<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<base href="x-msg://156/">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
Border device highly recommended.
<div><br>
</div>
<div>All NAT inspection engines are not keeping up with protocol updates. This article is dated but still relevant:</div>
<div><a href="https://supportforums.cisco.com/docs/DOC-8131">https://supportforums.cisco.com/docs/DOC-8131</a></div>
<div><br>
</div>
<div>Even with that NAT does not proxy TCP data so any TCP retransmission. See:</div>
<div>CSCso34072 NAT TCP re-assemby of skinny packets causes fragmentation <br>
</div>
<div>for some background. IOS first attempted to implement a proxy to store bytes for TCP retransmit on either side but that was unscalable and backed out.</div>
<div><br>
</div>
<div>NAT/PAT will not work with IOS if TCP retransmits are involved AFAIK.</div>
<div><br>
</div>
<div>Regards,</div>
<div>Wes</div>
<div><br>
</div>
<div>
<div>
<div>On Oct 12, 2013, at 6:41 AM, Tim Smith <<a href="mailto:tim.smith@enject.com.au">tim.smith@enject.com.au</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div lang="EN-AU" link="#0563C1" vlink="#954F72" style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; ">
<div class="WordSection1" style="page: WordSection1; ">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(58, 58, 58); ">Hi Ahmed,<o:p></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(58, 58, 58); "> </span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(58, 58, 58); ">When you say different organizations, do you mean other CUCM systems? SIP / H323 systems etc?<o:p></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(58, 58, 58); ">If so it’s perfect use for CUBE and / or trusted relay points.<o:p></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(58, 58, 58); "> </span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(58, 58, 58); ">I would definitely not let other organizations right into my network on such a broad range of ports.<o:p></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(58, 58, 58); ">You should try and force them through a demarcation point that you can control.<o:p></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(58, 58, 58); ">You want the media to flow through this device. This way you only have to let them talk to your CUBE, and your CUBE can reach everyone inside your network on their behalf.<o:p></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(58, 58, 58); "> </span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(58, 58, 58); ">The other complication this gets around is NAT, and routing issues. I.e. without this type of setup, you would both have to have fairly full knowledge of each others networks,
and also avoid overlaps.<o:p></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(58, 58, 58); "> </span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(58, 58, 58); ">It’s been a while since I’ve looked at security on routers.<o:p></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(58, 58, 58); ">However, NBAR and ACL’s are typically used in class maps in QoS to identify traffic and apply QoS policies<o:p></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(58, 58, 58); "> </span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(58, 58, 58); ">You do have inspection as an option on Cisco routers as well. Used to be called CBAC, I think it’s just IOS Firewall now. It can inspect SIP, SCCP, H323 from memory, and
open up pinholes where required.<o:p></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(58, 58, 58); "> </span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(58, 58, 58); ">My recommendation is look at some smart border device. I would be mandating SIP if possible and use CUBEs.<o:p></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(58, 58, 58); "> </span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(58, 58, 58); ">There are lots of improvements and fun stuff planned for the edge and this sort of connectivity coming soon too.<o:p></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(58, 58, 58); "> </span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(58, 58, 58); ">Hope that helps a bit.<o:p></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(58, 58, 58); "> </span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(58, 58, 58); ">Cheers,<o:p></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(58, 58, 58); "> </span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(58, 58, 58); ">Tim</span><span lang="EN-US" style="font-size: 8.5pt; font-family: Verdana, sans-serif; color: rgb(241, 90, 35); "><o:p></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(58, 58, 58); "> </span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<b><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; ">From:</span></b><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; "><span class="Apple-converted-space"> </span>cisco-voip [mailto:cisco-<a href="mailto:voip-bounces@puck.nether.net">voip-bounces@puck.nether.net</a>]<span class="Apple-converted-space"> </span><b>On
Behalf Of<span class="Apple-converted-space"> </span></b>Ahmed -Y<br>
<b>Sent:</b><span class="Apple-converted-space"> </span>Saturday, 12 October 2013 7:53 AM<br>
<b>To:</b><span class="Apple-converted-space"> </span><a href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a><br>
<b>Subject:</b><span class="Apple-converted-space"> </span>[cisco-voip] Fwd: RTP permission and related attacks/threats<o:p></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<o:p> </o:p></div>
<div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<o:p> </o:p></div>
<div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
HI Guys,<o:p></o:p></div>
<div>
<p style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; ">
I have to permit RTP traffic from internal network to other organizations (under different management) on gateway devices (routers, switches). I am curious to know if there are known attacks/threats when upd range 16384-32767 is permited. RTP source/destination
can be desk phone or PC with softphone. If yes then can we configure gateway routers/switches to protect from these attacks.<o:p></o:p></p>
<p style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; min-height: 8pt; ">
<o:p></o:p></p>
<p style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; ">
We have cisco 7200, 6500, 3550, 3560, 3750 switches as gateway devices.<o:p></o:p></p>
<p style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; min-height: 8pt; ">
<o:p></o:p></p>
<p style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; ">
One more quick question are there only two ways (NBAR and ACL with udp range) on routers/switches to identify/match RTP traffic? I know Firewalls provide feature like inspect, AGL etc to dynamically identify RTP ports by inspecting control traffic.<o:p></o:p></p>
<p style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; min-height: 8pt; ">
<o:p></o:p></p>
<p style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; ">
Your input will be highly appreciated<o:p></o:p></p>
<p style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; min-height: 8pt; ">
<o:p></o:p></p>
<p style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; ">
Regards<o:p></o:p></p>
</div>
</div>
</div>
</div>
_______________________________________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a><br>
https://puck.nether.net/mailman/listinfo/cisco-voip</div>
</div>
<br>
</div>
</body>
</html>