3Com V7000 manual

http://www.3com.com/ Part Number 900-0298-01 AA Published May 2005 VCX ™ Security Guide VCX ™ V7000 IP Telephony Solution System Release 6.0[...]

3Com Corporati on 350 Campus Drive Marlbor ough, MA 01752-3064 Copyright © 2004, 3Com Corporation. All r ights reser ved. No part of this do cumentation may be reproduced in any form or by any means or used to make any derivative work (such as translation, transformation , or adaptation) without written permission fr om 3Com Corporation. 3Com Corp[...]

C ONTENTS A BOUT T HIS G UIDE Conventions 1 Related Docum entation 3 Y our Comments 4 VCX S YSTEM S ECURITY Overview 5 Commands 6 Firewall Configuration 7 Example Network Configuration 7 TCP Port Access 8 Back End Server Ports 8 RTP Port Ran ge Calculations 9 UDP Port Range Calculations 9 Analog and Digital Gateway Ports 10 IP Messaging Ports 12 Pa[...]

4[...]

A BOUT T HIS G UIDE This guide describes seve ral issues related to making the VCX V7000 IP T elephony System more secur e. This guide is in tended for equipment installers and syst em administrators who have a thorough understanding of telecommunications, V oIP technology , Linux operati ng systems, Oracle databases, networks, and system administr[...]

2 A BOUT T HIS G UIDE Ta b l e 2 T ext Conventions Convention Descr iption Screen displays This typeface represents info rmation as it appears on the screen. Syntax The word “syntax” means that you must evalua te the syntax provided and then supply the appropriate val ues for the placeholders that appear in angle brackets. Example: To enable RI[...]

Related Documentation 3 Related Documentation These 3Com documents contain addi tional information about the VCX TM V7000 IP T elephony Solution products in this release. ■ VCX Business T elephone Quick Reference Guide ■ VCX Basic T elepho ne Quick Reference Guide ■ V7000 T elepho ne User Guide ■ Enterprise Management Suite User Guide , V e[...]

4 A BOUT T HIS G UIDE Y our Comments Y our suggestions are important to us because we want to make our documentation more useful to you. Please send e-mail comments about this g uide or any of the 3Com V oice Products documentation and Help systems to: VOICE_TECHCOMM_COMMENTS@3com.com Please include the following information with your comments: ■[...]

1 VCX S YSTEM S ECURITY Overview VCX V7000 IP T elephony Systems can be configur ed in a number of ways that enhance system s ecurity . 3Com recommends that anyone who is going to configure a VCX system read the latest updates on these items: ■ Advisories posted on the CERT/CC (Computer Emer gency Response T eam/Coordination Center) web site: www[...]

6 C HAPTER 1: VC X S YSTEM S ECURITY Commands T o enhance the security of VCX sy stems, these commands have been disabled: ■ ftp ■ telnet ■ tftp ■ finger ■ ident ■ rlogin ■ rsh ■ rcp T o access a VCX system remotely , you must use one of these secure commands: ■ ssh ■ sftp The first time that you try to access yo ur VCX system u[...]

Firewall Configuration 7 Fire wall Configuration 3Com recommends that you: ■ Isolate your VCX system from the Internet by configuring it behind your corporate firewall ■ Isolate your VCX system from computers inside your company by configuring it on a separate subnetwork or placing it behind an internal firewall ■ Always leave the integrated [...]

8 C HAPTER 1: VC X S YSTEM S ECURITY TCP Port Acces s Use the information in this section to configure your internal firewall. The VCX system allows remote network access to these TCP ports: Back End Server Ports The Back End Servers (Accou nting Se rver , Authentication and Directory Server) use these ports in order to provide r edundant service t[...]

TCP Port Access 9 RTP Port Range Calculations T o calculate the hi ghest RTP port number used by the VCX Unified Messaging Suite, us e this fo rmula: Highest Port Number = (Number of Ports) * 2 + (Start RTP Port -1) UDP Port Range Calculations The IP Messaging System transmits and r eceives fax information using the UDPTL protocol and uses UDP port[...]

10 C HAPTER 1: VC X S YSTEM S ECURITY Ending UDP Port Number T o calculate the ending port number in the UDP range, use this formula: UDP ending port number = (UDP S tart Port) +(Nu mber of Port s -1) Analog and Digital Gateway Ports The VCX system includes V7111 Analog Gateways for connect ion to the Public Swithced T elephone Network (PSTN) throu[...]

TCP Port Access 11 The V7122 Digital Gateways use t hese port numbers: 15 4140 4142 16 4150 4152 17 4160 4162 18 4170 4172 19 4180 4182 20 4190 4192 21 4200 4202 22 4210 4212 23 4220 4222 24 4230 4232 Ta b l e 2 V7122 Digital Gateway Port Numbers Channel Number UDP Port T.38 Port (fax) General Formula: (n = channel number) 6000+10(n-1) 6002+10(n-1)[...]

12 C HAPTER 1: VC X S YSTEM S ECURITY IP Messaging Ports The IP Messaging System (vcxums) uses these ports. If your VCX system does not use IP Messaging, the integr ated fir ewall on each VCX server will disable access to these ports. Passwords VCX systems that ar e shipped from 3Com have default passwor ds configured for system-level login IDs. 3C[...]

SNMP 13 T o configure thi s capability using the Enterprise Management Suite: 1 For each VCX server , locate the Configuration tab for the SIP call process. 2 Set the "C hallengeAllCa lls” value to "true." SNMP The VCX system support s version v1 of the Simple Net work Management Protocol (SNMP). SNMP v1 passes co mmunity names in [...]

14 C HAPTER 1: VC X S YSTEM S ECURITY[...]

I NDEX A advisories, security 5 analog gateway ports 10 B back end server ports 8 C changing default passwords 12 commands, disabled 6 configuration, firewall 7 conventions notice icons, About This Guide 1 text, About This Guide 2 D digital gateway ports 10 disabled commands 6 F firewall c onfiguration 7 G gateway ports 10 P passwords, changing def[...]

16 I NDEX[...]