Switching to VoIP

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

Intrusion Prevention and Monitoring

|

237

• In order for an RTP call path to exist between the PSTN gateway and the IP

phone, no rules need to be set up on the firewall, since both are on the same seg-

ment.

• As a matter of course, all hosts accessing services on the DMZ should have the

ability to resolve DNS hostnames, and so TCP and UDP port 53, for DNS, should

be permitted from 10.1.1.10 and 10.1.1.103 to the DNS server, 28.26.11.5.

At this point, assuming the VoIP network itself is configured to handle the calls via

dial-plans and channels, and so on, PSTN subscribers can call the IP phone, and the

IP phone can call the PSTN, even though the SIP proxy is on the DMZ. But what was

really accomplished through all this was security. Use a similar exercise to identify

the additional TCP/IP traffic flows required to support an Internet-based SIP calling

application through firewall A:

• In order to communicate with Internet-based SIP hosts, the SIP proxy at 28.26.11.4

must be able to send and receive SIP traffic (UDP ports 5060 and 5061).

• In order to provide DNS name resolution for SIP services, the DNS server at

28.26.11.5 must be able to send and receive DNS traffic (TCP and UDP port

53) to and from the Internet.

• The SIP proxy can already communicate with the IP phone and the PSTN