Oracle SBC Security Guide
</route>
</localRoutes>
Once the configuration has been saved and activated, the LRT file contents can be confirmed by
executing the command “show lrt route-entry blacklist 3712900” at the ACLI (or any of the other
blacklist prefixes, or numbers that contain the prefix).
Next, the dummy session agent must be set up. The hostname must match the LRT host entry. Note that
the response-map AND local-response map are required to identify blacklisted calls vs. just valid errors.
Make sure the session-agent state is disabled so traffic or error messages are not sent to a real host. It
should be noted that use of a real hostname will not work due to the way DNS resolution works in
conjunction with disabled session-agents.
session-agent
hostname 10.11.12.13
ip-address
port 5060
state disabled
app-protocol SIP
app-type
transport-method UDP
realm-id
response-map 503Fraud
local-response-map 503Fraud
Next, map the error to an error code we can identify and log / reject for trap.
session-router > sip-response-map
response-map
last-modified-date 2012-10-26 17:06:07
name 503Fraud
entries 503 -> 678 (Fraud)
On the access realm, the out-manipulationid should reference the “logBlacklist” HMR below. Note that if
there is already an outbound HMR in place that the header rules below can be added to the existing HMR.
sip-manipulation
name logBlacklist
description
split-headers
join-headers
header-rule
name logBlacklist
header-name @status-line
action manipulate
comparison-type case-sensitive
msg-type reply
methods
match-value
new-value
(Log the call that matched the blacklist to a local file “matched.log” on the SBC)
Comentarios a estos manuales