Proxy/Gateway/Border Controller Security Options

Proxy/Gateway/Session Border Control Inside the Firewall occurs when during VoIP call setup, the ports and addresses require a detailed inspection (sometimes referred to as a Stateful Inspection) as the setup progresses. If the firewall does not support dynamic ACL [Access Control Lists] based on the inspection, Proxy and Gateway Servers can be used just inside the firewall. In regard to SBC, there are arguments on placing SBC Inside (behind) the firewall, outside or at the carrier (service provider).

Proxy in Co-Edge (2-edge) Mode is the situation where local interior IP addresses that must be translated to valid exterior IP addresses. The firewall must be capable of decoding and translating all addresses passed in the various VoIP protocols. If the firewall is not capable of this translation task, a Proxy Server may be placed next to the firewall in a Co-edge Mode. In this configuration, interfaces lead to both inside and outside networks. To avoid exposing a network to unsolicited traffic, configure the Proxy to route only proxied traffic. In other words, the Proxy Server routes only VoIP protocol traffic that is terminated on the inside and then repeated to the outside.

Proxy/Gateway Outside the Firewall is if the firewall does not support VoIP dynamic ACL. The firewall can be configured with static ACL that allow traffic from the Proxy/Gateway Servers through the firewall. This poses a security risk if a hacker can spoof, or simulate the IP addresses of the Proxy/Gateway Servers and use them to attack their own network.

Please see other TECHtionary tutorials on IP Security or SS7. In VoIP security, there are two primary network issues - Signaling Path (in green) and Media Path (in purple). The Signaling Path shown here comes from control of TCP [Transmission Control Protocol] issues explained next. Media Path control comes from protection of the conversation contained in IP [Internet Protocol] packets.

See in-depth tutorials on this topic and more at TECHtionary.com.