Oracle SBC Security Guide
trans-protocol-match UDP
direction both
local-ip-mask 255.255.255.255
remote-ip-mask 0.0.0.0
action srtp
ike-sainfo-name
outbound-sa-fine-grained-mask
local-ip-mask 0.0.0.0
remote-ip-mask 255.255.255.255
local-port-mask 0
remote-port-mask 65535
trans-protocol-mask 255
valid enabled
vlan-mask 0xFFF
last-modified-date 2010-07-20 04:59:53
High Availability
In order for SIP and SRTP to work properly in the HA environment, both sip-config and ipsec-global-
config elements should be configured.
The ipsec-global-config element enables the secured process to update the Security Associations on both
the active and standby unit for high availability. The descriptions of the parameters in the ipsec-global-
config element are as follows:
red-ipsec-port: redundant IP security synchronization port
red-max-trans: max redundant transactions to keep
red-sync-start-time: redundant sync start timeout
red-sync-comp-time: redundant sync complete timeout
ipsec-global-config
red-ipsec-port 1994
red-max-trans 10000
red-sync-start-time 5000
red-sync-comp-time 1000
sip-config
… …
red-sip-port 1988
red-max-trans 10000
red-sync-start-time 5000
red-sync-comp-time 1000
… …
Notes on the Reference Configuration
The intention of this document is not to provide a full set of configurations, as the flexibility of the SRTP
configuration makes valid a high number of different possible configurations. The objective is to present
some common and valid configurations that have been tested and verified in Oracle labs.
In the cases considered here, there is a considered “access” or “peer1A” network, in the 172.18.1.0/24
network, and a considered “core” or “peer1B” in the 172.18.2.0/24 network. In all cases SIP and media
traffic runs on the same subnets.
Comentarios a estos manuales