RedMax EXtreme EX-LRT Guía para resolver problemas descargar pdf (Pagina 42)

Oracle SBC Security Guide

The following sip-interface->sip-ports parameter SHOULD be used for Peering

environments.

Setting “allow-anonymous” to agents-only will allow the SBC to reject requests sent by any IP which has

not yet been defined as a “Session-Agent” in the SBC configuration. In Peering configurations, the

customer SHOULD define each IP of a peer’s device as a “session-agent” for optimal purpose.

Parameter

Peer Realm

Core Realm

allow-anonymous

agents-only

all

Although it is not recommended, but it is still possible to allow packets from an IP that has not yet

defined as a Session-Agent, by setting “allow-anonymous” to “all”. In this setup, the SBC will simply

allow the request under DDoS threshold opposed to rejecting it with a 403 Forbidden response.

Session Agent and Access-Control

Any peering signaling device SHOULD be defined as a Session-Agent in SBC configuration. Further, for

proper DDoS prevention, it requires explicitly configuring one access control per address of each Session-

Agent address or other address (that has not yet been defined as a session-agent).

session-router->session-agent

Parameter

Realm

realm-id

peer

constraints

enabled

[optional]

max-sessions

max-burst-rate

max-sustain-rate

time-to-resume

60 sec

burst-rate-window

1 sec

sustain-rate-window

30 sec

There is no demotion event when access-control-trust-level in the realm-config is set “high” as packets

from the trusted peer endpoint are always allocated in the trusted queue for processing. It becomes a

concern when there is excessive amount of SIP traffic sent by a customer which is beyond the SLA.

Session constraints under session-agent can be deployed to further mitigate this problem. Listed above are

a small set of constraints to provide basic level of call admission control in order to ensure that a session-

agent’s capacity is not exceeded, or the SBC will reject the service with 503 Exceed Constraints. Please

be advised that these settings are only optional. Customers may consider them when deploying their

service in a Peering environment with or without DDoS configuration.

 max-sessions –X

Define a maximum number of sessions (inbound and outbound) allowed by the session agent.

Once the session limit is reached, the SBC will start rejecting new service with 503 Exceed

Constraints until the number of seconds in time-to-resume has elapsed.

 max-burst-rate –Y

1 2 ... 37 38 39 40 41 42 43 44 45 46 47 ... 141 142

Comentarios a estos manuales

Sin comentarios

RedMax EXtreme EX-LRT Guía para resolver problemas Pagina 42

Comentarios a estos manuales

Relacionado con productos y manuales para Cortadoras De Césped RedMax EXtreme EX-LRT