The SIP firewall can assist you in detecting failed SIP connections to the SBC.

  • The general concept is the SIP firewall is made up of rules that will either LOG or BLOCK the offender exceeding the failed attempts.
  • These rules can be targeted towards every IP and User Agent, or only certain User Agents or IPs.
  • As well these rules can be associated with all SIP profiles or certain SIP profiles.

SIP Firewall Configuration

To start the configuration go to Configuration->Security->SIP Firewall then

  • click Add to add rule in the SIP Security Monitor – Rules section.

Sangoma SBC SIP Firewall

  • Specify the name for the new rule, then click Add.

Sangoma SBC SIP Firewall Add

The rule below will look for any single source IP exceeding 20 failed attempts over 10 minutes.

  • If a certain IP exceeds this then it will be blocked.
  • The Action Parameter is set to 0 so this will block the host forever,
    • if you would like the host to be blocked for 15 minutes set the Action Parameter to 15.

Sangoma SBC SIP Firewall Rule

If you want to keep all blocked users in your own 3rd party firewall you can let the SBC block the IPs then check the status of the blocked users as shown below.
Or you can write to the log file and have a utility which checks the NSC logs for these entries and act on this.

The log file is /var/log/sipsecmon.log on the unit or in the WebUI go to Reports->System->NSC Logs then click on SIP Security Monitor.

SIP Firewall Logging

To configure the log level click edit under the SIP Security Monitor Configuration.

Sangoma SBC SIP Firewall Logging

  • On the next page the log level can be set to Information or Debug, once set click save to exit.

Sangoma SBC SIP Firewall Logging Set

  • To apply the changes click Configuration Modified then click Apply & Reload.

Sangoma SBC SIP Firewall Apply

SIP Firewall Status

To get the status of blocked IPs on the SBC go to Overview->Security->SIP Firewall Status and the list of blocked IPs will be there.

Sangoma SBC SIP Firewall Status

¿Necesitas más ayuda?
No dudes en ponerte en contacto con nosotros aquí.

¿Te resultó útil?

No
Has indicado que este tema no te resultó útil...
¿Puedes decirnos por qué? ¡Gracias!
Gracias por darnos tu opinión.