RedMax EXtreme EX-LRT Guía para resolver problemas descargar pdf (Pagina 35)

Oracle SBC Security Guide

The session-agent's max-burst-rate and max-sustain-rate are used to throttle the calls per second (CPS) of

traffic sent to and by that session-agent. Each of these parameters has its own configurable window by

which the statistics are gauged for constraint exceptions.

For the sustained-rate, the average is calculated over the previous window (equal to the sustained-rate-

window) and current "window fragment." The "window fragment" will be between 0 and the configured

sustained-rate-window upon receipt of an Invite. Once the window fragment increments and reaches the

sustained-rate-window, this rotates and becomes the "previous window" -- and a new window fragment

begins at 0. At this point all calculations are recalibrated accordingly.

For example, consider the case where the sustain-rate is set to 15 and the sustain-rate-window is set to 10

seconds. When an invite is received the SD will add the amount of Invites received in the current window

fragment and the previous window and divide by the number of seconds to get the average for that period.

This average is then compared to the 15 CPS derived from the sustain-rate and the sustain-rate window. If

the session-agent per the previous and current window is above 15 CPS when the Invite is received, the

Invite will be rejected.

The max-burst-rate and burst-rate-window interact by limiting the CPS rate for a burst of traffic over the

window. Using the example below, with a max-burst-rate of 20 and a burst-rate-window of 10, the SD

will permit 200 sessions within the first 10 seconds and then reject all new sessions until it exits

constraint mode.

Burst rate is much easier to understand and configure, so it is preferable over sustain rate.

As for a session-agent in constraint, it does not come out of constraint mode when traffic drops below its

constraint thresholds; it comes out of constraint mode after 60 seconds, unless a configured time-to-

resume value dictates otherwise. Even though the session-agent is out of the constraint mode after time-

to-resume seconds “show sipd agent” will show it back into In-Service mode only if the traffic flows to or

from that session-agent. On exceeding its constraint the session-agent is marked “C”.

Core registrars should have a max registration burst rate configured to the maximum rate (or just below)

what the registrar can handle.

Configuration is detailed in Section 5 “SIP Signaling Services” and Section 12 “Admission Control and

Quality of Service Reporting” of the ACLI Configuration Guide.

Media Policing

Media policing controls the throughput of individual session media flows (RTP and RTCP) in the SBC. It

also allows the SBC to police static flows. It is recommended to enable media policing to protect against

RTP media flooding and bandwidth piracy.

For each individual codec being used in sessions, a media-profile must be created with average-rate-limit

thresholds configured.

Configuration is detailed in Section 15 “Security” of the ACLI Configuration Guide.

DoS/DDoS Prevention

DoS and DDoS settings can protect against malicious and non-malicious SIP flooding attacks from

untrusted sources without adversely affecting service to trusted peers.

1 2 ... 30 31 32 33 34 35 36 37 38 39 40 ... 141 142

Sin comentarios

RedMax EXtreme EX-LRT Guía para resolver problemas Pagina 35