Johannes Weiß Die All-IP-Strategie der Carrier, direkte ... · PDF fileDie...
Transcript of Johannes Weiß Die All-IP-Strategie der Carrier, direkte ... · PDF fileDie...
Nov. 2015
Die All-IP-Strategie der Carrier, direkte oder indirekte SIP Anbindung?
Johannes WeißPre Sales DACH
AudioCodes – brief overview
• Voice Experts for over 21 years
• Manufacturing chips, boards, products
and providing solutions and services
• Global partner to leading telecom players including Alcatel-Lucent,
Avaya, Broadsoft, Microsoft, Genesys, NSN, Interactive Intelligence
• Extensive Interoperability with different PBX/IPBX systems
• Strong brand for quality & performance
Agenda
A E-SBC is an Enterprise Session Border Controller deployed and managed by the service partner or
enterprise customer to connect quickly, confidently and securely to VoIP services
Topics:
AudioCodes E-SBC Family
SIP Trunk Challenges
Benefits of AudioCodes E-SBC
E-SBC Portfolio
Mediant 500
Mediant 2600 Mediant 4000 Mediant 9000
Mediant SEMediant VE
Mediant 800B Mediant 1000B Mediant 3000
Hardware SBCs
Software SBCs
Hybrid SBCs
Same software means uniform functionalitymaking it easy to plan and deploy
Mediant 500L
Enterprise migration
Use of traditional TDM-PBX
Migration to IP-PBX or UC
E-SBC for
Interoperability
Survivability
Security
Remote Users
SLA and Quality Assurance
P B X
P S T N
S I P T r u n k
Internet
U C / I P P B X
EnterpriseData Center
Service Provider Network
SIP Trunk Provider
Internet Provider
PSTN Provider
S B C
S I P T r u n k
The different kinds of session border controllers
Enterprise Service Provider A Service Provider B
E-SB
C
Acc
ess
SBC
Peer
ing
SBC
Capability Enterprise SBC SP Access SBC SP Peering SBC
ScaleUp to 4000sessions
>=20000
Registrations data base
Few (remote workers only)
Many none
Routing Rules Hundreds Few Thousands
Peer
ing
SBC
E-SBC roles
Security
• VoIP Firewall
• Demarcation
• Topology Hiding
• Access Control
• Encryption
• Denial of Service
• Call Theft and Fraud
Connectivity
• SIP Normalization
• NAT Traversal
• Voice Mediation & Transcoding
• DTMF Conversion
• Fax Conversion
• Protocol/Coder Policing
SLA and QoS
• Call Admission Control
• QoS Monitoring and Troubleshooting
• Voice Service Assurance
• Survivability
2013 Global Fraud Loss Estimate:$46.3 Billion (USD) annually
VoIP systems make these kind of attacks much easier
Top 5 Fraud Methods Reported by Surveyed Companies:
Toll Fraud Impacts
0.00
2.00
4.00
6.00
Fraud Method
SubscriptionFraud
PBX Hacking
Account TakeOver
Source: 2013 CFCA Global fraud loss Survey
Bill
ion
(U
SD)
The most damaging form of toll fraud The idea is to exploit an IP PBX and find a way to take
an inbound call and hair-pin out to an international number
Dial-Through Fraud (DTF)
PBXITSP / Internet
Enterprise usersAttacker sells access to users who dial in and back out
Many calls generated to long distance or international destinations
1
2
3
4
Telephony denial of service attacks (TDoS) are increasing in severity and frequency
Unauthorized users flood the system with bogus access requests and prevent legitimate users from accessing the system
Keeping these calls active for long duration, the attacker prevents voice network resources from being used by legitimate callers
TDoS - Telephony Denial of Service
ITSP / InternetPBX
TDoSAttacker
Agents
Customers cannot reach the agents
AudioCodes E-SBC
Monitoring and Reporting
Data Confidentiality
and Privacy
Protection against Unauthorized
Access
Protection against Attacks
and Threats
Robust Management
Security
Gartner recommendation for securing enterprise voice:
“Implement session border controllers (SBCs) to control and log the security policies between the specific security zone for real-time voice and video communication and the other security zones.”
AudioCodes E-SBC provides an extensive set of features to protect an enterprise voice network:
Accept messages based on SIP header properties. For exp, request URI etc Filter oversized
SIP messages, unwanted SIP bodies, SIP syntax policing
Filter out SIP messages which do not belong to an open dialog
Overcome TCP vulnerabilities, perform TLS authentication
Look at the IP addresses and ports to filter unwanted packets and throttles the incoming packet rate
How Does AudioCodes E-SBC Secure SIP Traffic
Interfacing with various IP-PBXs
RFC 3261 is the largest SIP RFC
Not a ‘super tight’ spec:
”Should”: 344 times
”Can”: 475 times
”May 381” times
”Option: 144” times
Lots of room for interpretation
Media incompatibilities add to complexity
SIP implementation variances can lead to interoperability issues across multivendor systems and service provider networks
Handling these incompatibilities at the core SBC is complex and risky and may lead to service outages
Why a E-SBC on premise is needed
Voice quality is a critical factor in business satisfaction ratings
Varying service quality and availability can degrade call quality
Identifying problems in VoIP networks is difficult There is uncertainty of where the actual problems lie (at the Enterprise or the SP network)
This may lead to “finger pointing”
SIP Trunk Provider
Enterprise A
Enterprise B
Packet loss
Latency, Jitter
C4/5 Application Server
Access SBCInternet
SIP Trunk Interoperability Service
SIP Trunk Interoperability is costly and time consuming for service providers Businesses want to protect their investments in legacy communications equipment Hundreds of different solutions must be certified for interoperability On premise software upgrades requires recertifying the interoperability
AudioCodes interoperability service: Certify new IP-PBX vendors with the SIP trunk service with a 2-3 weeks SLA Assists service providers during official certification of their service with Lync
- Pre-testing: Testing in AudioCodes lab or SP labs- Official testing at certification lab (Tekvision/Wipro)
Embedded WebRTC gateway
IP Phone
AudioCodes Access SBC
Service Provider Network
SIP/WebSockets
ICE/DTLS
Opus/UDP/SRTP
SIP/TLS
SRTP
Embedded WebRTCGateway
WebRTC allows1. Single wireline number
across all devices phone, tablet, desktop and mobile phone
2. Click2Call for support (contact centers)
Application Server