Ehangcom Vianet Internet SBC Firewall Adaptation

In order to ensure network security, enterprises generally deploy various firewalls as edges and isolated devices, separating the trust and untrusted networks (generally extranet untrusted, intranet trust) of enterprises and avoiding direct access. At the same time, the firewall also has NAT function, hiding the intranet and proxy the intranet access to the extranet.

PrefaceIn order to ensure network security, enterprises generally deploy various firewalls as edge and isolation devices to separate the enterprise's trusted and untrusted networks (generally, the external network is untrusted and the internal network is trusted) to avoid direct access. At the same time, the firewall has both NAT Function, hide the internal network and proxy the access from the internal network to the external network.Due to the presence of firewalls, deployment SBC becomes more complex. In some cases, the cooperation of a firewall is required to complete SIP Firewall for signaling and voice flows/NAT penetrate.Just the firewall and SBC The location relationship is generally divided into two modes: near-end firewall, that is SBC Within the firewall, the connected device is outside the local firewall or inside the remote firewall; the remote firewall is SBC Outside the firewall, the connected device is inside the firewall.In these two modes, Ehangcom Vianet Internet SBC Both can complete the correct penetration of signaling and media.1. Introduction to the plan1, overviewEhangcom Vianet Internet SBC The impact of near-end and remote firewalls on signaling and media is fully considered. At the signaling level, theFrom/To/Contact/rport/SDP wait IP ,The address is processed to reflect the actual docking address to avoid problems such as signaling failure, off-hook timeout, and continuous on-hook.at the same time,SBC support OPTIONS/REGISTER Waiting for heartbeat mode (receiving or sending), used to maintain the firewall session(keep-alive), ensure firewall/NAT ,The ports are available and unchanged.The media identifies the remote IP/PORT, and then add this IP/PORT Methods for sending media packets to achieve various NAT penetration of the situation.Reasonable firewall penetration methodfirewall/NAT ,There are various modes and corresponding penetration methods. However, a more reasonable way to penetrate is from the firewall to the external network IP/P