Oracle SBC Security Guide
action add
comparison-type boolean
msg-type request
methods
match-value $isScanner.$0
new-value "<sip:10.12.13.14;lr>"
Whitelisting known User-Agents
A similar HMR is used here. The first header rule is replaced with one that uses a logical OR with
multiple values, but its regular expression match is for valid User-Agents. If a valid User-Agent match is
found, it is stored. The expressions used can match a part of the User-Agent string, and can be as specific
(or unspecific) as required. The final rule has been modified to insert the invalid route if a valid User-
Agent was NOT found.
WARNING
If endpoint firmware is updated and the User-Agent string changes then the whitelist rule may start failing
and endpoints will be denied. Make sure to perform lab testing prior to any endpoint software updates.
sip-manipulation
name AddRoutHdr
description
split-headers
join-headers
header-rule
name whitelist
header-name User-Agent
action store
comparison-type pattern-rule
msg-type out-of-dialog
methods
match-value (Bria Professional release 2.4.3
stamp 50906|UCCAPI|Avaya SIP R2.2
Endpoint Brcm)
new-value
header-rule
name addNullRoute
header-name Route
action add
comparison-type boolean
msg-type request
methods
match-value !($whitelist.$0)
new-value "<sip:10.12.13.14;lr>
Realm: The access realm-config must also be modified to assign the SIP manipulation rule defined above
as the inbound manipulation. Add the addRouteHdr manipulation for both fraudulent and whitelisting
scenarios.
realm-config
identifier access
description Serving all access endpoints
.
.
Comentarios a estos manuales