Elastix SIP Firewall Manuel utilisateur

Elastix SIP Firewall

User Manual

Copy Right

No part of this publication may be copied, distributed, transmitted, transcribed, stored in a retrieval system,

or translated into any human or computer language without the prior written permission of

http://www.elastix.org. This document has been prepared for use by professional and properly trained

personnel, and the customer assumes full responsibility when using it.

Proprietary Rights

The information in this document is Confidential to Elastix®and is legally privileged. The information and

this document are intended solely for the addressee. Use of this document by anyone else for any other

purpose is unauthorized. If you are not the intended recipient, any disclosure, copying, or distribution of this

information is prohibited and unlawful.

Disclaimer

Information in this document is subject to change without notice and should not be construed as a

commitment on the part of http://www.elastix.org. And does not assume any responsibility or make any

warranty against errors. It may appear in this document and disclaims any implied warranty of

merchantability or fitness for a particular purpose.

1.1. About this manual

This manual describes the Elastix® product application and explains how to work and use

it major features. It serves as a means to describe the user interface and how to use it to

accomplish common tasks. This manual also describes the underlying assumptions and

users make the underlying data model.

1.1. Document Conventions

In this manual, certain words are represented in different fonts, typefaces, sizes, and

weights. This highlighting is systematic; different words are represented in the same style

to indicate their inclusion in a specific category. Additionally, this document has different

strategies to draw User attention to certain pieces of information. In order of how critical

the information is to your system, these items are marked as a note, tip, important,

caution, or warning.

Icon!

Purpose!

Note!

Tip/Best!Practice!

Important!

Caution!

Warning!

•Bold indicates the name of the menu items, options, dialog boxes, windows and

functions.

•The color blue with underline is used to indicate cross-references and hyperlinks.

•Numbered Paragraphs - Numbered paragraphs are used to indicate tasks that need

to be carried out. Text in paragraphs without numbering represents ordinary

information.

•The Courier font indicates a command sequence, file type, URL, Folder/File name

e.g. http://www.elastix.org

1.2. Support Information

Every effort has been made to ensure the accuracy of the document. If you have

comments, questions, or ideas regarding the document contact:

[email protected]

Table of Contents

About this manual .................................................................................................. 2

Document Conventions........................................................................................... 2

Support Information ............................................................................................... 3

1. Introduction ........................................................................................................... 6

1.1. Overview: ......................................................................................................... 6

1.1.1. Notification LEDs (On the Front Panel of the SIP Firewall) ........................ 8

1.1.2. SIP Firewall Rear View:.............................................................................. 9

1.1.3. SIP Firewall Deployment Considerations ................................................... 9

2. Initial Setup & Configuration.............................................................................. 11

2.1.Default Configuration ...................................................................................... 11

2.2. Accessing the WebUI..................................................................................... 11

2.4 WebUI Session timeout .................................................................................. 14

2.5 WebUI Settings ............................................................................................... 14

2.4 Dashboard ...................................................................................................... 15

3. Device Configuration .......................................................................................... 16

3.1. General Settings ............................................................................................ 17

3.2. Time Settings ................................................................................................. 18

3.3. Management Access ..................................................................................... 18

3.4. Signature Update ........................................................................................... 20

3.5. Logging .......................................................................................................... 20

4. Configuring the SIP Security Policies............................................................... 22

4.1. SIP Attacks Detection Policies....................................................................... 22

4.2. SIP Protocol Compliance ............................................................................... 24

4.3. Firewall Rules ................................................................................................ 26

4.4. Firewall Settings............................................................................................. 27

4.5. White list Rules .............................................................................................. 28

4.6. Blacklist Rules (Static) ................................................................................... 29

4.7. Dynamic Blacklist Rules................................................................................. 30

4.8. Geo IP Filter................................................................................................... 30

5. Status ................................................................................................................... 32

5.1. Security Alerts................................................................................................ 32

6. Tools..................................................................................................................... 33

6.1. Administration ................................................................................................ 33

6.2. Diagnostics .................................................................................................... 34

6.3. Ping................................................................................................................ 35

6.4. Trace route..................................................................................................... 35

6.5. Troubleshooting ............................................................................................. 36

6.6. Firmware Upgrade ......................................................................................... 37

6.7. Logs Archive .................................................................................................. 38

7. Appendix A – Using Console Access ............................................................... 39

8. Appendix B – Configuring SIP Firewall IP Address via Console.................... 40

1. Introduction

1.1 . Overview:

This User manual describes the steps involved in setting up the Elastix®SIP Firewall

Appliance. Elastix®SIP Firewall is an appliance based VoIP threat prevention solution

dedicated to protect the SIP based PBX/Telecom Gateway/IP Phones/Mobile device

deployments. The appliance runs the Real time Deep Packet Inspection on the SIP

traffic to identify the VOIP attack vectors and prevents the threats impacting the SIP

based devices. The appliance has been made to seamlessly integrate with the existing

network infrastructure and reduces the complexity of deployment.

The appliance feature set includes,

!Analyze SIP packets using the Realtime Deep Packet inspection engine.

!SIP Protocol Anomaly detection with configurability of detection parameters.

!Detection and Prevention of the following categories of SIP based Attacks.

•Reconnaissance attacks (SIP Devices Fingerprinting, User enumeration,

Password Cracking Attempt)

•Dos/DDos Attacks

•Cross Site Scripting based attacks.

•Buffer overflow attacks

•SIP Anomaly based attacks

•3rd Party vendor vulnerabilities

•Toll Fraud detection and prevention

•Protection against VOIP Spam & War Dialing

!Attack response includes the option for quietly dropping malicious SIP packets to

help prevent continued attacks

!Dynamic Blacklist Update service for VOIP, SIP PBX/Gateway Threats

!Configurability of Blacklist/White list/Firewall rules.

!Support for Geo Location based blocking.

!Provide the option to secure against PBX Application vulnerabilities

!Operate at Layer 2 device thus transparent to existing IP infrastructure - no changes

required to add the device to your existing network

!Web/SSL based Device Management Access which will allow managing the device

anywhere from the Cloud.

!Ability to restrict the device management access to specific IP/Network.

!Provide System Status/Security events logging option to a remote Syslog server.

!Provides the SIP throughput up to ~10Mbps.

!Support for Signature update subscription and automated signature update

mechanism.

!The device has been made to operate with default configuration with just powering

on the device. No administrator intervention is required to operate the device with

default configuration.

!USB based power supply

!Optional support for security events logging on the USB based storage.

Technical Specifications

Functional Mode

Transparent Firewall with SIP Deep Packet

Engine.

SIP Intrusion/Prevention

~400+ SIP Attack Signatures Support

Throughput

~10Mbps

No of concurrent calls supports

Up to 50 concurrent calls

Logging

Local Security Event Console, Remote Syslog

Device Management

Web GUI via Https & SSH CLI

Hardware

MIPS based 32bit Processor Single core,

300MHz

Primary Storage

16 MB Flash

RAM

64MB

Secondary Storage

USB Storage devices support for logging (

Optional)

Interfaces

Two Fast Ethernet Interfaces.

1.1.1. Notification LEDs (On the Front Panel of the SIP Firewall)

LED 4-Alert Status

Power ON/OFF LED 3-DPI Status

Button

LED 2- Interface Status

Power LED LED 1- System Status

Indicator

Figure 1: Front Panel LED Notifications

The SIP Firewall package includes:

•1 SIP Firewall Appliance

•1 USB Power Adapter

•1 Serial Console Cable

•2 Ethernet Cables

Autres manuels pour SIP Firewall

Table des matières

Autres manuels Elastix Pare-feu

Elastix

Elastix SIP Firewall Manuel utilisateur

Manuels Pare-feu populaires d'autres marques

Cisco

Cisco S190 Manuel utilisateur

Fortinet

Fortinet FortiGate Voice Series Manuel utilisateur

ADTRAN

ADTRAN NetVanta 2300 Manuel utilisateur

SecureLogix

SecureLogix ETM System Manuel utilisateur

NETGEAR

NETGEAR ProSafe FVX538 Manuel utilisateur

Lanner

Lanner FW-8877 Manuel utilisateur

Huawei

Huawei USG6000 Series Manuel d'installation et d'exploitation

H3C

H3C SecPath F5000-AI-15 Manuel utilisateur

Nexcom

Nexcom DNA 1150 Manuel utilisateur

Fortinet

Fortinet FortiGate-60 series Manuel utilisateur

Cisco

Cisco 3110 Manuel

Draytek

Draytek Vigor2860 Series Manuel utilisateur

Lanner electronics

Lanner electronics FW-7650 Series Manuel utilisateur

Swisscom

Swisscom Internet Backup Manuel utilisateur

SonicWALL

SonicWALL NSa 5700 Manuel utilisateur

DPtech

DPtech FW1000 SERIES Manuel utilisateur

FEITIAN

FEITIAN MultiPass FIDO Manuel utilisateur

EBLOCKER

EBLOCKER PRO Manuel utilisateur