RedMax EXtreme EX-LRT Guía para resolver problemas descargar pdf (Pagina 34)

Oracle SBC Security Guide

The following IKEv1 functionality is supported:

 IKE pre-shared secret support

 IKE/ISAKMP Main Mode support

 IKE/ISAKMP Aggressive Mode support

 Phase 2 Quick Mode support

In addition, with IKEv1 enabled, the SBC can support IPsec between itself and an endpoint behind a NAT

device.

Configuration is detailed in Section 15 “Security” of the ACLI Configuration Guide.

Call Admission Control (CAC)

Call Admission Controls are used to limit the number of allowed resources such as bandwidth or sessions

to abide by customer Service Level Agreements (SLA) and to avoid abuse. It is recommended that

wherever possible these features be enabled:

 Bandwidth (codec) based – for bandwidth CAC settings see “Media Profiles”

 SIP Per-User CAC

 Session Capacity

 Session Rate (sustained and burst)

Bandwidth CAC

Bandwidth based CAC can be implemented though a media profile on the realm level. Media profiles

specify or limit the range of the codecs, bandwidth, and packet rate used. Configuration is detailed in

Section 4 “Realms and Nested Realms” of the ACLI Configuration Guide.

SIP Per-User CAC

When SIP per-user CAC is enabled the SBC changes its default behavior so that it will only allow the

configured number of calls or total bandwidth to and from each individual user in a particular realm. CAC

can be applied to an individual Address of Record (AoR) or IP address. Tracking based on IP address can

cause complications if a NAT is involved, so the use of a nat-trust-threshold may be required to set the

maximum number of untrusted endpoints behind NAT devices. This also enables the ability of the SBC to

track endpoints based on both IP and the TCP or UDP port in use.

Configuration is detailed in Section 5 “SIP Signaling Services” of the ACLI Configuration Guide.

Session Capacity and Session Rate using Constraints

Constraints are a CAC method that limits messaging based on session count and rate. Constraints can be

applied to SIP interfaces or realms. It is recommended that constraints are used on all external interfaces

and core session-agents.

A session-agent can be configured for max-outbound-sessions, max-sessions, max-burst-rate and max-

sustain-rate.

Max-outbound-sessions and max-sessions give the max number of allowed concurrent sessions. These

should be set to match what should be sent to an upstream session-agent (for example a service provider)

or accepted into a core session-agent.

1 2 ... 29 30 31 32 33 34 35 36 37 38 39 ... 141 142

Sin comentarios

RedMax EXtreme EX-LRT Guía para resolver problemas Pagina 34