follow these steps to improve traffic:

1. Update operatorAggregatePolicer with a fillRate of "30000" and a bucketSize of "250."

   Example

   set addressContext default operatorAggregatePolicer fillRate 30000 bucketSize 250

2. Create a new user ACL for the traffic between Ribbon Analytics and the SBC using the following parameters:

   ACL Parameters

   admin@PTBF05> show table addressContext default ipAccessControlList rule RA
   	precedence                     7003;
   	protocol                       any;
   	mgmtIpInterfaceGroup           mgmtGroup;
   	sourceIpAddress                <RA IP>;
   	sourceAddressPrefixLength      32;
   	destinationIpAddress           <SBC IP>;
   	destinationAddressPrefixLength 32;
   	sourcePort                     any;
   	destinationPort                any;
   	action                         accept;
   	fillRate                       30000;
   	bucketSize                     unlimited;
   	state                          enabled;
   	aggregatePolicer               OPERATOR;

Generating SSH Keys for Default Users 

The following section outlines how to generate SSH keys for Default Users on the SBC. 

Generating a SSH Key on a Non-cloud Based SBC

The following steps outline how to generate SSH keys from the command line on a non-cloud based SBC. The second section also outlines how to install the SSH keys to a linuxadmin user:

1. Input the following command: ssh-keygen -f <filename>.pem -t rsa


   Note

   To add a password to the key, enter a passphrase in the fields provided. To decline adding a password, leave the fields blank.

2. Extract the public key from the newly generated private key using the following command: ssh-keygen -y -f <keyname>


   Example

   jmulcock@jmulcock01:~$ ssh-keygen -f example.pem -t rsa
   Generating public/private rsa key pair.
   Enter passphrase (empty for no passphrase):
   Enter same passphrase again:
   Your identification has been saved in example.pem
   Your public key has been saved in example.pem.pub
   The key fingerprint is:
   SHA256:caJAkQzCTgQjSKim//234Rzz4ReGSnUDpR6/t8UQ6Qc jmulcock@jmulcock01
   The key's randomart image is:
   +---[RSA 3072]----+
   |%o.ooo       ..  |
   |+= .o       .. . |
   |+   .   o . o.E  |
   |.o   . . + ..+oo |
   |o     . S  ..o+..|
   |.         . . o= |
   | .       .+.....+|
   |  .  .   oo* ...o|
   |   .. ....+.o. . |
   +----[SHA256]-----+

Copying and installing a SSH key to the linuxadmin user

1. Run the following command: ssh-copy-id -i <key name> -p2024 linuxadmin@<SBC Mgt IP> 
2. Enter the password for the linuxadmin user.

3. Perform a login test using the following command: ssh -i <key name> -p2024 linuxadmin@<SBC Mgt IP>


   The user must install the key on all SBC instances (e.g. in a HA setup, install the key on both the active and standby instances).

   To authenticate a public key, refer to:

   • SSH Public Key Authentication Enabled - CLI
   • User and Session Management - Public Key Authentication
   Example

   jmulcock@jmulcock01:~$ ssh-copy-id -i example.pem -p2024 linuxadmin@10.31.243.20
   /usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "example.pem.pub"
   /usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
   /usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
   ######################
   #
   This system is restricted to authorized users only.
   Unauthorized access or access attempts to this system
   or services are prohibited. All user activity is logged.
   Evidence of unauthorized use collected during monitoring
   may be provided to appropriate personnel for
   administrative, criminal or other adverse action.
   #
   ######################
   linuxadmin@10.31.243.20's password:
   
   Number of key(s) added: 1
   
   Now try logging into the machine, with:   "ssh -p '2024' 'linuxadmin@10.31.243.20'"
   and check to make sure that only the key(s) you wanted were added.
   
   jmulcock@jmulcock01:~$ ssh -p 2024 -i example.pem linuxadmin@10.31.243.20
   ######################
   #
   This system is restricted to authorized users only.
   Unauthorized access or access attempts to this system
   or services are prohibited. All user activity is logged.
   Evidence of unauthorized use collected during monitoring
   may be provided to appropriate personnel for
   administrative, criminal or other adverse action.
   #
   ######################
   Last login: Thu May  4 15:27:53 BST 2023 from 172.26.223.243 on ssh
   Ribbon ConnexIP OS 10.01.00-A004 GNU/Linux
   linuxadmin@SBXUK20-1:~$

Public Cloud Key Generation

The following steps outline how to generate keys for public clouds. When creating keys for public clouds, two options are available:

1. Allow terraform to generate the keys:
   1. IAC provides the option to generate the key for the linuxadmin user.
   2. Terraform tfvars will contain a variable like 'generate_ssh_key'.
2. In AWS, use the AWS console to generate the key:
   1. Go to EC2 → Key Pairs
   2. Select Create Key Pair
   3. On screen
      1. Enter Name
      2. Select .pem
      3. Select Create key pair
      4. Save the private key somewhere.

SBC SSH Keys in Public Clouds

This section will outline how the SSH keys are handled on the SBC for linuxadmin and admin users for public clouds. All keys supplied to the cloud/instance are the public keys. The creator is responsible for storing the keys on the private side. Key types are always RSA. Any updates require the SBC instance to be rebooted to take effect.

For more information on updating SSH keys, refer to: Recovering SSH Key Access in Public Cloud and Updating User Data in Azure

AWS

Storage

• Linuxadmin - Stored in AWS Key Pairs (Orchestration)
  
  • The key is generated by AWS Key Pairs via the console, or the user can import a public key.
• Admin - User Data

Orchestration

• Linuxadmin - Supplied as Key Name, extracted by cloud init
• Admin - Supplied in value for the 'AdminSshKey' key in user data

Update

• Linuxadmin - Update not supported (as it is not supported in AWS itself)
• Admin - Update Value of 'AdminSshKey' in User Data

GCP

Storage

• Linuxadmin - Part of instance Metadata
• Admin - User Data

Orchestration

• Linuxadmin - In SSH Keys section:
  • Block Project Wide SSH Keys
  • Supply key in the form ssh-rsa ... linuxadmin
• Admin - Supplied in value for the 'AdminSshKey' key in user data

Update

• Linuxadmin - Update the key against Username 'linuxadmin' in SSH keys
• Admin - Update Value of 'AdminSshKey' in User Data

Azure

Storage

• Linuxadmin - Part of instance Metadata (Orchestration) or User Data (Update)
• Admin - Custom Data (Orchestration) or User Data (Update)

Orchestration

• Linuxadmin -Suplied via --ssh-key-values flag
• Admin - Supplied in value for the 'AdminSshKey' key in Custom Data

Update

• Linuxadmin - Attach User Data to the Azure instance, and add the updated key as: "LinuxadminSshKey": "ssh-rsa YYYYYY",
• Admin - Attach User Data to the Azure instance, and update value of 'AdminSshKey'