Afternoon all,
Trying to get some opinion on how (if) you would put up a perimeter to
your UCM clusters to bring in 3rd party clients, softphones, etc, that are SIP
based and reside outside of your secured LAN? Most of our desktops are on
public addresses, not behind any particular hardware firewall, just software on
the host. I'm concerned that the host could be compromised, or as seen with
some soft clients, they just get harassed by driveby SIP/H.323 scans and calls.
I haven't seen any great justification for trying to fence/proxy
connectivity to the UCM for Jabber, X-Lite, etc, to the cluster, but general
security practice is saying that if you can make it more secure, it is at least
worth looking into.
I've looked at trying to set the UBE up for proxy/passthrough
registrar, and this seems tedious because it doesn't proxy auth and requires
dial-peer configuration (making dual usage as a gateway cumbersome). I have
heard "use expressway" a few times but have no idea how that would work for 3rd
party SIP devices. Other than that, I spent a bit of time looking at stuff from
Edgewater, OpenSIPS, etc, but it is not clear to me if any of these products
are worth the trouble, and what the Cisco recommended way to go about this is.
Anyone have any experience or thought in this area? Is this a bad idea?
Anything to say about trying to secure potentially 'untrusted' connectivity on
a larger scale?
Regards,
Adam Pawlowski
SUNYAB
_______________________________________________
cisco-voip mailing list
[email protected]
https://puck.nether.net/mailman/listinfo/cisco-voip
