Manualshelf

User`s manual

ManualsBrandsAudioCodes ManualsNetworkingMediant 1000
321322323324325326327328329330
H.323 User's Manual 13. Security
Version 5.0 321 December 2006
13 Security
This section describes the security mechanisms and protocols implemented on the Mediant
1000. The following list specifies the available security protocols and their objectives:
IPSec and IKE protocols are part of the IETF standards for establishing a secured IP
connection between two applications. IPSec and IKE are used in conjunction to
provide security for control and management protocols but not for media (refer to
Section 13.1 below).
SSL (Secure Socket Layer) / TLS (Transport Layer Security) – The SSL / TLS
protocols are used to provide privacy and data integrity between two communicating
applications over TCP/IP. They are used to secure the following applications: Web
access (HTTPS) and Telnet access (refer to Section 13.2 on page 330).
RADIUS (Remote Authentication Dial-In User Service) - RADIUS server is used to
enable multiple-user management on a centralized platform (refer to Section 13.3 on
page 334).
Internal Firewall allows filtering unwanted inbound traffic (refer to Section 13.4 on
page 337).
13.1 IPSec and IKE
IPSec and IKE protocols are part of the IETF standards for establishing a secured IP
connection between two applications (also referred to as peers). Providing security
services at the IP layer, IPSec and IKE are transparent to IP applications.
IPSec and IKE are used in conjunction to provide security for control and management
(e.g., SNMP and Web) protocols but not for media (i.e., RTP, RTCP and T.38).
IPSec is responsible for securing the IP traffic. This is accomplished by using the
Encapsulation Security Payload (ESP) protocol to encrypt the IP payload (illustrated in
Figure 13-1 below). The IKE protocol is responsible for obtaining the IPSec encryption keys
and encryption profile (known as IPSec Security Association (SA)).
Figure 13-1: IPSec Encryption
Note: IPSec doesn’t function properly if the gateway’s IP address is changed on-
the-fly due to the fact that the crypto hardware can only be configured on
reset. Therefore, reset the gateway after you change its IP address.