D-Link DFL-860-IPS-12 Product Manual - Page 272
Scenario 3, Protecting proxy and local clients - Proxy on the DMZ interface, Solution B - Without NAT
View all D-Link DFL-860-IPS-12 manuals
Add to My Manuals
Save this manual to your list of manuals |
Page 272 highlights
6.2.8. The SIP ALG Chapter 6. Security Mechanisms If Record-Route is enabled then the Source Network for outbound traffic from proxy users can be further restricted in the above rules by using "ip_proxy" as indicated. When an incoming call is received, the SIP ALG will follow the SAT rule and forward the SIP request to the proxy server. The proxy will in turn, forward the request to its final destination which is the client. If Record-Route is disabled at the proxy server, and depending on the state of the SIP session, the SIP ALG may forward inbound SIP messages directly to the client, bypassing the SIP proxy. This will happen automatically without further configuration. Solution B - Without NAT Without NAT, the outbound NAT rule is replaced by an Allow rule. The inbound SAT and Allow rules are replaced by a single Allow rule. OutboundFrom Proxy&Clients InboundTo Proxy&Clients Action Allow Allow Src Interface lan wan Src Network lannet (ip_proxy) all-nets Dest Interface Dest Network wan all-nets lan lannet (ip_proxy) If Record-Route is enabled then the networks in the above rules can be further restricted by using "(ip_proxy)" as indicated. Scenario 3 Protecting proxy and local clients - Proxy on the DMZ interface This scenario is similar to the previous but the major difference is the location of the local SIP proxy server. The server is placed on a separate interface and network to the local clients. This setup adds an extra layer of security since the initial SIP traffic is never exchanged directly between a remote endpoint and the local, protected clients. The complexity is increased in this scenario since SIP messages flow across three interfaces: the receiving interface from the call initiator, the DMZ interface towards the proxy and the destination interface towards the call terminator. This the initial messages exchanges that take place when a call is setup in this scenario are illustrated below: 272