Using VPN (IP-Sec) is a completely different way to provide a secure VoIP solution. Using already well-established encryption tunnel technologies, a secure tunnel is created between the remote phone and the IP‑PBX.

In this example, the IP‑PBX resides behind a typical network firewall. The firewall is the border element between the Internet and LAN. The remote phone is located on a remote network across the Internet and the remote phone is establishing a VPN (IPSec) tunnel to the IP‑PBX. VPN (IPSec) is a network protocol suite that authenticates and encrypts the packets of data sent over the network. The firewall is relaying the VPN (IPSec) tunnel from the remote phone to the IP‑PBX.

In this example, the IP‑PBX resides behind a firewall, the firewall is the border element between Internet (or untrusted network zones) and Local Area Networks (or trusted zones). The firewall is a network security device and will forward the VPN (IPSec) traffic from the remote phone to the IP‑PBX.

If you enjoyed this blog, and would like to learn more about Security Best Practices for VoIP, download our whitepaper here: sangoma.com/voip-security-best-practices/

A remote phone deployment in branch offices or work-at-home employees is completely different than SIP trunking. Remote phones are dynamic in location, and require significantly more calling features. Remote phones cannot be considered as peers, as phones register for services and change IP addresses often, across multiple devices and locations.

Remote phones require automatic provisioning with file servers and possibly require web access and REST API access to the IP‑PBX. The interconnectivity between remote phones and a IP‑PBX is complicated with many communication requirements.

The application of security solutions involves providing a firewall solution that is used to define the remote phone to IP‑PBX relationship between various networks using VoIP application layers, file provisioning, and other services, while ensuring signaling and media are secure. Meanwhile, remote phones most often are located behind other firewalls, presenting additional communication issues.

In this example, the IP‑PBX resides behind a typical network firewall. The Firewall is the border element between the Internet (or untrusted network zones) and Local Area Networks (or trusted zones). The remote phone is located on a remote network across the Internet. The firewall is monitoring network traffic and decides whether to allow or block specific traffic based on a defined set of security rules.

Firewall Features & Setup

The firewall controls the traffic by redirecting SIP signaling and audio media streams to the defined destinations. In this solution, the firewall is controlling communications for allowing SIP VoIP traffic from remote phones to be directed to the IP‑PBX.

If you enjoyed this blog, and would like to learn more about Security Best Practices for VoIP, download our whitepaper here: sangoma.com/voip-security-best-practices/

As discussed in my previous blog, SIP trunking is often a peer-to-peer connection for the primary use of delivering PSTN connectivity over VoIP, and is delivered over a couple of different methods using ITSPs and Managed Service Providers.

In this blog, I’ll be addressing a Session Border Controller (SBC) element that is used to define the peer-to-peer relationship at various networks and VoIP application layers, and additionally ensuring signaling and media are secure as well.

IP-PBX with SBC

In this example, the IP-PBX resides behind an SBC. The SBC is the border element between Internet (or untrusted network zones) and Local Area Networks (or trusted zones). The SBC is a network security device as well as a VoIP security device that monitors incoming and outgoing network and voice traffic and decides whether to allow or block specific traffic based on a defined set of network and voice security rules.

SBC Features & Setup

The SBC controls the voice traffic by processing SIP signaling and audio media streams to the defined destinations. SBCs typically use B2BUA technology for processing SIP traffic. In this solution, the SBC is intelligently controlling communications for allowing SIP trunk traffic from carriers, to be directed to the IP‑PBX.

There are many VoIP Security features the SBC adds to the SIP trunk call flow. One of the SBCs primary functions is to provide VoIP security, analyzing and protecting mission critical VoIP applications from malicious activity, so these mission critical applications are protected from direct attacks. There are several different security features on the SBC to ensure complete coverage.

If you enjoyed this blog, and would like to learn more about Security Best Practices for VoIP, download our whitepaper here: sangoma.com/voip-security-best-practices/

SIP Trunking is often a peer-to-peer connection for the primary use of delivering PSTN connectivity over VoIP. SIP Trunking is delivered over a couple of different methods:

Internet Telephony Service Providers (ITSP)

• Deliver SIP Trunking over the Internet

Managed Service Providers (MSP)

• Deliver SIP Trunking over the dedicated carriers WAN connections

The application of security solutions involves providing a firewall in combination with an IP‑PBX that’s used to define the peer-to-peer relationship at various networks and VoIP application layers, and also ensuring signaling and media are secure as well.

In the example above, the IP‑PBX resides behind a typical network firewall. The firewall is the border element between Internet or Untrusted Network Zones and Local Area Networks or Trusted Zones. The firewall is a network security device that monitors incoming and outgoing network traffic and decides whether to allow or block specific traffic based on a defined set of security rules.

If you enjoyed this blog, and would like to learn more about Security Best Practices for VoIP, download our whitepaper here: sangoma.com/voip-security-best-practices/