RedMax EXtreme EX-LRT Guía para resolver problemas descargar pdf (Pagina 23)

Oracle SBC Security Guide

 Multi-queue access fairness for unknown traffic

 Automatic behaviorally driven promotion/demotion/denial of devices

 Per-device constraints and authorization

Each device is classified as untrusted, trusted or denied. The entire system bandwidth is allocated for the

trusted and untrusted queues according to the characteristics of the customer Access deployment (e.g.

number of endpoints, rate of registration, packet size, etc.). The allocation of the CAM is configurable to

tailor the sizes of the entries available for media, trusted and deny NAT entries according to the scale of

the customer Access network. Separate configurable sized queues also exist for fragmented packets and

ARP requests.

The trust-levels below determine promotion/demotion criteria between the deny list, untrusted and trusted

queues.

 None: Device is always untrusted, no promotion or demotion

 Low: Device is initially untrusted, can be promoted to trusted, or demoted to denied

 Medium: Device is initially untrusted, can be promoted to trusted, cannot be denied

 High: Device is always trusted

A low or medium trust level is appropriate for Access or untrusted networks (realms). In contrast, a high

trust level is appropriate only for Core or trusted networks (realms).

Promotion Criteria Examples

o SIP: 200OK received for either Register or Invite method

o MGCP: 200 received for either RSIP or CRCX

Demotion Criteria Examples

Exceeding any of the following thresholds:

 invalid-signal-threshold: maximum number of non-compliant signaling packets acceptable

 maximum-signal-threshold: maximum number of signaling packets acceptable while an

endpoint is classified as trusted

 untrusted-signaling-threshold: maximum number of signaling packets while an endpoint is

classified as untrusted

These thresholds are all measured in the configurable system wide tolerance-window (default 30s)

If an endpoint crosses one of these thresholds then a deny ACL is written to the CAM, and checked by the

Network Processors (NP) upon receipt of a packet from the denied endpoint. The endpoint is denied for a

configurable period of time.

The goal of the DDoS protection tools detailed above is to assess and plan for a configuration that allows

service to continue whether the SBC is under malicious attack or a non-malicious attack such as a

recovery from a Softswitch outage or registration flood from endpoints. This involves allowing enough

untrusted traffic such that endpoints can over time register successfully yet constraining all queues

sufficiently to protect SBC resources (i.e. core CPU threshold).

Furthermore, the SIP Registration Overload Protection (SROP) feature is used to protect the SBC against

mass endpoint avalanche restarts. The following sip-config options are recommended to be configured:

1 2 ... 18 19 20 21 22 23 24 25 26 27 28 ... 141 142

Sin comentarios

RedMax EXtreme EX-LRT Guía para resolver problemas Pagina 23